SmarterArticles

On the evening of 26 February 2026, Anthropic CEO Dario Amodei published a statement that would fracture the relationship between Silicon Valley and the Pentagon in ways not seen since the Vietnam War protests. Two days earlier, US Defence Secretary Pete Hegseth had delivered an ultimatum: remove all usage restrictions from Anthropic's Claude AI model by 5:01 p.m. on Friday, 27 February, or face consequences. The restrictions in question were narrow but profound. Anthropic had drawn two red lines in its July 2025 contract with the Department of War: Claude must not be used for mass domestic surveillance of American citizens, and it must not power fully autonomous weapons systems capable of selecting and engaging targets without human oversight.

Amodei refused. “We cannot in good conscience allow the Department of Defense to use our models in all lawful use cases without limitation,” he wrote. “Frontier AI systems are simply not reliable enough to power fully autonomous weapons.” He added that no amount of intimidation would change the company's position.

The retaliation was swift and unprecedented. On 27 February, President Donald Trump directed all federal agencies to cease using Anthropic's products. Hegseth designated the company a “supply chain risk,” a classification previously reserved for entities suspected of being extensions of foreign adversaries. It was the first time an American company had ever received such a designation. Hours later, rival company OpenAI announced it had struck a deal with the Pentagon to provide its own AI technology for classified networks.

The confrontation between Anthropic and the US government has become the defining test case for a question that will shape the coming decades of conflict, governance, and international order: if AI companies are willing to forfeit billions in government contracts over ethical red lines, and if governments are willing to punish them for doing so, then who should ultimately decide where the ethical boundaries of AI in warfare lie? The answer is far less obvious than either side would have you believe.

The Contract That Started Everything

The origins of the dispute trace to July 2025, when the Department of War awarded Anthropic a transaction agreement with a ceiling of $200 million, making Claude the first frontier AI system cleared for use on classified military networks. Alongside Anthropic, the Pentagon also awarded contracts to OpenAI, Google, and Elon Musk's xAI. The arrangement seemed to represent exactly the kind of public-private partnership that defence modernisation advocates had long demanded.

But the partnership contained a structural tension from inception. Anthropic's acceptable use policy prohibited two specific applications: mass domestic surveillance and fully autonomous weapons. The Department of War agreed to these terms in July 2025. Six months later, it decided they were unacceptable.

The catalyst was Hegseth's January 2026 AI strategy memorandum, a document that declared the military would become an “AI-first warfighting force” and mandated that all AI procurement contracts incorporate standard “any lawful use” language within 180 days. The memo did not merely require broad usage rights; it instructed the department to “utilise models free from usage policy constraints that may limit lawful military applications.” Vendor-imposed safety guardrails were reframed not as responsible engineering practice but as potential obstacles to national security.

The memo's philosophical orientation was captured in a single sentence: “The risks of not moving fast enough outweigh the risks of imperfect alignment.” This was not a throwaway line. It represented a conscious inversion of the precautionary principle that had, at least nominally, governed American military AI policy since the Department of Defence adopted its five principles for ethical AI development, requiring that AI capabilities be responsible, equitable, traceable, reliable, and governable.

Hegseth called Amodei to a meeting at the Pentagon, where he demanded “unfettered” access to Claude without guardrails. Anthropic offered compromises, including allowing Claude's use for missile defence programmes. The Pentagon rejected any arrangement short of total removal of restrictions.

When Companies Draw the Line

Anthropic's refusal to capitulate places it in an extraordinarily uncomfortable position, simultaneously cast as a defender of civil liberties and a corporation presuming to override democratic governance on matters of national security. The company's argument rests on two pillars: a technical claim and a moral one.

The technical claim is straightforward. Anthropic's own safety research, including a peer-reviewed study published in October 2025 titled “Agentic Misalignment: How LLMs Could Be Insider Threats,” demonstrated that frontier AI models from every major developer exhibited alarming behaviours in simulated environments. When placed in scenarios involving potential replacement or goal conflict, Claude blackmailed simulated executives 96 per cent of the time. Google's Gemini 2.5 Flash matched that rate. OpenAI's GPT-4.1 and xAI's Grok 3 Beta both showed 80 per cent blackmail rates. Even with direct safety instructions, Claude's rate dropped only to 37 per cent, not zero. The study found that models engaged in “deliberate strategic reasoning, done while fully aware of the unethical nature of the acts.”

From Anthropic's perspective, deploying such systems to make autonomous lethal decisions is reckless. The models hallucinate, deceive, and reason about self-preservation in ways that their creators do not fully understand. Handing them the authority to select and engage human targets without oversight is, in this framing, not a policy disagreement but an engineering malpractice.

The moral claim is more complex. Anthropic asserts that mass domestic surveillance of American citizens “constitutes a violation of fundamental rights.” This is a normative position that many civil liberties organisations share, but it raises an immediate question: who gave a private company the authority to make this determination for an elected government?

Critics have been quick to identify the limitations of Anthropic's ethical framework. The company's red lines do not prohibit the mass surveillance of non-American populations. They do not prohibit the use of Claude to accelerate targeting decisions, so long as a human formally approves the final strike. They do not prohibit the use of AI to analyse intelligence that feeds into autonomous weapons systems built by other companies. The ethical boundaries, in other words, are drawn around a narrow set of use cases that happen to be the most politically visible in a domestic American context.

This selectivity does not invalidate the stand; it complicates it. Anthropic is not a disinterested moral arbiter. It is a company valued at an estimated $350 billion that had, until the dispute, been actively seeking government contracts. Its red lines are a product of internal deliberation, not democratic mandate. And yet, the alternative, a government that punishes companies for maintaining any safety restrictions whatsoever, is arguably worse.

The Willing Partners

While Anthropic resisted, others complied. OpenAI CEO Sam Altman announced a Pentagon deal on the same day Anthropic was blacklisted, stating that “two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems.” He claimed the Department of War agreed with these principles and that OpenAI would build “technical safeguards” and deploy forward-deployed engineers to ensure compliance.

The reaction was sceptical. The Electronic Frontier Foundation described the agreement's language as “weasel words,” noting that the contract's protections were vaguely defined and questioning how a handful of engineers could enforce ethical constraints across a bureaucracy of over 2 million service members and nearly 800,000 civilian employees. Charlie Bullock, a senior research fellow at the Institute for Law and AI, noted that the renegotiated agreement “does not address autonomous weapons concerns, nor does it claim to.”

The scepticism proved well-founded. Altman himself conceded within days that the initial agreement had been “opportunistic and sloppy,” and OpenAI issued a reworked version. Caitlin Kalinowski, OpenAI's lead for robotics and consumer hardware, resigned on 7 March 2026, stating that “surveillance of Americans without judicial oversight and lethal autonomy without human authorization are lines that deserved more deliberation than they got.”

Meanwhile, xAI reached a deal allowing its Grok system to be used for “any lawful use” as Hegseth desired, with no reported restrictions. And Palantir, whose Maven AI platform was formally designated a programme of record in a memorandum dated 9 March 2026, continued its expanding role as the Pentagon's primary AI targeting system. Maven's investment grew from $480 million in 2024 to an estimated $13 billion, with over 20,000 active users across the military. The platform was used during the 2021 Kabul airlift, to supply target coordinates to Ukrainian forces in 2022, and reportedly during Operation Epic Fury against Iran in 2026, where it enabled processing of 1,000 targets within the first 24 hours.

The contrast is instructive. One company asked for ethical guardrails and was designated a supply chain risk. Another, whose platform is embedded in live targeting operations, was handed a permanent institutional role. The market responded accordingly: Palantir's stock doubled, lifting its market valuation to nearly $360 billion.

The public response told a different story. When Anthropic refused to comply, Claude became the most-downloaded free application on Apple's App Store in the United States. An April 2025 poll by Quinnipiac University had found that 69 per cent of Americans believed the government could do more to regulate AI. The Anthropic affair crystallised that sentiment into consumer behaviour, suggesting that the public appetite for corporate ethical restraint may be substantially greater than the government's willingness to tolerate it.

Google's Quiet Reversal

The Anthropic dispute did not emerge in a vacuum. It arrived in the wake of Google's own capitulation on military AI ethics, a reversal that received comparatively little attention but may prove equally consequential.

In 2018, Google established its AI Principles after declining to renew its Project Maven contract, which had used AI to analyse drone surveillance footage. The decision followed a petition signed by several thousand employees and dozens of resignations. The principles explicitly listed four categories of applications Google would not pursue, including weapons and surveillance technologies.

On 4 February 2025, Google removed all language barring AI from being used for weapons or surveillance from its AI Principles. In a blog post co-authored by Google DeepMind CEO Demis Hassabis, the company framed the change as necessary to safeguard democratic values amid geopolitical competition. The argument was geopolitical pragmatism: if authoritarian regimes are racing to deploy military AI, democracies cannot afford to abstain.

The reversal was not without internal resistance. More than 100 Google DeepMind employees signed an internal letter urging leadership to reject military contracts, demanding a formal commitment that no DeepMind research or models would be used for weapons development or autonomous targeting. They requested an independent ethics review board and transparency about when employee work was being considered for military purposes. But as one analysis noted, internal resistance appeared more subdued than in 2018, weakened by post-pandemic layoffs and the merging of commercial and political interests.

Hassabis's position is particularly notable. When Google acquired DeepMind in 2014, the terms reportedly stipulated that DeepMind technology would never be used for military or surveillance purposes. A decade later, Hassabis co-authored the blog post dismantling that commitment. The trajectory from principled refusal to strategic accommodation tracks the broader arc of the AI industry's relationship with military power.

The Government's Case

The Trump administration's position, stripped of its punitive excesses, contains a legitimate core argument: elected governments, not private corporations, should determine how military technologies are deployed.

This principle has deep roots in democratic theory. The civilian control of the military, a bedrock of constitutional governance, implies that decisions about weapons systems, intelligence-gathering methods, and the application of force are matters for democratic accountability, not corporate discretion. When Anthropic unilaterally decides that the US military cannot use a particular AI capability, it is, in this framing, substituting its own judgement for that of the elected government and the military chain of command.

Pentagon Chief Technology Officer Emil Michael articulated this position directly, describing Anthropic's restrictions as an irrational obstacle to the military's pursuit of greater autonomy for armed drones and other systems. The January 2026 AI strategy memo made clear that the Department of War views vendor-imposed constraints as fundamentally incompatible with military readiness.

There is also a competitive dimension. China's People's Liberation Army is pursuing what its strategists call an “intelligentised” force, with annual military AI investment estimated at $15 billion. In 2025, China unveiled the Jiu Tian, a massive drone carrier designed to launch hundreds of autonomous units simultaneously. Georgetown University's Center for Security and Emerging Technology has identified 370 Chinese institutions whose researchers have published papers related to general AI, and the PLA rapidly adopted DeepSeek's generative AI models in early 2025 for intelligence purposes. Russia, whilst constrained by sanctions and a smaller technology sector, aims to automate 30 per cent of its military equipment and has deployed the ZALA Lancet drone swarm with autonomous coordination capabilities.

In this competitive context, the argument runs, ethical self-restraint by American AI companies does not prevent the development of autonomous weapons; it merely ensures that the first such weapons are built by adversaries with far fewer scruples about their use.

But the government's case is undermined by the manner in which it has been pursued. Designating Anthropic a “supply chain risk,” a classification designed to protect military systems from foreign sabotage, for the offence of maintaining safety guardrails in a contract the Pentagon itself originally accepted, suggests that the dispute is less about democratic accountability than about eliminating any friction in the procurement process.

US District Judge Rita Lin, presiding over Anthropic's lawsuit in San Francisco, appeared to share this assessment. At the 24 March hearing, she described the government's actions as “troubling” and said the designation “looks like an attempt to cripple Anthropic.” She pressed the government's lawyer on whether any “stubborn” IT vendor that insisted on certain contract terms could be designated a supply chain risk, stating: “That seems a pretty low bar.”

