European Commission takes four countries to EU court over NIS2 delays

The European Commission has referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to transpose the NIS2 Directive fully into national law.

The Directive strengthens the EU cybersecurity rules and sets common requirements for organisations operating in critical sectors.

Member states were required to transpose NIS2 by 17 October 2024, but the four countries have not notified the Commission of full implementation.

The referrals follow earlier infringement steps. The Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025.

The Commission is asking the Court to impose financial sanctions, including a lump sum and daily penalties until the countries notify complete transposition.

NIS2 applies to entities in 18 critical sectors, including health, energy, transport and public administration.

The Directive aims to improve national and EU-wide cyber resilience by strengthening risk management, incident response and security obligations for public and private entities.

The Commission said full implementation is essential for improving the EU’s overall resilience and the incident response capacity of organisations operating in critical sectors.

Why does it matter?

The referral shows that the Commission is prepared to enforce cybersecurity law against member states that fail to meet implementation deadlines. NIS2 is designed to create a more consistent baseline of cyber resilience across the EU, but delays in national transposition can leave organisations facing fragmented obligations and uneven enforcement. For critical sectors, consistent implementation is central to risk management, incident response and cross-border resilience.

Would you like to learn more about AI, tech and digital diplomacyIf so, ask our Diplo chatbot!

ECB urges banks to prepare for AI cyber threats

The European Central Bank has called on major euro area banks to prepare action plans to address AI-enabled cybersecurity threats.

In a letter to bank CEOs, ECB Banking Supervision said emerging AI models can identify software vulnerabilities and generate functioning exploits at unprecedented speed.

The ECB warned that AI is compressing the time between vulnerability discovery and exploitation, with potentially serious implications for the confidentiality, integrity and resilience of banks’ ICT systems.

The central bank said the change is a long-term shift in the threat landscape, not a temporary risk linked to a single tool.

Banks have been asked to submit action plans to their Joint Supervisory Teams by 31 October 2026.

The plans should set out concrete measures, resources, roles, responsibilities and implementation timelines for strengthening cyber resilience.

Short-term priorities include faster vulnerability and patch management, stronger monitoring and detection, AI-enabled defensive capabilities and updated third-party risk management.

The ECB also called for structural measures such as defence-in-depth, improved cyber hygiene, infrastructure modernisation, crisis management, recovery arrangements and information-sharing.

The letter follows a European Systemic Risk Board warning about systemic cyber risks posed by frontier AI models.

ECB Banking Supervision also said it will address cybersecurity risks linked to quantum computing in a separate letter.

Why does it matter?

The ECB letter turns AI-enabled cyber risk into a concrete supervisory issue for major euro area banks. If AI accelerates vulnerability discovery and exploit generation, banks will face shorter windows for patching, detection and response. The focus on third-party providers and supply chains is also important because financial institutions depend heavily on external ICT services. The ECB’s approach links AI cyber threats with DORA-style operational resilience, showing that advanced AI is now part of mainstream financial supervision.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

ESRB urges EU action on frontier AI cyber risks in finance

The European Systemic Risk Board has warned that frontier AI models could strain cyber resilience in the EU financial system by increasing the speed, scale and sophistication of cyberattacks.

The warning follows the ESRB General Board’s assessment that systemic cyber risk has risen to ‘severe’, up from ‘elevated’ earlier this year.

The ESRB defines frontier AI models as advanced AI models capable of materially affecting offensive or defensive cyber operations.

According to the Board, these models may eventually strengthen cyber resilience, but in the short to medium term, they are likely to give threat actors an advantage.

The ESRB said frontier AI can help attackers discover vulnerabilities and execute cyberattacks more quickly and at greater scale.

It also warned that the concentration of leading AI providers outside the EU creates strategic dependency and geopolitical risks.

The Board called on the EU to scale up capacity, expertise and strategic autonomy in frontier AI and cybersecurity.

It said the response should involve AI providers, software providers, security firms, open-source maintainers, financial institutions and authorities at the national and the EU level.

