Every story in this edition, newest first.
Article 25 governs the handoff. Most insurers, lenders and HR platforms have not asked their providers for what they will have to produce on day one of the high-risk regime.
The draft strategic plan gives digital assets a policy home, but the useful signal is whether the agency can turn that posture into rules before enforcement fills the gap again.
Europe's financial regulators are treating major ICT incidents as cross-border evidence, not local outage paperwork, while AI-driven attack tooling raises the coordination bar.
The useful question is not whether Europe needs another social app. It is whether AT Protocol lets media operators separate identity, data, feed logic, and moderation without inheriting a platform-sized burden.
Colorado's amended Regulation 10-1-1 creates the first hard July 1 2026 deadline for US insurers to file attested AI governance and bias-testing programs covering ECDIS in underwriting and pricing, turning the state's rules into the practical national compliance floor.
SEBI's in-house surveillance tool Sudarshan has produced its first named enforcement action — a structural inversion of how most jurisdictions sequence AI in finance.
A 7 May 2026 provisional political agreement delays the EU AI Act's high-risk obligations for credit-scoring and life/health insurance AI from August 2026 to December 2027, yet BaFin, ECB and FCA supervisory pressure on governance and oversight continues unabated.
The FSA's Financial System Council just recommended that licensed crypto exchanges hold liability reserves on the same quantitative formula traditional securities firms already use — turning user compensation from a discretionary fund into a compliance line item, with the bill due in the 2026 Diet session.
The SFC's 20 April circular routes secondary trading of tokenised SFC-authorised funds exclusively through licensed VATPs — the first time a major regulator has put traditional product flow inside crypto plumbing.
The Basel Committee approved an ICT incident-management report this month and, in the same minute, named frontier AI as a force that may change the speed and scale of malicious cyber incidents — the report sets the ceiling national supervisors will be measured against.
South Korea's Digital Asset Basic Act would make commercial banks the structural anchor of every won-pegged stablecoin, on the inverse of the model that licensed almost every EU issuer as a non-bank.
Supervisors set the 300 bp CET1 depletion target; banks must construct and defend the geopolitical scenario that produces it, with qualitative SREP consequences ahead.
The FSA foreign-stablecoin ordinance takes effect in seven days. The LDP recommendation above it wants tokenised deposits, wholesale CBDC and automated settlement coordination on the same five-year timeline.
Brazil's AI infrastructure story has stopped being about grid capacity and started being about how operators count water, power and renewable claims.
New York's financial regulator is telling banks and insurers to prove that ordinary cyber controls still work when AI compresses vulnerability discovery.
IRDAI's AI-cyber deadline turns insurer security from readiness language into written proof of preventive, detective and response controls.
Enterprise AI-agent risk is moving from prompt safety into inventory, permissions, lifecycle control and decommissioning.
The Pensions Regulator is moving AI oversight into scheme governance, member protection, data quality and provider assurance.
Email security is not losing because phishing got poetic; it is losing when payloads, relationships and user behavior move faster than controls.
The Bank of England, FCA and Treasury have moved frontier-AI cyber risk into the same operating lane as patching, third-party control and recovery proof.
MAS is moving bank AI oversight from fairness principles into inventories, impact assessments, vendor controls and board reporting.
SDAIA is connecting AI adoption, personal-data compliance and ethics review through practical tools rather than another strategy slide.
Japan's FSA is not treating frontier-AI cyber risk as a memo problem; it is building a practitioner loop across banks, vendors, the central bank and model providers.
Enterprise data security is moving from files and email into prompts, uploads, browser sessions and personal AI accounts.