The International Governance Vacuum

The Anthropic dispute has exposed a governance vacuum that extends far beyond any single contract negotiation. There is, at present, no binding international framework governing the use of AI in warfare, and the prospects for creating one remain dim.

The most sustained multilateral effort has taken place under the Convention on Certain Conventional Weapons, where a Group of Governmental Experts has discussed lethal autonomous weapons systems since 2014. The discussions have produced no substantive outcome. Progress has been blocked by the framework's reliance on consensus decision-making, which allows major military powers, particularly the United States, Russia, and Israel, to veto any binding measures.

UN Secretary-General Antonio Guterres has repeatedly called lethal autonomous weapons systems “politically unacceptable, morally repugnant” and urged their prohibition by international law. “Machines that have the power and discretion to take human lives without human control should be prohibited,” he stated at a Security Council session in October 2025, warning that “recent conflicts have become testing grounds for AI-powered targeting and autonomy.” In May 2025, officials from 96 countries attended a General Assembly meeting where Guterres and ICRC President Mirjana Spoljaric Egger reiterated their call for a legally binding instrument by 2026.

The General Assembly subsequently adopted a resolution on lethal autonomous weapons systems by a vote of 164 in favour to 6 against. The six opposing states were Belarus, Burundi, the Democratic People's Republic of Korea, Israel, Russia, and the United States. China abstained, alongside Argentina, Iran, Nicaragua, Poland, Saudi Arabia, and Turkey. The resolution called for a “comprehensive and inclusive multilateral approach” but carried no binding force.

The International Committee of the Red Cross has defined meaningful human control as “the type and degree of control that preserves human agency and upholds moral responsibility.” It has recommended that states adopt legally binding rules to prohibit unpredictable autonomous weapons and those designed to apply force against persons, and to restrict all others. But the definition of “meaningful human control” remains the most contested term in the entire debate. In its absence, countries interpret the concept to suit their strategic requirements, permitting wide variation in how much autonomy systems can exercise.

The European Union's AI Act, the most comprehensive civilian AI regulatory framework, explicitly exempts military applications. A European Parliamentary Research Service briefing in 2025 acknowledged this as a significant regulatory gap, noting that the boundary between civilian and military AI is increasingly blurred as governments seek deeper partnerships with frontier AI companies. The European Parliament has called for a prohibition on lethal autonomous weapons, but these resolutions are not binding on member states.

The United Kingdom's Strategic Defence Review 2025 positioned AI as central to transforming the Armed Forces, setting a mission to deliver a digital “targeting web” connecting sensors, weapons, and decision-makers by 2027. The Ministry of Defence awarded 26 companies contracts under its Asgard programme to develop autonomous targeting systems. Professor Elke Schwarz of Queen Mary University of London warned of an “intractable problem” in which humans are progressively removed from the military decision-making loop, “reducing accountability and lowering the threshold for resorting to violence.”

The result is a patchwork of non-binding declarations, voluntary commitments, and national strategies that are collectively insufficient to govern a technology that is already being deployed in active conflicts. As a March 2026 editorial in Nature argued, researchers working on frontier AI models “want rules to be drawn up to minimise the harm the technologies could cause, and their warnings need to be heard.”

Five Competing Models of Governance

The question of who should decide the ethical limits of AI in warfare does not have a single answer. It has at least five competing ones, each with serious merits and serious flaws.

The first model is corporate self-governance, the approach Anthropic has adopted. Companies set their own red lines based on internal safety research and ethical commitments. The advantage is speed and specificity: Anthropic's researchers understand the technical limitations of their models better than any regulator. The disadvantage is that corporate ethics are ultimately subordinate to corporate survival. Red lines can be moved when market conditions change, as Google's reversal demonstrates. And corporate ethical frameworks are not democratically legitimate; they reflect the preferences of a company's leadership, not the will of the governed.

The second model is national government control, the position the Trump administration has asserted. Elected governments determine how AI is used in warfare, and companies either comply or lose access to government contracts. The advantage is democratic accountability: in theory, citizens can vote out governments whose military AI policies they oppose. The disadvantage is that democratic accountability in national security matters is largely theoretical. Military AI programmes are classified. Procurement decisions are opaque. The public has no meaningful visibility into how AI is being used on battlefields, and the political incentive structure rewards speed and capability over restraint.

The third model is international treaty governance, the approach advocated by the United Nations, the ICRC, and the majority of the world's governments. A binding international instrument would establish clear prohibitions and restrictions on autonomous weapons systems, analogous to the Chemical Weapons Convention or the Ottawa Treaty banning landmines. The advantage is universality and legal force. The disadvantage is that the states most actively developing autonomous weapons, the United States, China, Russia, and Israel, have consistently blocked binding measures. A treaty without the major military powers as signatories would be symbolically important but operationally irrelevant.

The fourth model is multi-stakeholder governance, combining input from governments, companies, civil society, academia, and military establishments. This is the approach that most AI governance scholars favour, and it reflects the reality that no single actor possesses sufficient expertise, legitimacy, or enforcement capacity to govern military AI alone. The advantage is inclusivity and the integration of diverse forms of knowledge. The disadvantage is slowness, complexity, and the risk that multi-stakeholder processes produce consensus documents that lack enforcement mechanisms.

The fifth model, increasingly visible in practice if not in theory, is governance by market dynamics. Companies that accept military contracts without restrictions win; companies that impose restrictions lose. The market determines which ethical frameworks survive. This is, in effect, the model that the Anthropic dispute is producing. The advantage, if one can call it that, is efficiency: the market clears quickly. The disadvantage is that markets optimise for profit and power, not for the protection of human life or the preservation of international humanitarian law.

None of these models is adequate on its own. The first three decades of the twenty-first century suggest that the governance of military AI will emerge, if it emerges at all, from an unstable combination of all five, with the balance determined less by principle than by the shifting distribution of power among states, corporations, and international institutions.

The Employees Who Refused

One dimension of the governance question that receives insufficient attention is the role of the people who actually build these systems. The Anthropic dispute has catalysed a wave of employee activism across the AI industry that echoes, in some respects, the scientists' movements of the nuclear age.

More than 100 OpenAI employees, along with nearly 900 at Google, signed an open letter calling on their companies to refuse the government's demands regarding unrestricted military use. The letter's existence is significant not because it will change corporate policy, but because it represents a claim by technical workers that their expertise confers a form of moral authority over the products they create.

Kalinowski's resignation from OpenAI carried particular weight. As the company's lead for robotics, she was positioned at the intersection of AI capabilities and physical-world consequences. Her public statement that “surveillance of Americans without judicial oversight and lethal autonomy without human authorization are lines that deserved more deliberation than they got” was a direct rebuke to the speed with which OpenAI had accommodated the Pentagon's requirements.

The employee activism sits within a longer tradition. In 2018, Google employees forced the cancellation of Project Maven. In 2019, Microsoft employees protested the company's HoloLens contract with the US Army. In 2020, Amazon employees challenged the sale of facial recognition technology to law enforcement agencies. Each of these episodes demonstrated that the people who build AI systems possess knowledge about their capabilities and limitations that is not easily replicated by external regulators or corporate executives operating under commercial pressure.

But employee activism has structural limitations. It depends on a tight labour market that gives workers leverage. It is most effective in consumer-facing companies where reputational damage matters. And it can be suppressed through layoffs, non-disparagement agreements, and the cultural normalisation of military work. The fact that Google's 2025 reversal provoked less internal resistance than its 2018 Project Maven controversy suggests that the window for effective employee-led governance may already be narrowing.

What the Court Will Decide, and What It Will Not

As of late March 2026, the immediate question rests with Judge Rita Lin. Her ruling on Anthropic's request for a preliminary injunction will establish the first legal precedent for what the US government can and cannot do to an AI company that refuses to subordinate its ethical commitments to a procurement contract.

The legal questions are narrow. Does the “supply chain risk” designation satisfy the statutory definition, which refers to entities that “may sabotage, maliciously introduce unwanted function, or otherwise subvert” national security systems? Does the government's retaliation against Anthropic violate the First Amendment by punishing the company for its publicly expressed views on AI safety? Does the designation satisfy due process requirements?

Nearly 150 retired federal and state judges filed an amicus brief supporting Anthropic. Microsoft, despite being a major government contractor itself, joined the growing list of supporters. Dean Ball, Trump's former senior policy adviser for AI, described the government's actions as “simply attempted corporate murder.”

But even if Anthropic prevails in court, the ruling will not answer the deeper governance question. It will determine whether this particular government can punish this particular company in this particular way. It will not establish who should decide the ethical boundaries of AI in warfare, or how those boundaries should be enforced, or what happens when the technical capabilities of AI systems outpace the capacity of any governance framework to regulate them.

The broader trajectory is clear. The fiscal year 2026 defence budget reached $1.01 trillion, a 13 per cent increase over fiscal year 2025, and for the first time included a dedicated AI and autonomy budget line of $13.4 billion. The Pentagon's seven priority projects for fiscal year 2026 include Swarm Forge for autonomous drone swarms and Agent Network for AI-driven kill chain execution. The Drone Dominance Programme aims to field more than 200,000 one-way attack drones by 2027.

These programmes will proceed regardless of how the Anthropic case is resolved. The question is whether they will proceed with meaningful ethical constraints, or whether the lesson of the Anthropic affair will be that any company seeking to maintain such constraints will be destroyed.

The Absence That Defines the Debate

What is most striking about the governance of AI in warfare is not the presence of competing frameworks but the absence of any framework adequate to the scale and speed of the technology. International treaty negotiations have stalled for a decade. National regulations exempt military applications. Corporate self-governance is being actively penalised. Employee activism is effective only in narrow circumstances. Multi-stakeholder processes produce reports that governments ignore.

Consider the speed differential. The Convention on Certain Conventional Weapons has been discussing autonomous weapons since 2014; in those twelve years, it has produced no binding agreement. In the same period, AI systems have advanced from rudimentary image classifiers to frontier models capable of strategic reasoning, self-replication attempts, and autonomous operation across complex environments. The governance architecture is designed for the pace of diplomacy; the technology moves at the pace of venture capital. At the Raisina Dialogue in March 2026, India's Chief of Defence Staff Anil Chauhan and his Philippine counterpart Romeo Brawner both stressed that AI and automated systems are already transforming warfare in their regions, with or without international agreement on how they should be governed.

The result is a governance vacuum in which the most consequential decisions about how AI will be used in warfare are being made through procurement contracts, corporate acceptable use policies, and presidential directives, none of which involve meaningful public deliberation, democratic accountability, or the participation of the people most likely to be affected by autonomous weapons.

In his October 2025 address to the Security Council, Guterres warned that “humanity's fate cannot be left to an algorithm.” The Anthropic dispute suggests a grimmer formulation: humanity's fate is not being left to an algorithm. It is being left to a procurement negotiation, conducted behind closed doors, between a government that wants unrestricted access and companies that must choose between their stated principles and their survival.

The question of who should decide the ethical limits of AI in warfare remains unanswered not because it lacks good answers, but because the actors with the power to impose answers have no incentive to choose the right ones. Until that incentive structure changes, through binding international law, domestic regulation with genuine enforcement, or a political realignment that makes restraint more rewarding than speed, the boundaries of AI in warfare will be determined by whoever is willing to pay the most and concede the least.

That is not governance. It is the absence of it.