The ESRB said it will continue monitoring the development and use of frontier AI models with cyber capabilities and their impact on the financial sector from a systemic risk perspective.

Why does it matter?

The ESRB warning puts frontier AI into the financial stability debate. If advanced AI models help attackers identify vulnerabilities and launch cyberattacks more quickly, financial institutions could face shorter response windows and greater systemic risk. The warning also links cybersecurity to the EU strategic autonomy, because dependence on non-EU AI providers could affect the resilience of Europe’s financial infrastructure during crises.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

European Commission launches AI cyber defence strategy

The European Commission has presented an Action Plan on Cybersecurity and Artificial Intelligence to strengthen Europe’s response to AI-related cyber risks.

The plan aims to help member states, businesses and public authorities use AI safely while addressing the cybersecurity risks created by advanced AI models.

The Commission said AI can help detect vulnerabilities, prevent cyberattacks and protect critical infrastructure. However, it warned that malicious actors can also use AI to automate attacks, identify weaknesses and carry out cyber operations at greater speed and scale.

The Action Plan focuses on three objectives: promoting the safe and responsible use of advanced AI, reinforcing EU cybersecurity and resilience, and scaling up Europe’s AI capabilities for cybersecurity.

The Commission said it will strengthen Europe’s capacity to evaluate AI models before they are placed on the EU market, in line with the AI Act.

It will also work with ENISA to develop a European Blueprint for secure access to advanced AI systems for cybersecurity purposes.

A secure testing platform will support organisations in critical sectors, including energy, transport, health, finance and public administration, in testing and deploying AI solutions safely.

The plan also encourages the use of AI, including open-source models where appropriate, to detect vulnerabilities faster and improve prevention and response to cyberattacks.

The Commission said it will launch an EU Grand Challenge on AI for cybersecurity to support the development of new AI-powered security solutions.

Why does it matter?

AI is becoming central to both cyber defence and cybercrime. The EU Action Plan recognises that advanced models can help defenders detect vulnerabilities and respond faster, but can also help attackers automate operations and scale incidents. By linking AI model evaluation, critical-sector testing, ENISA cooperation, existing cybersecurity laws and investment in sovereign AI capabilities, the Commission is trying to turn AI cybersecurity into a coordinated EU policy area rather than leaving it to fragmented national or private-sector responses.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

Claude Fable 5, frontier AI models and the future of cybersecurity

The release of Anthropic’s Claude Fable 5 may prove to be one of the most significant AI developments of 2026. At first glance, the launch appeared to be another milestone in the rapidly evolving frontier AI landscape, showcasing improvements in reasoning, software engineering and complex problem solving.

Yet within days, Fable 5 became the centre of an international debate involving cybersecurity, national security, export controls and technological sovereignty.

Anthropic introduced Fable 5 as a public-facing version of its more advanced Mythos 5 model, offering access to frontier-level capabilities while incorporating additional safeguards designed to limit misuse in sensitive domains.

Anthropic has launched Claude Fable 5

The company presented the model as a major step forward in AI performance, particularly in coding, reasoning and autonomous task completion. However, concerns surrounding its cybersecurity capabilities quickly caught the attention of policymakers and security agencies.

The situation escalated when the USA imposed export control restrictions, affecting access to Anthropic’s most advanced models. What began as a product launch rapidly evolved into a broader discussion about whether frontier AI systems should be treated as strategic technologies comparable to advanced semiconductors, encryption systems, or critical infrastructure.

The story, however, did not end there. Less than three weeks later, the US government lifted the restrictions after Anthropic introduced additional safeguards, strengthened collaboration with federal authorities, and agreed to participate in a broader framework for evaluating frontier AI security.

Rather than representing a simple regulatory dispute, the episode demonstrated how frontier AI governance is becoming an evolving process built upon continuous technical assessment, industry cooperation, and government oversight.

The Fable 5 episode highlights a reality that is increasingly difficult to ignore. AI is no longer simply a tool for productivity and innovation. Frontier models are emerging as technologies with profound implications for cybersecurity, national defence, economic competitiveness, and international relations.

