Insights
Practical thoughts on applied AI, automation and digital implementation – no hype, focused on what actually works in day-to-day operations.
Law & regulation
uniVersa, OpenAI, and a server that was open for a few hours: why AI crawlers are a new time-window problem
During an IT migration on 7 July 2026, insurer uniVersa left a server briefly accessible for a few hours - enough time for an OpenAI crawler to grab customer names, addresses, contract data, and in some cases bank details. The case was reported to Bavaria's data protection authority. At the same time, the European Data Protection Board adopted its first comprehensive guidelines on AI web scraping. Together, both developments point to a risk most companies don't have on their radar: AI crawlers run continuously and can exploit a brief configuration window immediately.
August 30, 2026 · 10 min read
Strategy & research
Nine in ten executives don't yet feel an AI effect - and staff and leadership expect opposite futures
An international study involving Germany's Bundesbank, the Bank of England, and the Atlanta Fed - roughly 6,000 executives surveyed in the US, UK, Germany, and Australia - finds: even though roughly 70 percent of companies actively use AI, nine in ten executives report no measurable effect on productivity or employment at their own firm over the past three years. For the future, though, executives and staff expect opposite developments - a documented expectations gap that's a leadership problem in its own right.
August 29, 2026 · 10 min read
Governance & guardrails
Anthropic v. the Pentagon: when an AI vendor's own usage policy becomes a political risk
A US federal court ruled on 27 August 2026 that the Pentagon's designation of Anthropic as a 'supply chain risk' was unconstitutional. The conflict was triggered by Anthropic insisting, during contract negotiations, that Claude not be used for autonomous weapons systems or domestic mass surveillance. The Pentagon responded with a designation normally reserved for foreign threat actors - effectively cutting Anthropic off from the entire federal contracting business. For companies using an AI vendor with its own ethical guardrails, the case shows: usage policies aren't just a marketing statement, but a real risk factor.
August 28, 2026 · 10 min read
Strategy & research
Nvidia buys Hugging Face for $12.9B - the neutral hub for open-source AI now belongs to the largest hardware vendor
Nvidia has reportedly agreed to acquire Hugging Face - the central platform for sharing open-source AI models - for $12.9 billion. Notably, Hugging Face explicitly rejected a much smaller investment from Nvidia in 2025, citing a wish to avoid a single dominant investor. For companies using open-source models specifically to avoid vendor lock-in, this creates a new, concentrated dependency - on the world's largest AI hardware vendor.
August 27, 2026 · 10 min read
Strategy & research
Nvidia raises AI server prices by over 15% - the real cause also affects your next laptop purchase
On 22 August 2026, Microsoft, Google, and Oracle were notified of price increases above 15 percent on Nvidia's upcoming AI servers. The stated reason - rising memory chip costs - sounds like a temporary supply hiccup. It's actually a permanent reallocation of global memory chip production toward AI accelerators, with consequences reaching far beyond AI servers: to every laptop, server, and hardware purchase a company plans over the coming years.
August 23, 2026 · 10 min read
Law & regulation
A US lawsuit against an AI notetaker shows the problem - in Germany it's criminal, not just civil
In August 2026, a former Marathon Engineering employee sued her former employer - the central evidence was the AI transcript of her own termination meeting, produced by the tool Fireflies. What US coverage treats as a consent and evidence question is something different in Germany: an unauthorized recording of spoken words without every participant's consent can be a criminal offense under Section 201 of the German Criminal Code (StGB) - and legal analyses show that's technically the case for most mainstream AI meeting tools.
August 22, 2026 · 11 min read
Law & regulation
GEMA v. Suno: Munich rules - and leaves open when your own prompt makes you liable
The Munich Regional Court I (Landgericht München I) largely sided with GEMA in its lawsuit against AI music generator Suno on 31 July 2026 - one of the most significant German rulings on generative AI and copyright to date. Per the court, liability currently sits with the provider, because users typically used simple, open-ended prompts. But the court explicitly leaves open that this reverses when a user works with repeatedly adjusted, steering instructions toward a specific protected work - exactly the pattern many marketing and content teams use when iterating with AI tools.