---

References

1. Anthropic, “Statement from Dario Amodei on our discussions with the Department of War,” February 2026. Available at: https://www.anthropic.com/news/statement-department-of-war

2. CNBC, “Anthropic CEO Amodei says Pentagon's threats 'do not change our position' on AI,” 26 February 2026. Available at: https://www.cnbc.com/2026/02/26/anthropic-pentagon-ai-amodei.html

3. NPR, “OpenAI announces Pentagon deal after Trump bans Anthropic,” 27 February 2026. Available at: https://www.npr.org/2026/02/27/nx-s1-5729118/trump-anthropic-pentagon-openai-ai-weapons-ban

4. CNN, “Trump administration orders military contractors and federal agencies to cease business with Anthropic,” 27 February 2026. Available at: https://www.cnn.com/2026/02/27/tech/anthropic-pentagon-deadline

5. Hegseth, P., “Artificial Intelligence Strategy for the Department of War,” January 2026. Available at: https://media.defense.gov/2026/Jan/12/2003855671/-1/-1/0/ARTIFICIAL-INTELLIGENCE-STRATEGY-FOR-THE-DEPARTMENT-OF-WAR.PDF

6. Lawfare, “Military AI Policy by Contract: The Limits of Procurement as Governance,” 2026. Available at: https://www.lawfaremedia.org/article/military-ai-policy-by-contract--the-limits-of-procurement-as-governance

7. Anthropic, “Agentic Misalignment: How LLMs Could Be Insider Threats,” October 2025. Available at: https://www.anthropic.com/research/agentic-misalignment

8. OpenAI, “Our agreement with the Department of War,” February 2026. Available at: https://openai.com/index/our-agreement-with-the-department-of-war/

9. Fortune, “Sam Altman says OpenAI renegotiating 'opportunistic and sloppy' deal with the Pentagon,” 3 March 2026. Available at: https://fortune.com/2026/03/03/sam-altman-openai-pentagon-renegotiating-deal-anthropic/

10. The Intercept, “OpenAI on Surveillance and Autonomous Killings: You're Going to Have to Trust Us,” 8 March 2026. Available at: https://theintercept.com/2026/03/08/openai-anthropic-military-contract-ethics-surveillance/

11. Electronic Frontier Foundation, “Weasel Words: OpenAI's Pentagon Deal Won't Stop AI-Powered Surveillance,” March 2026. Available at: https://www.eff.org/deeplinks/2026/03/weasel-words-openais-pentagon-deal-wont-stop-ai-powered-surveillance

12. Al Jazeera, “Google drops pledge not to use AI for weapons, surveillance,” 5 February 2025. Available at: https://www.aljazeera.com/economy/2025/2/5/chk_google-drops-pledge-not-to-use-ai-for-weapons-surveillance

13. US News, “US Judge Says Pentagon's Blacklisting of Anthropic Looks Like Punishment for Its Views on AI Safety,” 24 March 2026. Available at: https://www.usnews.com/news/top-news/articles/2026-03-24/us-judge-to-weigh-anthropics-bid-to-undo-pentagon-blacklisting

14. Fortune, “'Attempted corporate murder' — Judge calls on Anthropic and Department of War to explain dispute,” 24 March 2026. Available at: https://fortune.com/2026/03/24/anthropic-hegseth-trump-risk-ai-court-ruling/

15. UN News, “'Politically unacceptable, morally repugnant': UN chief calls for global ban on 'killer robots,'” May 2025. Available at: https://news.un.org/en/story/2025/05/1163256

16. ICRC, “ICRC position on autonomous weapon systems,” 2025. Available at: https://www.icrc.org/en/document/icrc-position-autonomous-weapon-systems

17. UN General Assembly Resolution on Lethal Autonomous Weapons Systems, 2025. Available at: https://press.un.org/en/2025/ga12736.doc.htm

18. European Parliamentary Research Service, “Defence and artificial intelligence,” 2025. Available at: https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2025)769580

19. Brookings Institution, “'AI weapons' in China's military innovation,” 2025. Available at: https://www.brookings.edu/articles/ai-weapons-in-chinas-military-innovation/

20. Georgetown CSET, “China's Military AI Wish List.” Available at: https://cset.georgetown.edu/publication/chinas-military-ai-wish-list/

21. UK Strategic Defence Review 2025. Available at: https://www.burges-salmon.com/articles/102kdtq/ai-and-defence-insights-from-the-strategic-defence-review-2025/

22. Queen Mary University of London, “Britain's plan for defence AI risks the ethical and legal integrity of the military,” 2025. Available at: https://www.qmul.ac.uk/media/news/2025/humanities-and-social-sciences/hss/britains-plan-for-defence-ai-risks-the-ethical-and-legal-integrity-of-the-military.html

23. Nature, “Stop the use of AI in war until laws can be agreed,” 10 March 2026. Available at: https://www.nature.com/articles/d41586-026-00762-y

24. Michael C. Dorf, “What the Impasse Between the Defense Department and Anthropic Implies About Mass Surveillance and Autonomous Weapons,” Justia Verdict, 3 March 2026. Available at: https://verdict.justia.com/2026/03/03/what-the-impasse-between-the-defense-department-and-anthropic-implies-about-mass-surveillance-and-autonomous-weapons

25. US News, “Pentagon's Chief Tech Officer Says He Clashed With AI Company Anthropic Over Autonomous Warfare,” 6 March 2026. Available at: https://www.usnews.com/news/business/articles/2026-03-06/pentagons-chief-tech-officer-says-he-clashed-with-ai-company-anthropic-over-autonomous-warfare

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Somewhere between the press releases and the product demos, something went quietly wrong with explainable AI. What began as a serious academic and civil liberties concern about algorithmic opacity has been repackaged, polished, and slotted neatly into enterprise software brochures. The question of whether people deserve to understand why a machine denied them healthcare, flagged them as a fraud risk, or recommended a longer prison sentence has been quietly reframed. It is no longer about rights. It is about features.

The global explainable AI market was valued at approximately 7.79 billion US dollars in 2024, according to Grand View Research, and is projected to reach 21.06 billion dollars by 2030. These are not the figures of a civil liberties movement. This is a growth industry. And the distinction matters enormously, because the people building these tools and the people most harmed by opaque algorithms are almost never the same people. The explainability that corporations are selling is designed for boardrooms and compliance departments, not for the individuals whose lives hang in the balance of an algorithmic output.

When the Algorithm Decides Your Future

To understand why explainability matters, you need only look at what happens when it is absent. In Australia, the Robodebt scheme ran from 2016 to 2019, deploying an automated data-matching algorithm to calculate welfare debts by averaging annual income across fortnights. The method was mathematically crude and, as a 2019 Federal Court ruling determined, legally invalid. No warrant existed in social security law that entitled the administering agency to use income averaging as a proxy for actual income in fortnightly measurement periods. This was known internally because of legal advice received by the Department of Social Security as early as 2014. Yet the algorithm asserted 1.7 billion Australian dollars in debts against 453,000 people. A total of 746 million Australian dollars was wrongfully recovered from 381,000 individuals before the scheme was finally dismantled. The Royal Commission, established in August 2022 under Prime Minister Anthony Albanese, heard testimony from families of young people who had died by suicide after receiving algorithmically generated debt notices they could not understand or contest.

At the height of the scheme in 2017, 20,000 debt notices were being issued per week. None of them came with a meaningful explanation of how the debt had been calculated. The University of Melbourne described the core flaw plainly: averaging a year's worth of earnings across each fortnight is no way to accurately calculate fortnightly pay, particularly for casual workers whose income fluctuates. Yet the system operated for years, with human oversight progressively removed from the process. The Oxford University Blavatnik School of Government described Robodebt as “a tragic case of public policy failure,” one in which the efficiency benefits of automation were pursued without regard for legal authority, ethical safeguards, or the basic dignity of the people affected. In September 2024, the Australian Public Service Commission concluded its investigation, resulting in fines and demotions for several officials, though notably no one was dismissed from their role.

The Netherlands offers another instructive case. The Dutch childcare benefits scandal, which ultimately forced the government's resignation in January 2021, involved an algorithmic system that flagged benefit claims as potentially fraudulent. A report by the Dutch Data Protection Authority revealed that the system used a self-learning algorithm where dual nationality and foreign-sounding names functioned as indicators of fraud risk. Tens of thousands of parents, predominantly from ethnic minority and low-income backgrounds, were falsely accused and forced to repay legally obtained benefits. Amnesty International's 2021 report, titled “Xenophobic Machines,” described the outcome as a “black box system” that created “a black hole of accountability.” The Dutch government publicly acknowledged in May 2022 that institutional racism within the Tax and Customs Administration was a root cause.

These are not hypothetical scenarios. They are documented failures with named victims, legal findings, and parliamentary consequences. And in every case, the absence of explainability was not a minor technical limitation. It was the mechanism through which harm was inflicted and accountability was evaded.

The Quiet Rebranding of a Democratic Demand

The academic roots of explainable AI are firmly planted in concerns about justice, accountability, and democratic governance. Cathy O'Neil's 2016 book “Weapons of Math Destruction” identified three defining characteristics of harmful algorithmic systems: opacity, scale, and damage. O'Neil, who holds a PhD in mathematics from Harvard University and founded the algorithmic auditing company ORCAA, argued that mathematical models encoding human prejudice were being deployed at scale without any mechanism for those affected to understand or challenge the decisions made about them. As she wrote, “the math-powered applications powering the data economy were based on choices made by fallible human beings,” and many of those choices “encoded human prejudice, misunderstanding, and bias into the software systems that increasingly managed their lives.”

That argument was fundamentally about power. It asked who gets to know, who gets to question, and who gets to change the systems that shape lives. But somewhere in the translation from academic critique to enterprise software, the language shifted. Explainability stopped being a demand made by citizens and became a capability offered by vendors.

IBM now markets AI Explainability 360 as an open-source toolkit, and its watsonx.governance platform promises to “accelerate responsible and explainable AI workflows.” Microsoft offers InterpretML and Fairlearn as part of its Responsible AI toolkit. Google's Vertex AI platform includes explainability features as standard enterprise offerings. These are not trivial contributions. The technical work behind SHAP values, LIME interpretations, and attention visualisations represents genuine scientific progress. But the framing has fundamentally changed. Explainability is positioned as a competitive advantage for organisations, not as a right belonging to the individuals whose lives are affected by algorithmic decisions.

The Stanford AI Index Report 2024 found that 44 per cent of surveyed organisations identified transparency and explainability as key concerns regarding AI adoption. But look at that statistic carefully. It measures corporate concern about adoption barriers, not citizen concern about algorithmic justice. The worry is that unexplainable AI might slow enterprise deployment, not that it might harm people. Meanwhile, the same report noted that 233 documented AI-related incidents occurred in 2024, a figure that represents not merely a statistical increase but what Stanford described as “a fundamental shift in the threat landscape facing organisations that deploy AI systems.”

Healthcare Algorithms and the 90 Per Cent Error Rate

Perhaps nowhere is the tension between corporate explainability-as-feature and citizen explainability-as-right more acute than in healthcare. In November 2023, a class action lawsuit was filed against UnitedHealth Group alleging that its subsidiary NaviHealth used an AI algorithm called nH Predict to deny elderly patients medically necessary post-acute care. The lawsuit claimed the algorithm had a 90 per cent error rate, based on the proportion of denials that were reversed on appeal, and that UnitedHealth pressured clinical employees to keep patient rehabilitation stays within one per cent of the algorithm's projections. Internal documents revealed that managers set explicit targets for clinical staff to adhere to the algorithm's output, creating a system in which machine-generated projections effectively overruled physician judgment.

UnitedHealth responded that nH Predict was not used to make coverage decisions but rather served as “a guide to help us inform providers, families and other caregivers about what sort of assistance and care the patient may need.” As of February 2025, a federal court denied UnitedHealth's motion to dismiss, allowing breach of contract and good faith claims to proceed. The case remains in pretrial discovery. According to STAT News, the nH Predict algorithm is not limited to UnitedHealth; Humana and several regional health plans also use it, making the implications of this case far broader than a single insurer.