As governments and companies struggle to understand the opportunities and risks associated with increasingly capable AI systems, Fable 5 offers an early glimpse into what could become one of the defining policy debates of the coming decade.

The rise of frontier AI models

The concept of a frontier AI model refers to the most advanced systems available at a given moment. These models represent the leading edge of AI capabilities and often demonstrate performance levels significantly beyond previous generations.

Claude Fable 5 belongs to this category. Anthropic designed the model to perform complex reasoning tasks, analyse large quantities of information, generate software code and assist users with sophisticated technical challenges.

Unlike earlier generations of AI assistants that primarily focused on conversational interactions, frontier models increasingly function as problem-solving systems capable of performing intricate tasks across multiple domains.

One of the most notable characteristics of Fable 5 is its ability to assist with software engineering and technical analysis. The model can review source code, identify patterns, suggest improvements and help users navigate highly complex technical environments.

Such capabilities are particularly valuable in cybersecurity, where analysts often face enormous volumes of code, logs and threat intelligence data.

Behind Fable 5 is Mythos 5, a model that Anthropic initially released only to trusted participants in Project Glasswing, a programme focused on defensive cybersecurity research.

More organisations gain access through Anthropic to advanced AI cyber defence tools.

While Mythos offers stronger offensive cybersecurity capabilities for vetted organisations, Fable 5 was designed for broader public use with significantly stronger safeguards that limit potentially dangerous behaviour without substantially reducing its usefulness for legitimate applications.

Anthropic has emphasised that Fable 5 was subjected to extensive testing and red teaming before its release. In the weeks preceding its launch, the company reportedly reassigned researchers and engineers from multiple teams to strengthen its cybersecurity protections, reflecting a growing recognition that frontier models require safety engineering on a scale previously unseen in commercial AI development.

The challenge is that the same qualities that make frontier models like the Fable 5 valuable also make them strategically important. As AI capabilities continue to advance, governments increasingly view these systems not merely as software products but as assets with potential national security implications.

Why the USA intervened

The US decision to restrict access to Anthropic’s most advanced models marked a significant turning point in the AI governance debate.

Historically, the release of AI systems has largely been managed by technology companies themselves. Governments have generally focused on regulation and oversight rather than direct intervention in model availability.

The response to Fable 5 suggests that such an approach may be changing.

The primary concern involved cybersecurity capabilities. Mythos-class models demonstrated the ability to identify software vulnerabilities and assist with highly advanced technical analysis. While such capabilities offer substantial defensive benefits, they also raise concerns about potential misuse.

The immediate trigger came after Amazon researchers identified a technique capable of bypassing some of Fable 5’s cybersecurity safeguards.

During testing, the model successfully identified several software vulnerabilities and, in one instance, generated code illustrating how one of those vulnerabilities could be exploited.

Although Anthropic argued that comparable outputs could also be obtained from several existing AI models and that the behaviour did not expose Mythos-level offensive capabilities, the incident convinced US authorities that additional safeguards were necessary before wider deployment.

From a national security perspective, policymakers increasingly fear that highly capable AI systems could assist malicious actors in discovering vulnerabilities, developing exploits or conducting cyber operations at a scale that exceeds existing defensive capabilities.

As a result, access to frontier models is beginning to resemble access to other strategically important technologies.

The restrictions also generated controversy because they affected not only geopolitical competitors but also close allies.

Since Anthropic had no practical method for verifying users’ nationality in real time, it temporarily suspended access to both Fable 5 and Mythos 5 for all users rather than attempting selective enforcement.

The incident highlighted the growing reality that access to frontier AI may increasingly become subject to geopolitical considerations.

Yet the restrictions ultimately proved temporary. Following intensive collaboration between Anthropic, Amazon, and US government agencies, the Department of Commerce lifted the export controls after Anthropic implemented stronger safeguards.

US Commerce Department Anthropic Claude Fable 5

The company introduced a new safety classifier capable of blocking reported behaviour in more than 99% of tested cases while redirecting potentially dangerous requests to its less capable Opus 4.8 model.