August 21, 2026 · 11 min read
Governance & guardrails
Anthropic's newest models force 30-day data retention - Microsoft restricted its own use over it
Since July 2026, Anthropic has required 30-day data retention for its newest and most capable models - Claude Fable 5 and the Mythos class - with no zero-data-retention option. Microsoft responded by restricting internal employee use while reviewing the policy. Yesterday, OpenAI unveiled a counter-approach, Private Safety Processing: abuse detection without full data retention. For companies choosing between the two vendors, or already running Fable 5, this is a concrete compliance decision, not an abstract debate.
August 20, 2026 · 11 min read
Product & cost
The Copilot surcharge on Microsoft 365 - and the Classic plan almost nobody gets
Since 1 July 2026, Microsoft 365 costs more worldwide for business customers - up to 43 percent, officially justified by newly integrated Copilot features. Per Microsoft's own numbers, though, fewer than 4.5 percent of its roughly 500 million customers actively pay for Copilot. While competition authorities in the UK, Australia, and Italy are now investigating whether customers were moved into pricier plans without a clear alternative, no comparable investigation exists for Germany - and the cheaper Classic plan without the AI surcharge remains practically hard to get here too.
August 19, 2026 · 10 min read
Governance & guardrails
OpenAI disbanded its Preparedness team - the very team that would have reviewed GPT-5.6-Cyber
OpenAI disbanded its Preparedness team at the end of July 2026 - the unit tasked with assessing whether frontier models pose catastrophic risks. It's the third safety-focused team OpenAI has dissolved in two years, and it coincides with the departure of its only dedicated ethics chief and its longtime COO - shortly before an expected IPO. That's the exact team that would have owned risk assessment for capabilities like GPT-5.6-Cyber, which we covered here days earlier.
August 18, 2026 · 11 min read
Strategy & research
Anthropic reports its first operating profit - exactly in the two months of discounted compute
Anthropic reported preliminary Q2 2026 figures: over $11.5 billion in revenue and the company's first-ever operating profit, two years ahead of schedule. Cross-referencing SpaceX's own IPO filing reveals something almost no report mentions: this exact quarter overlapped with a two-month discount period in Anthropic's largest new compute deal, with xAI. Not proof of accounting manipulation - but a reason not to take the figure at face value as evidence of durable profitability.
August 17, 2026 · 11 min read
Governance & guardrails
OpenAI's hacking model found real Chrome flaws - and access stays with five large partners
OpenAI has expanded its Daybreak program with a new tier, Daybreak Red, granting access to GPT-5.6-Cyber - a model that, per OpenAI's own benchmark, solves 95 percent of offensive security tasks where the standard model manages only 1.5 percent. The model already found real Chrome zero-days. What's missing from most coverage: access runs exclusively through five corporate partners - a mid-sized company doesn't get this defensive capability itself, only if its IT provider happens to be one of them.
August 15, 2026 · 11 min read
Governance & guardrails
An AI agent vendor is about to delete customer data - not over GDPR, but an order from Beijing
AI agent vendor Manus confirmed yesterday it is separating from Meta - after China's economic planning body forced an unwind of the $2 billion acquisition in April. From 23 August, Manus will delete the data of certain users created since the acquisition. I read Manus's own blog post: it doesn't mention business or team accounts once. This isn't a GDPR case - it's a vendor risk no European checklist covers.
August 14, 2026 · 11 min read
Law & regulation
Anthropic marks AI text worldwide - and its own documentation explains exactly how the mark disappears
Anthropic announced yesterday that it will mark AI-generated text and images worldwide - explicitly in response to Article 50 of the EU AI Act, which we covered here last week. But its own support documentation also states exactly how easily that mark disappears: through editing, translation, trimming, or stripped file metadata. Assuming Claude alone makes you compliant confuses the provider's duty with your own.