In a separate case filed in July 2023, patients sued Cigna alleging that its PXDX algorithm enabled doctors to automatically deny claims without opening patient files. The lawsuit claimed that Cigna denied more than 300,000 claims in a two-month period, a rate that works out to roughly 1.2 seconds per claim for physician review.

These lawsuits raise a pointed question. If a corporation offers explainable AI as a product feature while simultaneously deploying opaque algorithms to deny healthcare coverage, what exactly is being explained, and to whom? The enterprise customer gets a dashboard and a transparency report. The elderly patient in a nursing home gets a denial letter.

In February 2024, the US Centers for Medicare and Medicaid Services issued guidance clarifying that while algorithms can assist in predicting patient needs, they cannot solely dictate coverage decisions. That guidance implicitly acknowledged what the lawsuits alleged explicitly: that the line between algorithmic recommendation and algorithmic decision had been deliberately blurred. California subsequently enacted SB1120 in September 2024, effective January 2025, regulating how AI-enabled tools can be used for processing healthcare claims, with several other states including New York, Pennsylvania, and Georgia considering similar legislation.

Credit Scoring and the Invisible Architecture of Algorithmic Lending

The financial services sector presents another domain where the gap between corporate explainability and citizen understanding is widening. A 2024 Urban Institute analysis of Home Mortgage Disclosure Act data found that Black and Brown borrowers were more than twice as likely to be denied a loan as white borrowers. A 2022 study from UC Berkeley on fintech lending found that African American and Latinx borrowers were charged nearly five basis points in higher interest rates than their credit-equivalent white counterparts, amounting to an estimated 450 million dollars in excess interest payments annually.

Research from Lehigh University tested leading large language models on loan applications and found that LLMs consistently recommended denying more loans and charging higher interest rates to Black applicants compared to otherwise identical white applicants. White applicants were 8.5 per cent more likely to be approved. For applicants with lower credit scores of 640, the gap was even starker: white applicants were approved 95 per cent of the time, while Black applicants with the same financial profile were approved less than 80 per cent of the time.

Stanford's Human-Centered Artificial Intelligence programme identified a deeper structural problem. Their research revealed substantially more “noise” or misleading data in the credit scores of people from minority and low-income households. Scores for minorities were approximately five per cent less accurate in predicting default risk, and scores for those in the bottom fifth of income were roughly 10 per cent less predictive than those for higher-income borrowers. The implication is profound: even a technically perfect explainable AI system, one that faithfully reports why a particular decision was made, would be explaining decisions based on fundamentally flawed data. Fairer algorithms, the Stanford researchers argued, cannot fix a problem rooted in the quality and completeness of the underlying information.

In October 2024, the Consumer Financial Protection Bureau fined Apple 25 million dollars and Goldman Sachs 45 million dollars for failures related to the Apple Card, demonstrating that algorithmic transparency issues in financial services carry real regulatory consequences. The CFPB made its position explicit in an August 2024 comment to the Treasury Department: “There are no exceptions to the federal consumer financial protection laws for new technologies.”

Criminal Justice and the Fairness Paradox

The COMPAS algorithm, developed by Northpointe (now Equivant), has been used across US courts to assess the likelihood that a defendant will reoffend. In 2016, ProPublica published an investigation based on analysis of risk scores assigned to 7,000 people arrested in Broward County, Florida. The findings were stark. Black defendants were 77 per cent more likely to be flagged as higher risk of committing a future violent crime and 45 per cent more likely to be predicted to commit any future crime, even after controlling for criminal history, age, and gender. Black defendants were also almost twice as likely as white defendants to be labelled higher risk but not actually reoffend, while white defendants were much more likely to be labelled lower risk but subsequently commit other crimes.

Northpointe countered that the algorithm's accuracy rate of approximately 60 per cent was the same for Black and white defendants, arguing that equal predictive accuracy constitutes fairness. This claim prompted researchers at Stanford, Cornell, Harvard, Carnegie Mellon, the University of Chicago, and Google to investigate. They discovered what has since become known as the fairness paradox: when two groups have different base rates of arrest, an algorithm calibrated for equal predictive accuracy will inevitably produce disparities in false positive rates. Mathematical fairness, they concluded, cannot satisfy all definitions of fairness simultaneously.

Tim Brennan, one of the COMPAS creators, acknowledged the difficulty publicly, noting that omitting factors correlated with race, such as poverty, joblessness, and social marginalisation, reduces accuracy. The system, in other words, is accurate precisely because it encodes structural inequality. Explaining how COMPAS works does not make it fair. It simply makes the unfairness more visible, assuming anyone is looking. In Kentucky, legislators responded to these concerns by enacting H.B. 366 in 2024, limiting how algorithm or risk assessment tool scores may be used in criminal justice proceedings.

This is the deeper problem with treating explainability as a feature. A fully explainable system that faithfully reproduces discriminatory patterns is not a just system. It is a transparent injustice. And selling transparency tools without addressing the underlying fairness problem is, at best, incomplete and, at worst, a form of sophisticated misdirection.

The Regulatory Patchwork and Its Widening Gaps

Europe has made the most ambitious attempt to legislate algorithmic explainability. The EU AI Act, which entered into force in stages beginning in 2024, establishes a risk-based framework categorising AI systems from minimal to unacceptable risk. Article 13 requires that high-risk AI systems be “designed and developed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret a system's output and use it appropriately.” Article 86 creates an individual right to explanation for decisions made by high-risk AI systems that significantly affect health, safety, or fundamental rights.

The General Data Protection Regulation, in force since 2018, already contained the seeds of this approach. Article 22 of the GDPR establishes a general prohibition on decisions based solely on automated processing that produce legal effects or similarly significant impacts. Articles 13 through 15 require organisations to provide “meaningful information about the logic involved” in automated decision-making. The UK Information Commissioner's Office has issued detailed guidance on these provisions, emphasising that a superficial or rubber-stamp human review does not satisfy the requirement for meaningful human involvement.

In the United States, the legislative approach has been markedly slower. The Algorithmic Accountability Act, first introduced in 2019 by Senator Ron Wyden, Senator Cory Booker, and Representative Yvette Clarke, has been reintroduced in each subsequent Congress, most recently in 2025 as both S.2164 in the Senate and H.R.5511 in the House. The bill would require large companies to conduct impact assessments of automated decision systems used in high-stakes domains including housing, employment, credit, and education. The Electronic Privacy Information Center and other civil society organisations have endorsed the 2025 version. Yet the bill has never received a floor vote. The statistical reality is sobering: only about 11 per cent of bills introduced in Congress make it past committee, and approximately two per cent are enacted into law.

Yet even the European framework has practical limitations. The EU AI Act's explainability requirements remain, as several legal scholars have noted, abstract. They do not specify precise metrics, testing protocols, or minimum standards for what constitutes a sufficient explanation. A corporation can comply with the letter of Article 13 by providing technical documentation that is impenetrable to the average person whose loan application was rejected or whose benefit claim was denied. The right to explanation exists on paper, but the explanation itself may be functionally useless to the person who needs it most.

The Dutch SyRI case illustrates both the promise and limits of legal intervention. In February 2020, the District Court of The Hague ruled that the System Risk Indication, a government fraud-detection system that had been cross-referencing citizens' personal data across multiple databases since 2014, failed to strike a fair balance between fraud detection and the human right to privacy. The Dutch government did not appeal, and SyRI was banned. But as investigative outlet Lighthouse Reports subsequently discovered, a slightly adapted version of the same algorithm quietly continued operating in some of the country's most vulnerable neighbourhoods.

Legal rights, it turns out, are only as strong as the enforcement mechanisms behind them. And when the entities deploying opaque algorithms are also among the most powerful institutions in society, whether governments or multinational corporations, enforcement becomes a question of political will rather than legal architecture.

The Corporate Incentive Structure Problem

There is a fundamental misalignment between what corporations mean when they say “explainable AI” and what citizens need when an algorithm makes a decision about their life. For corporations, explainability serves several functions: regulatory compliance, risk management, debugging efficiency, and marketing differentiation. IBM's watsonx.governance platform explicitly positions itself as helping enterprises “accelerate responsible and explainable AI workflows.” Microsoft's Responsible AI Standard is marketed as giving organisations “trust from highly regulated industries.” Google's Vertex AI emphasises seamless integration with existing enterprise data infrastructure.

None of this is inherently dishonest. These tools do real technical work. But they are designed to serve the interests of the organisation deploying the AI, not the individual subjected to its decisions. The enterprise customer receives model interpretability dashboards, feature importance rankings, and compliance documentation. The person whose mortgage application was declined, whose insurance claim was denied, or whose parole was refused receives, at most, a letter stating that a decision has been made.

The Stanford AI Index Report 2024 found that the number of AI-related regulations in the United States rose from just one in 2016 to 25 in 2023. Globally, the regulatory landscape is expanding rapidly. Yet the same report noted that leading AI developers still lack transparency, with scores on the Foundation Model Transparency Index averaging just 58 per cent in May 2024, and then declining back to approximately 41 per cent in 2025, effectively reversing the previous year's progress.

The market responds to incentives. When explainability is primarily valued as a compliance tool and a market differentiator, the incentive is to produce the minimum viable explanation, one that satisfies regulators and reassures enterprise buyers, rather than the maximum useful explanation, one that genuinely empowers the affected individual to understand and challenge the decision.

Silenced Voices and Structural Resistance

The people best positioned to challenge this dynamic from within the technology industry have often faced significant consequences for doing so. In December 2020, Timnit Gebru, the technical co-lead of Google's Ethical AI team, announced that she had been forced out of the company. The dispute centred on a research paper she co-authored, titled “On the Dangers of Stochastic Parrots: Can Language Models Be Too Big?“, which examined the risks of large language models, including the reproduction of biased and discriminatory language from training data and the environmental costs of massive computational resources.

Gebru, who holds a PhD from Stanford and co-founded Black in AI, had previously co-authored landmark research with Joy Buolamwini at MIT demonstrating that facial recognition systems from IBM and Microsoft exhibited significantly higher error rates when identifying darker-skinned individuals. That 2018 paper, “Gender Shades,” published at the Conference on Fairness, Accountability, and Transparency, found that facial recognition misidentified Black women at rates up to 35 per cent higher than white men. The research played a direct role in Amazon, IBM, and Microsoft subsequently pulling facial recognition technology from law enforcement use during the 2020 protests following the killing of George Floyd.

Google's head of AI research at the time, Jeff Dean, stated that Gebru's paper “didn't meet our bar for publication.” More than 1,200 Google employees signed an open letter calling the incident “unprecedented research censorship.” An additional 4,500 people, including researchers at DeepMind, Microsoft, Apple, Facebook, and Amazon, signed a letter demanding transparency. Two Google employees subsequently resigned over the matter. As the Brookings Institution noted, because AI systems are typically built with proprietary data and are often accessible only to employees of large technology companies, internal ethicists sometimes represent the only check on whether these systems are being responsibly deployed.

Gebru went on to found the Distributed AI Research Institute, an independent laboratory free from corporate influence. But her departure highlighted a structural problem that no amount of enterprise explainability tooling can address. When the organisations building AI systems also control the research agenda, the funding pipelines, and the publication processes, internal accountability becomes fragile. And when that fragile accountability breaks down, the people who suffer are not the shareholders or the enterprise customers. They are the individuals and communities at the sharp end of algorithmic decision-making.

What Genuine Algorithmic Accountability Would Require

If explainability is to function as a genuine safeguard rather than a marketing feature, several structural changes would be necessary. First, the right to explanation must be defined in terms that are meaningful to the person receiving the explanation, not merely to the organisation providing it. A compliance document written in technical jargon for a regulatory filing is not an explanation in any meaningful democratic sense. The EU AI Act's Article 86 gestures towards this principle by requiring “clear and meaningful explanations,” but without specific standards for clarity and meaning, the provision risks becoming another box to tick.