The episode represents a significant shift in frontier AI governance. Rather than relying solely on regulation or voluntary commitments, governments and developers increasingly appear to favour continuous technical evaluation, rapid safeguard improvements and close operational cooperation.

AI as a cybersecurity defender

Despite concerns about misuse, the defensive potential of frontier AI models is immense.

Cybersecurity professionals face an increasingly difficult environment. Organisations must defend against ransomware groups, state-sponsored actors, supply chain attacks, phishing campaigns and countless other threats.

At the same time, many organisations struggle with cybersecurity talent shortages and limited resources.

Frontier models offer a potential solution.

Systems such as Fable 5 can analyse software code, identify vulnerabilities, process threat intelligence and support incident response activities at speeds that would be impossible for human analysts alone. Tasks that previously required days of manual effort can often be completed in minutes.

The implications extend well beyond private sector organisations. Governments, healthcare providers, financial institutions, energy companies and critical infrastructure operators could all benefit from AI-assisted security capabilities.

Frontier models may help defenders identify vulneabilities before attackers discover them, improving overall resilience across digital ecosystems.

Anthropic argues that Mythos 5 was specifically developed to support trusted organisations engaged in defensive cybersecurity. Rather than serving as an offensive cyber tool, the model is intended to accelerate vulnerability discovery, strengthen software security and improve defensive research.

In many respects, it illustrates the central dilemma surrounding frontier AI. The same capability that appears dangerous in one context may become invaluable when deployed responsibly by trusted defenders.

The US government has increasingly recognised the potential. Recent policy initiatives encourage frontier AI developers to collaborate with federal agencies through pre-release testing, shared evaluations and coordinated threat intelligence.

Anthropic has now committed to expanding that cooperation by providing designated government partners with early access to future frontier models, supporting joint research efforts and participating in security evaluations before broader public deployment.

Perhaps most importantly, the Fable 5 episode demonstrates that cybersecurity is becoming one of the primary drivers of frontier AI development.

While public attention often focuses on conversational abilities or creative applications, governments increasingly judge advanced models by their ability to strengthen national cyber resilience.

As cyber threats continue to grow in scale and sophistication, frontier AI like Fable 5 may become an indispensable component of future defensive strategies.

The emergence of the AI-enabled attacker

The problem is that cybersecurity has always been a dual-use domain. Every major defensive innovation has historically created new opportunities for offensive actors, and frontier AI models are unlikely to be an exception.

Ironically, the same capabilities that help defenders can often help attackers.

A model capable of identifying vulnerabilities can potentially assist malicious actors in locating weaknesses within software systems. A system that helps defenders analyse code can also support offensive security research.

Likewise, a model capable of generating scripts for legitimate automation may also assist with harmful activities if appropriate safeguards are bypassed.

Frontier AI cybersecurity

Such a reality has led many experts to describe frontier AI as both a shield and a sword.

Security agencies have repeatedly warned that AI is lowering the barriers to entry for cybercriminals. Activities that once required extensive technical expertise may become increasingly accessible through AI assistance.

Phishing campaigns, malware development, reconnaissance operations, exploit research, and vulnerability discovery could all become faster and considerably more efficient.

The concern that extends beyond individual hackers is that organised cybercriminal groups and state-sponsored actors already possess substantial technical expertise.

Frontier AI does not necessarily replace that expertise, but it has the potential to amplify it significantly. Operations that previously required specialised teams and considerable preparation may eventually be conducted more rapidly, with greater precision, and at a much larger scale.

The emergence of AI agents further increases these concerns. Unlike traditional chat-based assistants, autonomous agents are increasingly capable of performing multi-step tasks with limited human supervision.

In a cybersecurity context, Fable 5 and similar systems could theoretically identify vulnerabilities, gather intelligence, write software, execute defensive workflows, or assist with incident response almost autonomously. The same autonomy, however, could also be abused if deployed for malicious purposes.

Rather than eliminating cyber threats, frontier AI may fundamentally change the nature of digital conflict. Success may increasingly depend not only on technological capability but also on who can adapt more quickly as AI systems continue to evolve.

