Insights from the field.

"Fewer breaches, probably" does not survive the budget meeting. This is the model that does: four value lines with named inputs, a worked example that clears platform cost with the soft line excluded, and the 40%-cancellation counterargument answered head-on.

Breaches involving shadow AI averaged USD 5.39 million in IBM's 2026 report, above the USD 4.99 million global average. Here is how to brief the audit committee on what that means, what it does not, and what to ask for.

IBM's 2026 report puts the average breach at a record USD 4.99 million, and its AI findings point at access, identity and oversight more than at models. We read the shadow AI, AI-related breach, governance, non-human identity, AI-driven attack and security automation figures, with page numbers, and map each to the control that answers it, plus the study's own stated limits.

Insider risk programs were built around email, USB and cloud storage. AI added new exit paths: staff pasting regulated data into chatbots, browser extensions reading internal pages, and agents acting with a human's credentials. Using CISA's 2026 guide, the Verizon 2026 DBIR, NIST SP 800-53 and the OWASP agentic Top 10, we map each insider type to its AI-era path and show where inventory, inline redaction, attribution and evidence fit in the program you already run.

The Act has applied in general since 2 August 2026. What changed, who enforces it in 19 member states and Norway, which national laws are in force, who signed the codes, and what to watch.

Nigeria, Kenya and South Africa have no AI statute, and Kenya's Artificial Intelligence Bill is still a bill, listed at second reading stage in the Senate as of 9 October 2026. Each country's data protection law already carries an automated-decision right, an impact-assessment duty, a breach-notification duty and a transfer rule. We read the three laws, Nigeria's GAID 2025 and the regulators' pages, and set out what binds AI use today and what to do first.

When staff paste personal data into an AI tool hosted abroad, seven Middle East regimes ask for seven different things. Egypt requires a license or permit, Saudi Arabia a written risk assessment in defined cases, and Türkiye a standard contract notified within five business days. We found no AI Act in force in any of them and no Gulf-wide binding instrument as of October 2026. One table compares transfer, automated-decision and breach rules, with what was verified and what was not.

Vietnam's AI Law gives systems already running 12 months from 1 March 2026 to comply, and 18 months in health, education and finance. In the other five markets, data protection law does the binding work. We set Singapore, Malaysia, Indonesia, Vietnam, Thailand and the Philippines in one table: law, regulator, breach clock and its starting point, transfer rule, automated-decision rule and AI instrument. Thailand is drawn from secondary sources only and is marked as such.

Canada has no AI statute, and as of early October 2026 none is before Parliament. AIDA lapsed with Bill C-27, and its replacement, Bill C-36, is a privacy bill that has had first reading only. That does not leave enterprise AI unregulated. We read PIPEDA, Quebec's Law 25, the privacy regulators' OpenAI findings and OSFI Guideline E-23, and set out what applies today, what has a fixed date, and why the work starts with an inventory.

The UK has no AI statute, so the UK GDPR as amended by the Data (Use and Access) Act 2025 is the binding regime. Since 5 February 2026, Articles 22A to 22D allow significant decisions with no human involved if four safeguards are in place, with tighter rules for special category data. Since 30 September 2026 the regulator is the Information Commission. We read the Act and both commencement regulations and set out what changed, which guidance is out of date, and what to evidence.

Since 30 September 2026, an Italian civil court hearing a damages claim over the use of an AI system can order production of evidence on how the system worked, including AI Act logs and oversight documentation. A party that fails to comply without a justified reason can see the claimant's facts treated as admitted. We read Legislative Decree 160/2026 and Law 132/2025 in the Gazzetta Ufficiale and set out what they require, what they do not, and what to log and keep.