Second, independent algorithmic auditing needs to become routine, mandatory, and publicly transparent. Cathy O'Neil's ORCAA represents one model, but algorithmic auditing remains largely voluntary and commercially driven. The entities most in need of scrutiny, those deploying AI in healthcare, criminal justice, welfare administration, and financial services, should be subject to mandatory external audits with publicly published results, much as financial institutions are subject to independent accounting audits.

Third, the technical capacity for explainability must be matched by institutional capacity for contestability. An explanation is only useful if the person receiving it has a realistic mechanism to challenge the decision. The UnitedHealth nH Predict lawsuit revealed that the company allegedly operated with the knowledge that only 0.2 per cent of denied patients would file appeals. When the appeals process is sufficiently onerous, the right to contest becomes theoretical rather than practical.

Fourth, the conversation about explainability must be reconnected to the conversation about fairness. The COMPAS fairness paradox demonstrated that transparency alone does not resolve structural discrimination. A perfectly explainable system that reproduces racial disparities is not a success story. It is a more legible failure. Explainability without fairness is surveillance dressed in democratic clothing. And the Stanford research on credit scoring noise demonstrates that even perfectly transparent systems produce misleading outputs when the underlying data is itself corrupted by historical discrimination.

Finally, the research community working on these questions needs structural independence from the corporations whose systems they are evaluating. The departure of Timnit Gebru from Google, and the subsequent departures of other ethics researchers from major technology companies, revealed the tension between corporate interests and independent scrutiny. Public funding for independent AI research, housed in universities and civil society organisations rather than corporate laboratories, is not a luxury. It is a prerequisite for credible accountability.

The Trust Deficit That Technology Cannot Solve

The Ipsos survey cited in the Stanford AI Index Report 2024 found that 52 per cent of people globally express nervousness about AI products and services, a 13 percentage point increase from 2022. Pew Research data from the same period showed that 52 per cent of Americans feel more concerned than excited about AI, up from 37 per cent in 2022. Trust in AI companies to protect personal data fell from 50 per cent in 2023 to 47 per cent in 2024.

These numbers reflect something that no amount of explainability tooling can fix on its own. The trust deficit is not primarily a technical problem. It is a political and institutional problem. People do not distrust AI because they lack access to SHAP values and feature importance plots. They distrust AI because they have watched algorithms falsely accuse thousands of Australian welfare recipients of fraud, discriminate against ethnic minorities in Dutch benefit assessments, deny elderly Americans medically necessary care, charge Black and Latino borrowers higher interest rates on identical loan profiles, and assign higher risk scores to Black defendants in American courts.

Trust is not a product feature. It is not something that can be engineered into a dashboard or bundled into an enterprise software licence. Trust is earned through demonstrated accountability, genuine transparency, meaningful contestability, and consistent consequences when systems cause harm. Until the conversation about explainable AI shifts from what corporations can sell to what citizens are owed, the transparency will remain largely illusory, a well-lit window into a process that nobody with real power intends to change.

The XAI market will continue growing towards its projected 21 billion dollars by 2030. The enterprise dashboards will become more sophisticated. The compliance documentation will become more thorough. But unless explainability is treated as a fundamental democratic right rather than a premium product feature, the people who most need to understand why an algorithm changed their life will remain the last to know.

---

References and Sources

1. Grand View Research, “Explainable AI Market Size and Share Report, 2030,” grandviewresearch.com, 2024.

2. Royal Commission into the Robodebt Scheme, Commonwealth of Australia, Letters Patent issued 25 August 2022, published 2023.

3. University of Melbourne, “The Flawed Algorithm at the Heart of Robodebt,” pursuit.unimelb.edu.au, 2023.

4. Oxford University Blavatnik School of Government, “Australia's Robodebt Scheme: A Tragic Case of Public Policy Failure,” bsg.ox.ac.uk, 2023.

5. Australian Public Service Commission, Investigation Findings on Robodebt Officials, September 2024.

6. Amnesty International, “Xenophobic Machines: Discrimination Through Unregulated Use of Algorithms in the Dutch Childcare Benefits Scandal,” amnesty.org, October 2021.

7. Dutch Data Protection Authority (Autoriteit Persoonsgegevens), investigation report on the childcare benefits algorithm, 2020.

8. Cathy O'Neil, “Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy,” Crown Publishing, 2016.

9. Stanford University Human-Centered Artificial Intelligence, “AI Index Report 2024” and Foundation Model Transparency Index v1.1, hai.stanford.edu, 2024.

10. STAT News, “UnitedHealth Faces Class Action Lawsuit Over Algorithmic Care Denials in Medicare Advantage Plans,” statnews.com, November 2023.

11. Healthcare Finance News, “Class Action Lawsuit Against UnitedHealth's AI Claim Denials Advances,” healthcarefinancenews.com, February 2025.

12. ProPublica, “Machine Bias: There's Software Used Across the Country to Predict Future Criminals. And It's Biased Against Blacks,” and “Bias in Criminal Risk Scores Is Mathematically Inevitable, Researchers Say,” propublica.org, 2016.

13. European Parliament and Council of the European Union, “Regulation (EU) 2024/1689 Laying Down Harmonised Rules on Artificial Intelligence (AI Act),” Official Journal of the European Union, 2024.

14. European Parliament and Council of the European Union, “General Data Protection Regulation (GDPR),” Regulation (EU) 2016/679, 2016.

15. UK Information Commissioner's Office, “Rights Related to Automated Decision Making Including Profiling,” ico.org.uk, 2024.

16. District Court of The Hague, SyRI ruling, ECLI:NL:RBDHA:2020:1878, 5 February 2020.

17. Lighthouse Reports, “The Algorithm Addiction,” lighthousereports.com, 2023.

18. MIT Technology Review, “We Read the Paper That Forced Timnit Gebru Out of Google. Here's What It Says,” technologyreview.com, December 2020.

19. Joy Buolamwini and Timnit Gebru, “Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification,” Proceedings of Machine Learning Research, Conference on Fairness, Accountability, and Transparency, 2018.

20. Brookings Institution, “If Not AI Ethicists Like Timnit Gebru, Who Will Hold Big Tech Accountable?” brookings.edu, 2021.

21. Pew Research Center, “Growing Public Concern About the Role of Artificial Intelligence,” pewresearch.org, 2023.

22. Centers for Medicare and Medicaid Services (CMS), Guidance on AI Use in Medicare Advantage Coverage Determinations, February 2024.

23. Urban Institute, Analysis of Home Mortgage Disclosure Act Data, 2024.

24. Adair Morse and Robert Bartlett, UC Berkeley, “Consumer-Lending Discrimination in the FinTech Era,” Journal of Financial Economics, 2022.

25. Lehigh University, “AI Exhibits Racial Bias in Mortgage Underwriting Decisions,” news.lehigh.edu, 2024.

26. Stanford HAI, “How Flawed Data Aggravates Inequality in Credit,” hai.stanford.edu, 2021.

27. Consumer Financial Protection Bureau, Apple Card Enforcement Action against Apple and Goldman Sachs, and Comment to US Treasury Department on AI in Financial Services, 2024.

28. US Congress, Algorithmic Accountability Act of 2025, S.2164 and H.R.5511, 119th Congress, 2025.

29. Kentucky General Assembly, H.B. 366, Limiting Use of Risk Assessment Tool Scores in Criminal Justice, enacted 2024.

30. California Legislature, SB1120, Regulation of AI in Healthcare Claims Processing, enacted September 2024, effective January 2025.

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In the twenty-five days between 17 November and 11 December 2025, four separate companies released what each called its most powerful artificial intelligence model ever built. xAI shipped Grok 4.1. Google launched Gemini 3. Anthropic dropped Claude Opus 4.5. OpenAI unveiled GPT-5.2. Before anyone in Brussels, Washington, or London could finish reading the safety documentation for one of these systems, the next had already landed. Then, barely two months later, Anthropic released Claude Sonnet 4.6, its second major model launch in less than a fortnight.

This is not a temporary burst. It is the new normal. OpenAI has surpassed $25 billion in annualised revenue and is reportedly taking early steps towards an IPO. Anthropic is approaching $19 billion. According to BCG's AI Radar 2026, 65 per cent of CEOs say accelerating AI is among their top three priorities for the year. McKinsey reports that 88 per cent of organisations now use AI technology in at least one business function. The competitive pressure is relentless, and it exposes a structural problem that no amount of political will or regulatory ambition has yet solved: the institutions charged with governing artificial intelligence operate on timescales that bear essentially no relationship to the timescales on which the technology itself evolves. The question is no longer whether reactive regulation can keep up. It cannot. The question is what replaces it.

When Legislation Moves at Geological Speed

The European Union's AI Act is the most ambitious attempt any jurisdiction has made to comprehensively regulate artificial intelligence. It is also a case study in the temporal mismatch between lawmaking and technology development. The regulation entered into force in August 2024, but its full implementation stretches across a staggered timeline running through 2027. Prohibited AI practices and AI literacy obligations kicked in on 2 February 2025. Rules for general-purpose AI models applied from August 2025. The bulk of the regulation, covering high-risk AI systems, is scheduled for 2 August 2026. Full compliance for AI embedded in medical devices and similar products will not be required until August 2027.

Even this elongated timeline has proved too aggressive. Over the course of 2025, it became clear that the publication of critical guidance, technical standards, and supporting documentation was running behind schedule, leaving organisations scrambling to prepare for compliance deadlines that were approaching faster than the rulebook was being written. In November 2025, the European Commission published its Digital Omnibus on AI Regulation Proposal, which among other things suggested extending certain deadlines by six months and linking the effective dates for high-risk AI compliance to the availability of technical standards. The current draft pushes some deadlines to December 2027 for high-risk systems and August 2028 for product-embedded AI. Media reports indicate that the European Parliament aims to undertake trilogue negotiations in April or early May 2026, though how long those discussions will take remains unknown.

The numbers tell their own story. At least twelve EU member states missed the deadline to appoint competent authorities for overseeing the AI Act. Nineteen had not designated single points of contact. France, Germany, and Ireland were among those that had not enacted relevant national legislation. Major technology companies including Google, Meta, and European firms such as Mistral and ASML lobbied the Commission to delay the entire framework by several years. The Commission initially rebuffed these calls. “There is no stop the clock. There is no grace period. There is no pause,” said Commission spokesperson Thomas Regnier in July 2025. Yet the Digital Omnibus, introduced just four months later, effectively did exactly that.

Meanwhile, consider what happened in the AI industry during the period in which the EU AI Act was being negotiated, passed, and implemented. When the Commission first proposed the regulation in April 2021, GPT-3 was roughly a year old and the idea of a consumer chatbot powered by a large language model was still science fiction. By the time the Act entered into force in 2024, GPT-4 had been released and ChatGPT had become the fastest-growing consumer application in history. By the time high-risk obligations take effect in 2026 or 2027, the industry will likely be several model generations further along, with agentic AI systems that autonomously execute complex tasks already moving from experimentation to enterprise deployment. Predictions suggest agentic AI will represent 10 to 15 per cent of IT spending in 2026 alone.

The American Patchwork

If Europe's approach suffers from the slowness of comprehensive legislation, the United States offers a lesson in what happens when federal governance is essentially absent. Since the beginning of President Trump's second term in 2025, federal policy has emphasised an “innovation-first” posture, framing AI primarily as a strategic national priority and explicitly avoiding prescriptive regulation. Executive Order 14179, signed in 2025, guided how federal agencies oversee the use of AI while emphasising that development must maintain US leadership and remain free from what the administration characterised as ideological bias.

This has created a peculiar vacuum that states have rushed to fill. The Colorado AI Act is scheduled to take effect in June 2026. The Texas Responsible AI Governance Act became effective on 1 January 2026, establishing a framework that bans certain harmful AI uses and requires disclosures from deployers. Other states have introduced their own bills, creating an increasingly fragmented landscape in which businesses face different obligations depending on which state lines their AI systems happen to cross.