The limits of safety guardrails

Recognising the risks associated with powerful AI systems, Anthropic implemented extensive safeguards within Fable 5.

The company sought to make the model widely accessible while limiting its ability to assist with highly sensitive activities. Certain cybersecurity, biological and other high-risk requests are subject to additional restrictions. Anthropic has argued that such measures significantly reduce the likelihood of misuse.

Unlike previous generations of AI models, Fable 5 relies on multiple overlapping layers of protection rather than a single safety mechanism. Anthropic describes this approach as defence in depth.

Fable 5 Anthropic multilayer protection AI model

The model combines behavioural training, specialised safety classifiers, continuous monitoring, and post-deployment analysis to detect potentially harmful cybersecurity requests before they reach the model itself.

One of the most important components of the system is the use of dedicated safety classifiers. These smaller AI systems analyse prompts in real time to determine whether they involve potentially dangerous cybersecurity activities.

Requests that appear harmful or sufficiently ambiguous are blocked before the model generates a response.

Following the June export control directive, Anthropic introduced an improved classifier specifically designed to detect the jailbreak technique identified by Amazon researchers. According to the company, the updated safeguard blocks the reported behaviour in more than 99 per cent of tested cases.

An additional layer of protection redirects blocked requests away from Fable 5 altogether. Instead of simply refusing to respond, certain requests are automatically transferred to Anthropic’s less capable Opus 4.8 model, allowing legitimate users to continue working while preventing access to Fable 5’s more advanced cybersecurity capabilities.

Yet the broader AI industry has learned that no safeguard system is perfect.

Researchers continue to demonstrate that even highly protected frontier models remain vulnerable to sophisticated jailbreak techniques and adversarial attacks. Determined users often find creative ways to circumvent restrictions, particularly when motivated by financial gain or malicious intent.

Anthropic itself acknowledges that it is probably impossible to develop a frontier AI model that is completely immune to jailbreaks. Rather than pursuing absolute protection, the company aims to make successful attacks sufficiently difficult, resource-intensive, and technically demanding enough to make the overwhelming majority of malicious attempts impractical.

Such a philosophy represents an important evolution in AI safety. Security is no longer viewed as a binary condition in which systems are either safe or unsafe. Instead, it is increasingly understood as a continuous process of risk reduction, rapid adaptation, and ongoing improvement.

Does it mean that safeguards are ineffective?

On the contrary, they play a critical role in reducing risk and raising barriers to misuse. However, the Fable 5 debate illustrates that AI safety should be understood as an ongoing process rather than a final destination.

As frontier models become increasingly capable, organisations will need to invest continuously in monitoring, testing and improving security measures. The challenge is not simply to build safeguards but to adapt them within an environment where both AI capabilities and attack techniques evolve rapidly.

AI sovereignty and strategic dependence

Perhaps the most unexpected consequence of the Fable 5 controversy was the renewed focus on AI sovereignty.

AI sovereignty security infrastructure

For years, discussions about technological sovereignty centred on semiconductors, telecommunications infrastructure and cloud computing. Frontier AI models are now becoming part of this debate.

The temporary disruption of access to Anthropic’s most advanced systems demonstrated how governments, businesses and research institutions can become dependent on technologies they do not control.

If access to frontier AI can be restricted through export controls or national security directives, organisations may face strategic vulnerabilities similar to those associated with dependence on foreign energy supplies or critical infrastructure.

Although the restrictions were ultimately lifted, the episode served as an important reminder that access to frontier AI increasingly depends not only on technological capability but also on trust between governments, developers and international partners.

Anthropic’s decision to strengthen safeguards, deepen cooperation with US authorities and expand information sharing became central to restoring global access to Fable 5.

The issue is particularly relevant for the EU and other allied nations. Many countries possess strong AI research communities but remain dependent on a relatively small number of companies for access to the world’s most advanced models.

As a result, policymakers are increasingly discussing sovereign AI capabilities, domestic model development and technological autonomy. What once seemed like a long-term aspiration is now viewed by many as an urgent strategic consideration.