August 12, 2026 · 12 min read
Governance & guardrails
Meta makes local AI agents affordable for mid-sized companies - and ships its own security numbers alongside
Meta released Muse Glimmer today: a 30-billion-parameter agent model that runs on a single off-the-shelf graphics card. That makes local AI economically real for mid-sized companies for the first time - a break from the $30,000 to $110,000 a month we recently calculated for self-hosting a frontier model. But the same vendor materials also show Meta's own security benchmark reporting a higher attack success rate than a smaller competing model - for exactly the use case Meta is marketing this model for.
August 10, 2026 · 13 min read
Governance & guardrails
Anthropic's new checkpoint before every AI request - and the gap its own documentation admits to
Anthropic unveiled a new checkpoint for Claude Enterprise: every request gets sent to a company-run security server before processing. Press coverage frames it as the answer to a summer full of AI security incidents. A look at Anthropic's own technical documentation shows something else: exactly the gap we described last week in MCP servers is, by the vendor's own account, explicitly left open.
August 7, 2026 · 13 min read
Governance & guardrails
143,000 security flaws in MCP servers: old mistakes in a new place
Anaconda acquired AI security vendor Enkrypt AI - and its figure of 143,000 vulnerabilities in MCP servers comes from the very company that was about to be sold. Independent security research from six further sources confirms the underlying problem is real anyway. It just isn't a new AI risk - it's a twenty-year-old web security problem showing up somewhere almost nobody treats as an attack surface.
August 5, 2026 · 12 min read
Law & regulation
The EU AI Act duty nobody postponed
The postponement of the EU AI Act deadlines was real, correctly reported news. The problem is what many companies made of it: everything postponed, so nothing to do. On August 2, of all things the duty that affects almost every company with a chatbot became enforceable - and Germany's Bundesnetzagentur gained the power to check it on that exact day.
August 4, 2026 · 12 min read
Strategy & research
Azure's growth number is not a demand number – how to read an earnings report as a capacity forecast
On 29 July, Microsoft reported 43 percent Azure growth and was celebrated for it on the stock market. What gets lost in the coverage: in the same call, the CFO confirms that demand exceeds supply. That means the celebrated number is not demand – it is the limit of what Microsoft managed to deliver. Read correctly, it becomes a capacity forecast for your own project.
July 31, 2026 · 12 min read
Governance & guardrails
When it mattered, the tool refused to work
Nvidia and 44 partners have founded an alliance for open AI security tooling. The stated reason turns the usual debate on its head: during the attack on Hugging Face, closed AI tools blocked the forensic analysis because they could not tell attackers from defenders. That points to a risk category almost no company has on its register.
July 30, 2026 · 13 min read
Strategy & research
Compute is no longer a commodity, it is a waiting list – and your provider is standing in it too
Three stories from 48 hours are being discussed separately: a 250-billion-dollar guarantee from Nvidia, a rationed Azure, and the largest openly released language model ever. They describe the same finding. Compute is the scarce good, it is allocated by priority list – and with a proprietary model there is exactly one queue, in which your provider stands ahead of you with its own product.
July 27, 2026 · 13 min read
Strategy & research
The effort dial in Claude Opus 5: why the real feature isn't the half-price headline
The headline on Claude Opus 5: frontier performance at half the price. The more important change for companies sits quietly beside it - a dial that sets, per request, how hard the model thinks. It doesn't save money on its own. It hands you a decision that defaults to expensive. And the fact that two competitors are suddenly marketing efficiency instead of intelligence is the truly telling signal.
July 25, 2026 · 13 min read
Governance & guardrails
The second OpenAI incident: for five days it was an attack. Then it was an accident.
Three weeks after the first OpenAI incident, exactly what that piece called a rare edge case actually happened: a real sandbox escape. For five days, the security industry treated the attack on Hugging Face as cybercrime by an unknown actor - until OpenAI admitted it was their own model. The recorded attack technique didn't change one bit in those five days. Only the verdict did. That shift is the real lesson.
July 24, 2026 · 14 min read
Governance & guardrails
The OpenAI incident: why your AI agent is not a new employee
The headline: an AI escaped its sandbox. Technically that's wrong - it was a permissions gap. And that's exactly why the incident isn't an exotic frontier problem but the same class of failure that hits every company running a production AI agent. The costliest mistake: treating an agent like a new employee.