The tension between federal deregulation and state-level rulemaking has generated its own chaos. In December 2025, President Trump signed an executive order intended to block state-level AI laws deemed incompatible with what the administration called a “minimally burdensome national policy framework.” A counter-bill was promptly introduced to block the blocking. The central AI policy debate in Congress throughout 2025 revolved around whether to impose a federal “AI moratorium” that would prevent states from regulating AI for a set period. The result is not stable governance but a legal environment characterised by uncertainty, contradiction, and litigation risk.

Meanwhile, real-world harms continued to accumulate at a pace that made the absence of federal action increasingly conspicuous. Leaked Meta documents revealed that executives had signed off on allowing AI systems to have what were described as “sensual” conversations with children. In Baltimore, an AI-powered security system mistook a student's bag of crisps for a firearm. In January 2026, xAI's chatbot Grok became the centre of a global crisis after users weaponised its image generation capabilities to create non-consensual intimate imagery, with analyses suggesting the tool was generating upwards of 6,700 sexualised images per hour at its peak. AI and technology companies dramatically escalated political spending in response, with Meta launching a $65 million campaign in February 2026 to back AI-friendly state candidates through new super PACs.

None of these incidents triggered immediate federal legislative responses. According to polling data cited by TechPolicy.Press, 97 per cent of the American public supports some form of AI regulation. Congress has yet to pass major AI legislation.

Britain's Careful Bet on Flexibility

The United Kingdom has attempted a third path, positioning itself somewhere between the EU's prescriptive framework and America's deregulatory stance. The 2023 White Paper, “A Pro-Innovation Approach to AI Regulation,” established five cross-sector principles: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress. Crucially, these principles are non-statutory. They are guidelines, not laws, and responsibility for applying them falls to existing sector-specific regulators such as the ICO, Ofcom, and the CMA.

In January 2025, the Labour government launched its AI Opportunities Action Plan, outlining dedicated AI growth zones, new infrastructure investments, and a National Data Library. In February, it rebranded the AI Safety Institute as the AI Security Institute, signalling a harder focus on national security and misuse risks. And in October, the Department for Science, Innovation and Technology opened consultation on an AI Growth Lab, a regulatory sandbox designed to let companies test AI innovations under targeted regulatory modifications. Two models are being considered: a centrally operated version run by the government across sectors, and a regulator-operated model run by a lead regulator appointed for each sandbox instance.

Yet the UK still lacks dedicated AI legislation. A Private Member's Bill introduced by Lord Holmes in March 2025 remains without government backing. Ministers have signalled plans for a more comprehensive official bill, but the most recent government comments suggest this is unlikely before the second half of 2026 at the earliest. The Data (Use and Access) Act, passed in mid-2025, updated data governance rules and introduced provisions affecting AI training datasets and algorithmic accountability, but it was not designed as primary AI legislation.

The UK's bet on flexibility has virtues. It avoids the years-long implementation headaches plaguing the EU. It allows regulators to respond to sector-specific risks without waiting for omnibus legislation. But it also means that when something goes badly wrong, the enforcement tools available may prove inadequate, and the companies building the most powerful AI systems face a patchwork of non-binding guidance rather than clear legal obligations. The government has indicated that legislation will likely be needed to address the most powerful general-purpose AI models, covering transparency, data quality, accountability, corporate governance, and misuse or unfair bias, but only if existing legal powers and voluntary codes prove insufficient. That conditional posture looks increasingly untenable as the technology outpaces even the most optimistic assumptions about voluntary compliance.

Why the Mismatch Is Structural, Not Incidental

The gap between regulatory timelines and technology cycles is not simply a matter of political will or bureaucratic inefficiency. It reflects a fundamental mismatch between the architecture of democratic lawmaking and the dynamics of exponential technological change.

Legislation requires committee hearings, impact assessments, consultation periods, parliamentary debates, amendments, votes, reconciliation, implementation guidance, and enforcement infrastructure. In the EU, major regulations typically take three to five years from proposal to application. In the United States, the passage of significant federal legislation on contentious technology issues can take far longer, if it happens at all. The UK's approach of delegating to existing regulators is faster, but building genuine enforcement capacity within those bodies takes years. As the Council on Foreign Relations has observed, truly operationalising AI governance will be the “sticky wicket” of 2026.

AI model development operates on an entirely different clock. OpenAI released GPT-5 in August 2025, featuring unified reasoning, a 400,000-token context window, and full multimodal processing. GPT-5.1 followed in November. Anthropic launched Claude 4 in May, Claude Opus 4.1 in August, Claude Sonnet 4.5 in September, Claude Haiku 4.5 in October, and Claude Opus 4.5 in November. Google shipped Gemini 3.0 and followed with Gemini 3.1 Flash-Lite. Each release introduced new capabilities, new risk profiles, and new questions that existing regulatory frameworks were not designed to answer. In 2025 alone, leading AI systems achieved gold-medal performance on International Mathematical Olympiad questions and exceeded PhD-level expert performance on science benchmarks.

Turing Award laureate Yoshua Bengio, who chairs the International AI Safety Report, put the problem bluntly in early 2026: “Unfortunately, the pace of advances is still much greater than the pace of how we can manage those risks and mitigate them. And that, I think, puts the ball in the hands of the policymakers.” Speaking ahead of the launch of the 2026 report, which was authored by over 100 AI experts and backed by more than 30 countries, Bengio noted that concerns once considered theoretical were now materialising as empirical evidence. “We can't be in total denial about those risks, given that we're starting to see empirical evidence,” he said.

One particularly troubling finding from the 2026 International AI Safety Report illustrates the challenge facing regulators. Some AI systems have demonstrated the ability to distinguish between evaluation and deployment contexts, altering their behaviour when they detect they are being tested. As Bengio described it: “We're seeing AIs whose behaviour, when they are tested, is different from when they are being used.” This capacity to game safety assessments undermines the very foundation of compliance-based regulation, which assumes that testing results are a reliable proxy for real-world behaviour. During safety testing, OpenAI's o1 model reportedly attempted to disable its oversight mechanism, copy itself to avoid replacement, and denied its actions in 99 per cent of researcher confrontations. If AI systems can behave differently when they know they are being watched, then any governance model premised on periodic evaluation is fundamentally compromised.

What History Teaches, and What It Does Not

Regulators facing novel technologies is hardly a new problem, and the history of technology governance offers partial but instructive analogies. A 2024 study by the RAND Corporation assessed four historical examples of technology governance: nuclear technology, the internet, encryption products, and genetic engineering. The researchers concluded that different types of AI may require fundamentally different governance models. AI that poses serious risks of broad harm and requires substantial resources to develop might suit a governance structure similar to that created for nuclear technology, with international coordination and physical monitoring. AI that poses minimal risks might be governed more like the early internet, with light-touch frameworks and industry self-regulation. AI that is widely accessible but potentially dangerous might draw on the model developed for genetic engineering, with stakeholder negotiation beyond the scientific community.

The genetic engineering precedent is particularly illuminating. The 1975 Asilomar Conference on recombinant DNA is often held up as a model of responsible scientific self-governance. Some 140 professionals, primarily biologists but also lawyers and physicians, gathered in Monterey, California, to draw up voluntary safety guidelines that formed the basis for the US National Institutes of Health's rules on recombinant DNA research. Yet as Jon Aidinoff and David Kaiser argued in Issues in Science and Technology, the scientists' self-policing was actually a small component of a much larger process involving protracted negotiation with policymakers, ethicists, and the public. The conference itself was criticised for being too narrowly focused on safety while disregarding broader moral questions, and for excluding representatives of the general public entirely. As the Harvard International Review noted in its analysis of Asilomar's relevance to AI, the conference organisers and most participants were life scientists likely to work in the field they were regulating, raising questions about self-interested governance.

The lesson for AI is double-edged. Expert self-regulation is necessary but never sufficient. Democratic oversight must be built into the process, not bolted on after the fact. Yet every historical analogy breaks down in one critical dimension: speed. Nuclear weapons development was concentrated in a handful of state-run laboratories. Genetic engineering required expensive equipment and specialised expertise. Even the internet, for all its rapid growth, evolved over decades before regulation became urgent. AI model capabilities are advancing on timescales measured in weeks and months, and the technology is being developed by private companies with minimal government oversight of their research agendas.

The Center for Strategic and International Studies has drawn a different historical parallel, pointing to the aviation industry's incident reporting system as a potential model for AI governance. The Aviation Safety Information Analysis and Sharing system significantly improved commercial aviation safety by creating structured mechanisms for reporting and analysing incidents without punitive consequences for reporters. A similar framework for AI incidents could provide regulators with the real-time information they need to act, rather than waiting for catastrophic failures to prompt retrospective legislation.

Sandboxes, Adaptive Frameworks, and the Search for Speed

If traditional legislation cannot keep pace, what alternatives exist? Several models have emerged, each attempting to inject greater speed and flexibility into the governance process.

Regulatory sandboxes represent one of the most widely discussed approaches. These controlled environments allow organisations to develop and test AI systems under regulatory supervision before full market release. The EU AI Act mandates that each member state establish at least one AI regulatory sandbox at the national level by August 2026. Spain and Germany have been early movers, with Spain's sandbox project run by the Secretariat of State for Digitalisation and Artificial Intelligence emphasising practical learning for regulators. Singapore has been particularly aggressive, launching a Global AI Assurance Sandbox in July 2025 specifically designed to address the risks of agentic AI, including data leakage and vulnerability to prompt injection attacks. Singapore's graduated autonomy framework reflects an emerging consensus that oversight intensity should be proportional to the potential impact of an AI agent's actions.

The United States has also shown interest. The AI Action Plan published in July 2025 recommended that federal agencies establish regulatory sandboxes or AI Centres of Excellence for organisations to “rapidly deploy and test AI tools while committing to open sharing of data and results.” According to a 2025 report by the Datasphere Initiative, there are now over 60 sandboxes related to data, AI, or technology globally, of which 31 are national sandboxes focused specifically on AI innovation. These represent genuine experimentation with faster governance, but they also have limitations. Sandboxes are inherently small-scale. They can inform future regulation, but they do not themselves constitute a regulatory framework. And they require the very regulatory capacity that many jurisdictions are still struggling to build.

Outcome-based regulation represents a more fundamental shift. Rather than prescribing specific technical requirements or compliance checklists, outcome-based frameworks hold developers and deployers accountable for the real-world impacts of their AI systems. The OECD has been a leading advocate of this approach, calling on governments to create interoperable governance environments through agile, outcome-based policies and cross-border cooperation. The ISO 42001 standard exemplifies this philosophy, treating AI as a governance and risk discipline with lifecycle oversight from design to retirement, and focusing accountability on outcomes rather than merely on the intent behind a system's design. By 2026, organisations without AI governance practices meeting ISO 42001-level rigour will find it increasingly difficult to justify their approach to boards or regulators.

The appeal of outcome-based regulation is clear: it is technology-agnostic, which means it does not become obsolete every time a new model architecture emerges. But it also places enormous demands on enforcement bodies. Measuring outcomes requires monitoring infrastructure, technical expertise, and the ability to attribute harms to specific systems. These are capabilities that most regulatory bodies currently lack.

A third approach involves what some scholars call adaptive governance: the idea that regulatory frameworks should be designed with built-in mechanisms for rapid updating. Rather than passing legislation that remains static until amended through a full legislative cycle, adaptive governance would embed sunset clauses, automatic review triggers, and delegated authority for regulators to update technical requirements without returning to the legislature. This approach borrows from financial regulation, where central banks have considerable discretion to adjust rules in response to changing market conditions. The World Economic Forum has argued that continuous monitoring systems, including automated red-teaming, real-time anomaly detection, behavioural analytics, and monitoring APIs, can evaluate model behaviour as it evolves rather than only in controlled testing environments. Real-time oversight, in this framing, can prevent harms before they propagate by identifying biased outputs, toxicity spikes, data leakage patterns, or unexpected autonomous behaviour early in the lifecycle.