The Fable 5 episode revealed that access to AI itself could become a geopolitical issue.

Frontier models and the future of cybersecurity

Looking ahead, frontier AI models are likely to transform cybersecurity in ways that far exceed current debates.

Future defensive systems could continuously monitor networks, analyse software, identify vulnerabilities, and recommend mitigations with minimal human intervention.

AI-powered assistants could become standard components of security operations centres, helping analysts respond to threats more effectively.

At the same time, offensive capabilities are likely to evolve. Adversaries may use AI to automate reconnaissance, analyse targets and adapt attack strategies dynamically. Cybersecurity may increasingly involve interactions between competing AI systems rather than interactions solely between human operators.

Some experts argue that the future of cyber conflict will be defined by machine-versus-machine competition, with humans providing oversight and strategic direction rather than performing every operational task themselves.

Equally significant is the emerging effort to establish common security standards for frontier AI.

One of the most important outcomes of the Fable 5 controversy has been Anthropic’s collaboration with Amazon, Microsoft, Google and other Project Glasswing partners to develop a shared framework for evaluating AI jailbreaks.

The proposed methodology assesses capability gains, breadth of misuse, ease of weaponisation, and discoverability, creating a common language through which developers and governments can evaluate the severity of newly identified vulnerabilities.

If successful, such a framework could play a role similar to the Common Vulnerability Scoring System, which has long provided the cybersecurity community with a common method for assessing software vulnerabilities.

Standardising how AI jailbreaks are evaluated would enable developers to prioritise responses more consistently while allowing governments to better understand the actual level of risk posed by newly discovered attacks.

The initiative also reflects a broader shift in frontier AI governance. Rather than relying exclusively on post-deployment regulation, governments and developers are increasingly cooperating during the development process through pre-release testing, shared evaluations, coordinated threat intelligence, and continuous red teaming.

2151977487

Such a future offers enormous potential benefits. It could significantly improve security outcomes, reduce response times, and strengthen resilience across critical infrastructure sectors.

Yet it also introduces new challenges involving accountability, transparency, control, and governance. Ensuring that increasingly autonomous systems remain aligned with human objectives will become one of the central cybersecurity questions of the AI era.

Conclusion

The release of Claude Fable 5 may ultimately be remembered as more than a technological milestone. It represents one of the clearest examples to date of how AI, cybersecurity, national security, and technological sovereignty are becoming deeply interconnected.

For defenders, frontier AI models offer unprecedented opportunities to strengthen security, improve resilience, and respond more effectively to an increasingly complex threat environment. For attackers, many of the same capabilities create opportunities to automate, scale, and enhance malicious operations.

The resulting tension lies at the heart of the Fable 5 debate. Frontier AI is neither inherently beneficial nor inherently harmful. Its impact depends on how it is developed, governed, and deployed.

Perhaps the most important lesson from the Fable 5 episode is that frontier AI governance is beginning to move from theory to practice.

The rapid sequence of export controls, technical reviews, stronger safeguards, renewed deployment and closer cooperation between Anthropic and the US government demonstrates that innovation and security do not necessarily have to be in opposition.

Instead, they increasingly depend on continuous collaboration between governments, researchers, technology companies, and the broader cybersecurity community.

Ultimately, we may remember Fable 5 not simply as another AI product launch, but as one of the first moments when the world began to recognise that access to advanced AI could become a strategic issue in its own right.

As governments, organisations, and citizens, each of us is becoming part of that transition.

The challenge is no longer whether AI will reshape cybersecurity, but whether we can establish the trust, standards and international cooperation necessary to ensure that frontier models like Fable 5 strengthen digital resilience rather than undermine it for generations to come.

Would you like to learn more about AI, tech and digital diplomacyIf so, ask our Diplo chatbot!

UK firms sign Cyber Resilience Pledge amid rising AI threats

The UK government has launched a voluntary Cyber Resilience Pledge, with more than 60 businesses and strategic government suppliers committing to strengthening their cyber defences.

