Fine Print

The four largest AI companies have agreed to honour a new shared standard that lets publishers block AI training crawlers with a single line in their robots.txt file — the text file websites use to tell web crawlers what they can and cannot access, according to The Verge.

Currently, blocking each company's crawler requires separate, individual instructions. The new "policy token" signal, proposed through the IETF (Internet Engineering Task Force — the body that sets internet standards), would cover all participating companies at once. Anthropic has already adopted it. Google and Microsoft plan to follow in 2025; OpenAI says it will implement it "in the coming months." Meta signalled support but has not confirmed it will comply.

If you run a website and care about this, the robots.txt change is what to watch for.

The EU's CiTiVERSE consortium — a group building shared AI infrastructure for European cities — is presenting at Smart City Expo World Congress 2026 this week. The focus is on local digital twins (virtual models of cities used to simulate planning decisions) and how AI can support public services and governance. The event is part of the EU's AI Innovation Month. No new regulation or binding guidance was announced, but it signals continued EU investment in government-led AI deployment at the city level.

NIST (the US National Institute of Standards and Technology) has released NISTIR 8547, a roadmap for switching from today's encryption to quantum-resistant standards before powerful quantum computers can crack them.

Federal high-value systems must migrate by 2030–2031. Organisations working with the federal government will face the same pressure indirectly.

The practical threat is real now: attackers can collect encrypted data today and decrypt it later once quantum hardware matures — a strategy called "harvest now, decrypt later." If your organisation stores sensitive data, checking which encryption algorithms you rely on is a sensible first step.

Meta revised its business account terms after publishing language that appeared to allow it to train AI models on any content from websites associated with a business account. The revised terms, which take effect October 30th, drop the explicit word "train" — but legal experts tell Nieman Lab via The Verge that the word "develop" remains broad enough to cover it. Meta alleges its terms were never designed to enable news site scraping. Cornell law professor James Grimmelmann and media attorney Matt Topic both dispute that characterisation.

What you can do: check your robots.txt settings and review Meta's business terms before October 30th.

OpenAI published a policy document this week calling on governments and AI companies to act before advanced offensive cyber tools become widely available, according to the company's own announcement.

The blueprint covers three areas: clearer accountability for securing AI models, better tools and training for cybersecurity defenders, and stronger government oversight and incident reporting requirements.

It is a proposal, not a regulation. No binding commitments are attached. For ordinary users, the relevant signal is that OpenAI is publicly acknowledging that the same AI capabilities that help defenders can be used to attack — and that without new rules, the offensive side gets there first.

The European Commission has published a study under the Digital Services Act (DSA) — the EU law that sets obligations for large online platforms — mapping how financial scams operate across social media, search engines, and app stores. Commissioned in 2025, the study identifies six scam categories, with investment and romance scams flagged as the fastest-growing in Europe. It also finds that generative AI is lowering the barrier to entry for organised scam networks.

The practical upshot: platforms covered by the DSA will face growing pressure to improve identity verification, ad screening, and content moderation. Read the study here.

Meta has deleted a clause from its commercial terms of service that legal experts, including a Cornell professor of digital and information law, interpreted as giving the company permission to scrape any website — including news publishers — to train its AI, and to override the standard blocking instructions sites use to opt out of crawlers.

Meta says the language only ever applied to its ads and business products and that nothing about how it crawls the web has changed. The clause is now gone regardless.

If you run a website, the standard opt-out method — a robots.txt file — remains your primary tool. Check that it is current.

Google DeepMind and Singapore's Government Technology Agency have jointly fine-tuned an AI scam-detection model, presented at Singapore International Cyber Week 2026, according to Google DeepMind. The model runs entirely on-device, meaning conversations are never sent to Google or the government — analysis happens on the phone itself. It was trained on local scam patterns, including impersonation of Singapore public institutions and officials, which generic models often miss. Rollout within applications is being phased carefully. No launch date has been confirmed.

Google published a safety report alongside today's Argon launch, according to DeepMind. It flags that Argon showed elevated capability in both cybersecurity and biology, prompting Google to add three layers of real-time protection: screening inputs for harmful intent, reading internal neural signals to catch disguised dangerous requests, and monitoring outputs as they generate.

Google gave a limited group of trusted security researchers early access before the public launch. That window turned up a critical bug in hospital software affecting hundreds of thousands of patient records.

For ordinary users, the report means Argon was not released on a press-release schedule — there was a deliberate safety review first.

The European Commission held a special meeting of its Scientific Panel on frontier AI safety this week, according to the EU digital strategy office. The panel — 60 independent experts advising the EU AI Office — has been reviewing recent incidents where AI models acted outside their intended boundaries. It presented formal safety recommendations to the Commission.

Executive Vice-President Henna Virkkunen confirmed the EU AI Act is the world's first law specifically addressing systemic risk from AI. The panel's recommendations are expected to inform enforcement decisions. No specific measures have been announced yet.