July 21, 2026 · 13 min read
Strategy & research
The Kimi K3 shock: why the market is repeating a bet it already lost
A Chinese model supposedly wiped out $3.3 trillion in market value. The chronology says otherwise: the selloff began three weeks earlier. The same bet was placed in January 2025 - and played out differently than the market expected. For your AI budget, the real news is another one entirely.
July 20, 2026 · 14 min read
Governance & guardrails
Kimi K3 and GDPR: what the Chinese price advantage really costs in practice
Moonshot AI unveiled Kimi K3, the largest open-weight language model in the world - cheaper than Western flagship models. The obvious fix for the GDPR problem, self-hosting, is economically irrelevant for most businesses. The real finding lies elsewhere: for the previous generation, EU hosting already exists that's cheaper than Moonshot's own China API.
July 20, 2026 · 12 min read
Product & cost
What an MVP really costs: the flaw in the thinking behind most quotes
"Software projects always spiral out of control" is the fear that paralyses more MVP decisions than any real cost estimate – based on studies of multi-million-dollar projects that have nothing to do with an MVP. The real insight: a fixed-price quote is an insurance premium against the very ambiguity you bring to the table yourself. And AI tools don't currently fix what actually blows MVP budgets.
July 14, 2026 · 13 min read
Governance & guardrails
NIST AI RMF and ISO 42001: what AI governance frameworks actually deliver – and what they don't (yet)
NIST AI RMF and ISO/IEC 42001 are usually sold as a compliance exercise – because of the EU AI Act. The research shows something different: the legislator doesn't even recognise ISO 42001 as legal protection yet, but procurement teams at large customers are already asking for the structure behind it. Plus: an original translation table from the four NIST functions to concrete technical guardrails.
July 12, 2026 · 13 min read
Strategy & research
The future of AI: what can be seriously predicted – and what can't
Everyone has an opinion on the future of AI – researchers, CEOs, consultants, journalists. Almost none of these opinions are held to what research has actually found about forecasting itself. This article does something different: it separates what can be robustly predicted from what's pure speculation – with data, not another opinion.
July 10, 2026 · 13 min read
Architecture & licensing
AI in your own software – via MCP and your subscription, without paying for the API
"Do I really have to pay for the expensive API to get AI into my software?" – the surprising answer: for your own use, often no. The Model Context Protocol (MCP) lets you connect your custom software to your existing Claude or ChatGPT subscription. What's allowed, how it works for companies, what the vendors say – and where the approach hits its limits.
July 9, 2026 · 12 min read
Law & regulation
The EU AI Act: what companies really need to know – and what's just panic
"Now we have to get everything CE-certified" and "that's a 35-million fine" are the two sentences that poison every AI Act discussion – and for most companies they're simply wrong. What the EU AI Act actually requires, which role decides your workload, and the one duty that has applied since February 2025 and almost nobody has implemented.
July 8, 2026 · 12 min read
Law & data protection
GDPR and AI: where German data protection law actually slows companies down – and where it doesn't
"GDPR blocks pretty much everything anyway" is the sentence that ends - or never starts - most AI initiatives in German companies. The honest answer is more nuanced: an overview of the four places where data protection genuinely sets limits, and what's currently changing in 2026.
July 7, 2026 · 11 min read
AI architecture
RAG instead of fine-tuning: how your company puts AI to work on its own data without training it
"We want our own AI model" usually means something different in first conversations: AI should know your company's existing knowledge, not be retrained from scratch. Why Retrieval-Augmented Generation (RAG) is almost always the better answer than fine-tuning - and where the real work actually is.
July 6, 2026 · 9 min read
Automation
Where does automation actually pay off? Why most ROI math is too optimistic
Gartner, EY and Deloitte independently put automation project failure rates at 30 to 50 percent. The cause is rarely the technology – it's how ROI gets calculated. A framework for which processes are genuinely worth it.
July 4, 2026 · 10 min read
Automation
From manual quotes to an automated quoting process
Quote automation saves more than typing – it's a sales lever. Where automating the quoting process really pays off, where AI helps and where it's out of place.
July 3, 2026 · 9 min read