Founding signatories include companies from retail, finance, media, technology and utilities, including M&S, Nationwide, ITV, Microsoft UK, Cloudflare, Deloitte, Accenture UK, Vodafone Group and VodafoneThree.

The pledge asks organisations to take three practical steps: make cybersecurity a board-level responsibility, register for the National Cyber Security Centre’s Early Warning service and take a risk-based approach to requiring Cyber Essentials certification across supply chains.

The government said the pledge is designed mainly for medium and large organisations, but is open to organisations of all sizes and sectors.

Signatories will be asked to publish a signed pledge letter and provide an annual update on progress.

The launch comes ahead of the government’s National Cyber Action Plan, which is expected to set out further cooperation with industry on cyber resilience in the AI era.

According to the government, cyberattacks cost UK organisations an estimated £14.7 billion a year, while the NCSC handled 204 nationally significant incidents in the year to September, up from 89 the previous year.

Officials also warned that AI is lowering barriers for attackers by helping them find software weaknesses, write exploit code and scale attacks more quickly.

Why does it matter?

The pledge elevates cyber resilience to board-level corporate governance, rather than treating it solely as an IT function. Its supply-chain focus is also important because major cyber incidents often spread through vendors, service providers and connected business partners. By linking the pledge to AI-enabled threats, the UK government is signalling that basic cyber hygiene, governance and supply-chain assurance remain essential even as attacks become faster and more automated.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Alberta uses Claude Code to review government systems

The Government of Alberta has used Anthropic’s Claude Code to review and secure provincial government systems, according to a case study published by the company. Anthropic said Alberta’s Ministry of Technology and Innovation used Claude Code with its Opus and Sonnet models to analyse code, identify vulnerabilities and support remediation.

According to Anthropic, the ministry scanned 466 million lines of code in about 20 hours, covering systems used across 27 provincial ministries. Around 50 AI agents worked in parallel to identify security vulnerabilities, infrastructure weaknesses and documentation gaps.

The ministry manages about 1,280 applications and 3,400 code repositories supporting services including social services, public safety and wildfire response. Anthropic said many had never undergone comprehensive security reviews, resulting in accumulated technical debt and incomplete documentation.

Alberta used a two-stage review process. A rules engine first identified known patterns, after which Claude Code analysed the results and cited the relevant files and lines for each finding. Anthropic said the approach uncovered issues that conventional automated scanning tools had missed.

Claude Code was also used to generate fixes, write tests where needed and assist with modernising legacy systems. Anthropic said ministry engineers reviewed and approved all proposed patches before deployment, maintaining human oversight throughout the remediation process.

Alberta also developed specialised Claude-based review agents for continuous security testing during software development. These include red-team agents that probe applications for vulnerabilities, blue-team agents that assess compliance with security standards, and additional agents that review code quality and public-facing content.

Why does it matter?

The case illustrates how governments are beginning to use AI coding agents to modernise and secure large portfolios of legacy software, an area that has traditionally required significant time and specialised expertise. If these tools prove reliable, they could help public administrations reduce technical debt, improve cybersecurity and accelerate software maintenance across critical public services.

At the same time, the deployment highlights the importance of governance in public-sector AI adoption. Alberta’s reported use of human review before implementing AI-generated changes reflects a growing emphasis on combining AI-assisted development with oversight, accountability and established security practices.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

MEPs to debate EU AI cybersecurity strategy

Members of the European Parliament are set to question the European Commission on its latest AI and cybersecurity proposals, including a new AI cybersecurity strategy expected to be unveiled on 7 July.

According to the European Parliament’s plenary newsletter, the Commission’s action plan is expected to include measures to help EU member states and companies address AI-related cybersecurity risks.

The strategy is also expected to strengthen Europe’s AI cybersecurity capabilities as policymakers examine how AI is reshaping both cyber threats and cyber defence.

The debate follows the European Commission’s welcome of the G7 cybersecurity declaration on strengthening global cyber resilience. Parliament is also considering two legislative proposals collectively referred to as the ‘Cybersecurity Act 2‘.

The proposals are expected to address issues including the NIS2 framework, the role of the EU Agency for Cybersecurity (ENISA), the EU cybersecurity certification framework and ICT supply chain security.