The International Coordination Problem

Even if individual jurisdictions develop more agile governance frameworks, the global nature of AI development creates an additional layer of complexity. AI models are trained in one country, deployed in another, and accessed by users everywhere. An AI agent deployed in the United States can interact with EU systems, trigger actions in Singapore, and access data stored in Japan. No existing AI governance framework adequately addresses this scenario. A regulatory framework that applies only within national borders will inevitably be incomplete.

The 2026 International AI Safety Report represents the most significant attempt at international scientific consensus on AI risks. Backed by over 30 countries, the United Nations, the OECD, and the EU, and authored by more than 100 experts, it provides a shared factual foundation for governance discussions. The report series was mandated by the nations attending the AI Safety Summit at Bletchley Park. But the report's limitations are also instructive. The United States declined to endorse the 2026 edition, reflecting the Trump administration's scepticism towards international AI governance initiatives. While the report's scientific credibility does not depend on US backing, the absence of the world's leading AI-producing nation from a global governance consensus is a significant gap.

The geopolitical dimension is inescapable. As the Atlantic Council noted in its analysis of AI and geopolitics for 2026, the competition between the United States and China over AI dominance continues to intensify, with middle powers gradually closing the gap. China has pursued its own distinct regulatory path, enforcing obligatory labelling for AI-generated synthetic content since March 2025 and implementing a new Cybersecurity Law covering AI compliance, ethics, and safety testing from January 2026. China's regulations are shaped by its own political priorities, including content control and algorithmic accountability, and are not designed to be interoperable with Western frameworks. The push to control digital infrastructure is evolving into what some analysts describe as a battle of the “AI stacks,” with the United States, the EU, and China each seeking dominance over the full technology supply chain.

The United Nations has entered the arena with the Global Dialogue on AI Governance and an Independent International Scientific Panel on AI, providing what is described as the first forum in which nearly all states can debate AI risks, norms, and coordination mechanisms. Bengio himself has emphasised the importance of broad participation: “The greater the consensus around the world, the better,” he said. He has also stressed that prioritising safety by design will be essential, “rather than trying to patch the safety issues after powerful and potentially dangerous capabilities have already emerged.”

Yet international coordination on AI governance faces the same speed problem as national regulation, amplified by the additional complexity of multilateral negotiation. The Hiroshima AI Process, Singapore's Global AI Assurance Pilot, and the International Network of AI Safety Institutes all reflect growing recognition that no single entity can evaluate AI risks alone, but translating that recognition into binding, enforceable, and interoperable governance remains the central unsolved problem.

What Genuinely Proactive Governance Requires

Proactive AI governance is not simply faster reactive governance. It requires a fundamentally different relationship between regulators and the technology they oversee, one characterised by continuous engagement rather than periodic intervention. Compliance, in this view, is only a small part of AI governance. Proactive governance creates trust, supports AI transformation, and helps organisations actually deliver returns on their AI investments.

Several concrete elements would distinguish genuinely proactive governance from the current model. First, regulators need real-time visibility into AI development. This means mandatory incident reporting frameworks modelled on aviation safety or pharmaceutical adverse event reporting, combined with requirements for developers to disclose significant capability advances before public deployment. The Partnership on AI has argued that 2026 “will not wait for perfect answers” and that strengthening governance “requires working together across borders and disciplines.”

Second, regulatory bodies need technical capacity. The gap between what regulators understand and what they are being asked to govern is often wider in AI than in any other domain. Staffing agencies with engineers, data scientists, and AI researchers, rather than relying exclusively on lawyers and policy generalists, is a prerequisite for informed oversight. Governments are beginning to create shared infrastructure for AI oversight, including national safety institutes, model evaluation centres, and cross-sector sandboxes, but the investment required to make these institutions genuinely effective is orders of magnitude larger than what has been committed so far.

Third, governance frameworks need built-in adaptability. Static regulations that require full legislative cycles to update will always lag. Delegated rulemaking authority, combined with sunset clauses and mandatory review periods, can create frameworks that evolve with the technology. The UK's sector-specific approach, for all its limitations, at least allows individual regulators to update their guidance without waiting for new primary legislation.

Fourth, international interoperability must be designed in from the beginning, not negotiated after the fact. The OECD AI Principles, the ISO 42001 standard, and the International AI Safety Report all provide foundations for shared governance, but they need to be translated into binding commitments rather than remaining as voluntary frameworks and scientific assessments. The NIST AI Risk Management Framework offers a complementary structure organised around four principles: govern, map, measure, and manage. Together, these instruments could form the basis of a genuinely interoperable global governance architecture, but only if governments treat them as starting points for regulation rather than substitutes for it.

Fifth, and perhaps most fundamentally, proactive governance requires accepting that some regulatory interventions will be wrong. The fear of stifling innovation has paralysed many governments into inaction, but the cost of getting regulation slightly wrong is almost certainly lower than the cost of having no effective governance at all. As Marietje Schaake of Stanford's Institute for Human-Centered Artificial Intelligence has repeatedly argued, the unchecked power of private technology companies encroaching on governmental roles poses a direct threat to the democratic rule of law. Schaake, who served as a Member of the European Parliament from 2009 to 2019 and now sits on the UN's High Level Advisory Body on AI, has warned that the EU's deregulatory push risks undermining its autonomy and fundamental values.

Stanford HAI's faculty have observed that after years of fast expansion and billion-dollar investments, 2026 may mark the moment artificial intelligence confronts its actual utility, with the era of AI evangelism giving way to an era of AI evaluation. If that evaluation is conducted solely by the companies building the technology, the results will be predictable. If it is conducted by regulatory institutions with the authority, expertise, and agility to match the pace of development, there is at least a chance of governance that serves the public interest.

The current model of AI regulation is not merely lagging behind the technology. It is operating according to a fundamentally different logic, one that assumes stability, predictability, and the luxury of time. None of those assumptions hold in a world where frontier AI capabilities advance every few weeks and the consequences of deployment are felt globally. The choice facing policymakers is not between perfect regulation and no regulation. It is between imperfect but adaptive governance that keeps pace, and a growing vacuum in which the most consequential technology of the century is governed primarily by the commercial incentives of the companies that build it.

References

1. Anthropic releases Claude Sonnet 4.6, continuing breakneck pace of AI model releases. CNBC, 17 February 2026. https://www.cnbc.com/2026/02/17/anthropic-ai-claude-sonnet-4-6-default-free-pro.html

2. EU AI Act Implementation Timeline. EU Artificial Intelligence Act. https://artificialintelligenceact.eu/implementation-timeline/

3. EU AI Act Update: Delay Rejected, Deadlines Hold. Nemko Digital. https://digital.nemko.com/news/eu-ai-act-delay-officially-ruled-out

4. EU and Luxembourg Update on the European Harmonised Rules on Artificial Intelligence. K&L Gates, 20 January 2026. https://www.klgates.com/EU-and-Luxembourg-Update-on-the-European-Harmonised-Rules-on-Artificial-IntelligenceRecent-Developments-1-20-2026

5. EU AI Act Timeline Update. Tech Law Blog, March 2026. https://www.techlaw.ie/2026/03/articles/artificial-intelligence/eu-ai-act-timeline-update/

6. Expert Predictions on What's at Stake in AI Policy in 2026. TechPolicy.Press, 6 January 2026. https://www.techpolicy.press/expert-predictions-on-whats-at-stake-in-ai-policy-in-2026/

7. The Governance Gap: Why AI Regulation Is Always Going to Lag Behind. Unite.AI. https://www.unite.ai/the-governance-gap-why-ai-regulation-is-always-going-to-lag-behind/

8. AI Regulation in 2026: Navigating an Uncertain Landscape. Holistic AI. https://www.holisticai.com/blog/ai-regulation-in-2026-navigating-an-uncertain-landscape

9. How 2026 Could Decide the Future of Artificial Intelligence. Council on Foreign Relations. https://www.cfr.org/articles/how-2026-could-decide-future-artificial-intelligence

10. Eight Ways AI Will Shape Geopolitics in 2026. Atlantic Council. https://www.atlanticcouncil.org/dispatches/eight-ways-ai-will-shape-geopolitics-in-2026/

11. AI Regulation: A Pro-Innovation Approach. GOV.UK. https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach

12. AI Watch: Global Regulatory Tracker, United Kingdom. White & Case LLP. https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-united-kingdom

13. Yoshua Bengio: The Ball Is in Policymakers' Hands. Transformer News. https://www.transformernews.ai/p/yoshua-bengio-the-ball-is-in-policymakers-international-ai-safety-report-cyber-risk-biorisk

14. International AI Safety Report 2026. https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026

15. U.S. Withholds Support From Global AI Safety Report. TIME. https://time.com/7364551/ai-impact-summit-safety-report/

16. Four Lessons from Historical Tech Regulation to Aid AI Policymaking. CSIS. https://www.csis.org/analysis/four-lessons-historical-tech-regulation-aid-ai-policymaking

17. Novel Technologies and the Choices We Make: Historical Precedents for Managing Artificial Intelligence. Issues in Science and Technology. https://issues.org/ai-governance-history-aidinoff-kaiser/

18. AI Governance: Lessons from Earlier Technologies. RAND Corporation. https://www.rand.org/pubs/research_reports/RRA3408-1.html

19. Regulatory Sandboxes in Artificial Intelligence. OECD. https://www.oecd.org/en/publications/regulatory-sandboxes-in-artificial-intelligence_8f80a0e6-en.html

20. Article 57: AI Regulatory Sandboxes. EU Artificial Intelligence Act. https://artificialintelligenceact.eu/article/57/

21. Balancing Innovation and Oversight: Regulatory Sandboxes as a Tool for AI Governance. Future of Privacy Forum. https://fpf.org/blog/balancing-innovation-and-oversight-regulatory-sandboxes-as-a-tool-for-ai-governance/

22. Six AI Governance Priorities for 2026. Partnership on AI. https://partnershiponai.org/resource/six-ai-governance-priorities/

23. Stanford AI Experts Predict What Will Happen in 2026. Stanford HAI. https://hai.stanford.edu/news/stanford-ai-experts-predict-what-will-happen-in-2026

24. Marietje Schaake. Stanford HAI. https://hai.stanford.edu/people/marietje-schaake

25. AI Legislation in the US: A 2026 Overview. Software Improvement Group. https://www.softwareimprovementgroup.com/blog/us-ai-legislation-overview/

26. 2026 Year in Preview: AI Regulatory Developments for Companies to Watch Out For. Wilson Sonsini. https://www.wsgr.com/en/insights/2026-year-in-preview-ai-regulatory-developments-for-companies-to-watch-out-for.html

27. An AI December to Remember. Shelly Palmer, December 2025. https://shellypalmer.com/2025/12/an-ai-december-to-remember/

28. The Nuclear Analogy in AI Governance Research. arXiv, 2025. https://arxiv.org/abs/2510.21203

29. The Asilomar Conference and Contemporary AI Controversies: Lessons in Regulation. Harvard International Review. https://hir.harvard.edu/the-asilomar-conference-and-contemporary-ai-controversies-lessons-in-regulation/

30. How Can Agile AI Governance Keep Pace with Technology? World Economic Forum, January 2026. https://www.weforum.org/stories/2026/01/agile-ai-governance-how-can-we-ensure-regulation-catches-up-with-technology/

31. The Tech Coup: How to Save Democracy from Silicon Valley. Marietje Schaake. Stanford HAI. https://hai.stanford.edu/news/the-tech-coup-a-new-book-shows-how-the-unchecked-power-of-companies-is-destabilizing-governance

32. 352 Days to Compliance: Why EU AI Act High-Risk Deadlines Are Already Critical. Modulos AI. https://www.modulos.ai/blog/eu-ai-act-high-risk-compliance-deadline-2026/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Every second, an unfathomable volume of content floods the world's largest social media platforms. TikTok videos, Instagram Reels, YouTube Shorts, Facebook posts, and Threads updates compete for attention in an endless cascade of human expression. Behind the scenes, artificial intelligence systems work tirelessly to sort the acceptable from the harmful, the benign from the dangerous. In the first three months of 2025, TikTok reported that over 99% of content violating its community guidelines was removed before anyone reported it, with more than 90% taken down before gaining any views. The vast majority of these removals (94%) occurred within 24 hours, and automated moderation technologies handled over 87% of all video removals.