The debate is scheduled for 7 July, as part of a European Commission statement followed by parliamentary scrutiny.

Why does it matter?

The debate shows that AI-related cybersecurity risks are becoming part of the EU’s broader cyber resilience agenda. By linking AI policy with NIS2, ENISA, certification and supply chain security, the EU is preparing to treat AI not only as an innovation priority but also as a cybersecurity concern.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Intesa Sanpaolo moves core IT systems to Google Cloud in Italy

Intesa Sanpaolo has completed the migration of core IT systems to Google Cloud’s Italian regions, hosted in TIM data centres in Milan and Turin.

The Italian banking group said the project is one of the largest cloud migrations carried out by a European financial institution. It forms part of a broader digital transformation effort with Google Cloud and TIM.

The migration involved more than 800 business applications and the retirement of a similar number of legacy systems previously hosted on the bank’s own infrastructure.

According to the partners, the transition was completed while maintaining operational continuity for the bank’s services.

Google Cloud provided cloud infrastructure and data capabilities, while TIM hosted the Italian cloud regions and supported data centre services, connectivity and project governance.

Intesa Sanpaolo said the migration strengthens its cloud-first strategy and provides the technological foundation for Isytech, its cloud-native digital platform for customers and employees across the group.

The bank also linked the project to workforce transformation. More than 3,000 employees participated in cloud training programmes, earning more than 170 Google Cloud certifications.

The project is intended to support advanced analytics, AI adoption and future digital banking services while keeping workloads in Google Cloud’s Italian regions.

Why does it matter?

The migration shows how major European banks are modernising legacy IT infrastructure to support AI, analytics and digital financial services. Moving core systems to cloud environments can improve scalability and accelerate new services, but it also raises important questions about resilience, cybersecurity, data governance and regulatory compliance. The use of Italian cloud regions hosted in TIM data centres reflects the growing importance of data residency and trusted infrastructure in regulated financial services.

Would you like to learn more about AI, tech and digital diplomacyIf so, ask our Diplo chatbot!  

India and Japan expand strategic AI partnership

India and Japan have agreed to deepen cooperation on AI, linking AI governance, cybersecurity, infrastructure, research and talent development.

In a joint statement, the two countries described AI as a transformative technology with long-term implications for innovation, economic security, governance and the international order.

Both sides are committed to building a safe, secure, trustworthy, inclusive and human-centric AI ecosystem. They also agreed to strengthen cooperation with partners in the Indo-Pacific and the Global South.

The statement identifies international AI governance, safety and cybersecurity as priority areas. India and Japan said they would coordinate in forums including the G20, OECD, Global Partnership on AI and the UN, while supporting responsible innovation and risk-based governance.

The two countries also agreed to cooperate on AI-enabled cybersecurity and the security of AI systems, with particular attention to critical infrastructure. They highlighted the need for safeguards to ensure AI supports children’s learning and growth rather than causing harm.

AI infrastructure is another focus. India and Japan will strengthen cooperation on data centres, GPU and other compute resources, semiconductors and trustworthy supply chains across the AI technology stack.

The statement also supports collaboration on multilingual, open-source and domain-specific AI models, including models for native languages and public-interest applications. Several memoranda were signed, including partnerships involving IIT Bombay, BharatGen, Japan’s National Institute of Informatics, Sarvam, Preferred Networks, IndiaAI and Japan’s Ministry of Economy, Trade and Industry.

Both sides also committed to researcher exchanges, industry-academia collaboration and talent mobility. Japan reaffirmed its goal of welcoming 500 highly skilled AI professionals from India by 2030.

Why does it matter?

The joint statement shows how AI cooperation is becoming part of broader economic and security strategies in the Indo-Pacific. India and Japan are not only discussing AI governance, but also the infrastructure and supply chains needed to build and deploy AI systems, including compute, semiconductors, data centres and talent. The focus on multilingual and open-source models also matters for countries seeking AI systems that reflect local languages, public-interest needs and Global South priorities.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!