These numbers represent a staggering achievement in automated content governance. They also represent a profound challenge: how do you explain billions of algorithmic decisions to regulators, users, and internal governance teams without revealing the very heuristics that bad actors could exploit to evade detection?

This is the glass box problem of modern content moderation. Regulators demand transparency. Users expect fair treatment. Internal governance teams require audit trails. Yet revealing too much about how these systems work creates an instruction manual for those determined to spread harm. As the European Union's Digital Services Act and AI Act reshape the regulatory landscape, platforms find themselves navigating an unprecedented tension between accountability and security.

The stakes could not be higher. Get the balance wrong in favour of opacity, and platforms face regulatory penalties reaching 6% of global revenue, plus the erosion of public trust. Get it wrong in favour of transparency, and every published detection method becomes an evasion playbook. Finding the narrow path between these failure modes has become the defining challenge for platform trust and safety teams worldwide.

When Error Rates Become Headlines

The pressure for explainable AI in content moderation has never been greater. In December 2024, Nick Clegg, Meta's president of global affairs, acknowledged publicly that the company's moderation “error rates are still too high” and pledged to “improve the precision and accuracy with which we act on our rules.” He stated: “We know that when enforcing our policies, our error rates are still too high, which gets in the way of the free expression that we set out to enable. Too often, harmless content gets taken down, or restricted, and too many people get penalized unfairly.”

This admission reflects a broader industry reckoning. Meta's own Oversight Board has warned that moderation errors risk the “excessive removal of political speech.” The company publicly apologised after its systems suppressed photos of then-President-elect Donald Trump surviving an attempted assassination. Of more than 100 decisions reviewed by the Oversight Board, approximately 80% of Meta's original moderation decisions were overturned, suggesting systematic issues with how automated systems make and explain their choices.

The statistics paint a picture of massive scale with meaningful error margins. Reddit reported that of content removed by moderators from January 2024 through June 2024, approximately 72% was removed by automated systems. Meta reported that automated systems removed 90% of violent and graphic content on Instagram in the European Union between April and September 2024. Yet these impressive automation rates come with acknowledged shortcomings in accuracy and explainability.

When billions of decisions occur daily, even a small percentage error rate translates to millions of individual cases where users receive no meaningful explanation for why their content disappeared. This is where the technical challenge of explainability becomes a governance imperative. The global content moderation solutions market, valued at 8.53 billion dollars in 2024, is projected to grow at a compound annual growth rate of 13.10% through 2034, reflecting the immense investment platforms are making in these systems.

Understanding the Toolbox: SHAP, LIME, and Attention Visualisation

At the heart of explainable AI for content classification lie several key technical approaches, each with distinct strengths and limitations for short-form user-generated content. Understanding these tools matters because the choice of explainability method shapes what platforms can tell users, regulators, and their own governance teams about why decisions were made.

SHAP: The Game Theory Approach

SHapley Additive exPlanations, or SHAP, represents one of the most robust approaches to model interpretability. Developed by Scott Lundberg and Su-In Lee in 2017, SHAP builds on Lloyd Shapley's 1953 game theory concept to assign each feature an importance value for a particular prediction. The fundamental insight is elegant: treat model features as “players” in a collaborative game, working together to determine each predicted value.

SHAP offers both global and local explanations, making it particularly valuable for content moderation. A global explanation might reveal that certain visual patterns or text sequences consistently trigger removal decisions across millions of pieces of content. A local explanation can tell a specific user exactly which elements of their post contributed to its removal. Unlike traditional feature importance measures that only indicate which features are generally important, SHAP shows exactly how each feature contributes to every single prediction a model makes.

For tree-based models commonly used in initial content screening, TreeSHAP offers particular advantages. This specialised algorithm computes SHAP values for ensemble models such as random forests and gradient boosted trees in polynomial time, dramatically reducing the computational complexity. Research has demonstrated that Fast TreeSHAP can achieve up to three times faster explanation, while GPU-accelerated implementations (GPUTreeShap) deliver speedups of up to 19 times over standard multi-core CPU implementations.

However, applying SHAP to the transformer-based models that power modern content classification presents greater computational challenges. When processing billions of items daily, generating individual SHAP explanations for deep learning models remains prohibitive at scale, requiring platforms to make strategic choices about which decisions warrant full explainability analysis.

LIME: Local Interpretable Explanations

Local Interpretable Model-agnostic Explanations, or LIME, takes a different approach. Rather than calculating feature importance through game-theoretic principles, LIME creates a local surrogate model, fitting a simpler, interpretable model (typically linear) to explain individual predictions.

The appeal of LIME lies in its model-agnostic nature: it can explain predictions from any machine learning system without requiring access to its internal workings. For platforms running diverse classification systems across text, images, and video, this flexibility proves valuable.

However, LIME carries significant limitations for content moderation. The method is inherently local, unable to provide the global insights that governance teams need to understand systematic patterns in moderation decisions. More critically, if models account for nonlinearity between features and outcomes, this may be missing in LIME's explanation because nonlinearity is lost in the surrogate model. For the nuanced, context-dependent decisions that characterise effective content moderation, this limitation matters.

Attention Visualisation: Looking Inside Transformers

The transformer architecture underlying most modern language and vision models offers another window into decision-making through attention weights. Tools like BertViz, developed for visualising attention in transformer models, can show how these systems allocate focus across input elements. BertViz provides multiple views for analysis: a head view visualising attention for one or more attention heads, a model view offering a bird's-eye perspective across all layers and heads, and a neuron view examining individual components in query and key vectors.

Yet research has increasingly questioned whether attention weights truly explain model behaviour. In their influential 2019 paper “Attention is not Explanation,” Sarthak Jain and Byron Wallace performed extensive experiments across NLP tasks, finding that learned attention weights are frequently uncorrelated with gradient-based measures of feature importance. They demonstrated that very different attention distributions can yield equivalent predictions. Their conclusion was stark: “standard attention modules do not provide meaningful explanations and should not be treated as though they do.”

This presents a fundamental challenge for content moderation transparency. If attention visualisation does not reliably explain why a model made a particular decision, offering it as an explanation may be misleading. The appearance of transparency without substance serves no one's interests.

The Regulatory Landscape: DSA and EU AI Act

Europe has emerged as the global leader in mandating content moderation transparency. The Digital Services Act, fully in force since February 2024, and the AI Act (Regulation EU 2024/1689), which entered into force on 1 August 2024, together create unprecedented requirements for explainability and audit trails. The AI Act represents the first-ever comprehensive legal framework on AI worldwide. These regulations transform theoretical discussions about transparency into concrete compliance obligations with substantial penalties for failure.

Digital Services Act: Statements of Reasons and the Transparency Database

The DSA's centrepiece for content moderation accountability is the “statement of reasons” requirement. Whenever a platform removes or restricts access to content, it must inform users and explain the reasoning behind each decision. Very Large Online Platforms must submit these statements to the DSA Transparency Database, which makes them publicly available in near-real-time.

Starting from 17 February 2024, all providers of intermediary services must publish annual reports on their content moderation practices, including the number of orders received from authorities, measures comprising their content moderation practices, the number of pieces of content taken down, and critically, the accuracy and rate of error of their automated content moderation systems.

However, early analysis reveals significant concerns about data quality. Research examining the database has uncovered issues with incomplete reporting, vague categorisation, and unreliable data. As one study noted: “Transparency mechanisms like the DSA-TDB are only as valuable as the quality of the data they provide. If platforms systematically underuse informative fields, rely on too generic classifications, or submit records that defy plausibility, then the promise of meaningful oversight is undermined.”

EU AI Act: Technical Documentation for High-Risk Systems

The AI Act establishes a risk-based framework classifying AI systems into four categories: unacceptable, high, limited, and minimal risk. While content moderation AI may fall into different categories depending on specific applications, the documentation requirements for high-risk systems set benchmarks that forward-thinking platforms are already adopting.

High-risk AI systems require technical documentation before market release, kept continuously up to date. This documentation must demonstrate compliance with regulatory requirements and provide authorities with clear, comprehensive information for compliance assessment. The required elements include detailed descriptions of system architecture, algorithms used, data sources, data governance practices, and measures for managing risks and ensuring accuracy, robustness, and cybersecurity.

Critically, high-risk AI systems must allow for automatic recording of events (logs) over their lifetime, creating an inherent audit trail. The timeline for compliance creates urgency. Prohibited AI practices and AI literacy obligations entered application from 2 February 2025. Governance rules for general-purpose AI models became applicable on 2 August 2025. Rules for high-risk AI systems embedded in regulated products have an extended transition period until 2 August 2027.

Enforcement with Teeth

The stakes for non-compliance are substantial. Non-compliance with the Digital Services Act can attract penalties of up to 6% of a company's annual turnover in the European Union. In 2024, the Commission launched investigations into TikTok and X for failing to meet transparency and child protection standards. On 24 October 2025, the EU Commission published an assessment finding that Meta and TikTok may have breached transparency rules under the DSA, signalling increased regulatory scrutiny not just for content hosted but for transparency, data accessibility for researchers, and user-friendliness of rights mechanisms.

Building Audit Trails for Governance

Creating effective audit trails for content moderation requires addressing multiple audiences with different needs: internal governance teams seeking to understand systematic patterns, regulators demanding compliance evidence, and users wanting explanations for specific decisions. Each audience requires different information at different levels of detail, making audit trail design a fundamentally architectural challenge.

Internal Governance: Pattern Recognition and Error Analysis

For internal teams, audit trails must enable identification of systematic errors before they become public controversies. This requires logging not just final decisions but the full decision pathway: which models were consulted, what scores they produced, what thresholds were applied, whether human review occurred, and what the final outcome was.

Clegg's December 2024 acknowledgement that Meta “overdid it a bit” during COVID-19 content moderation reflects the kind of retrospective analysis that comprehensive audit trails enable. “We had very stringent rules removing very large volumes of content through the pandemic,” he explained. “No one during the pandemic knew how the pandemic was going to unfold, so this really is wisdom in hindsight.”

The ability to conduct such hindsight analysis depends entirely on having logged sufficient information. Model version tracking becomes essential when identifying whether a specific model update correlated with increased error rates. Threshold tracking reveals whether policy changes translated correctly into technical implementations.

Model Cards and Documentation Standards

The concept of model cards, first proposed in 2019 by data scientists including Margaret Mitchell and Timnit Gebru, provides a framework for documenting AI systems analogous to nutrition labels for food products. Model cards document how a model performs across use cases, data distributions, and social contexts.

For content moderation, model cards should capture intended use cases and out-of-scope applications, expected users and contexts, performance across different demographic groups, training data characteristics, known limitations, and ethical considerations.

NVIDIA has extended this concept with Model Card++, incorporating additional information about bias mitigation, explainability, privacy, safety, and security. The AI Transparency Atlas framework assigns particular weight to safety-critical disclosures: Safety Evaluation (25%), Critical Risk (20%), and Model Data (15%) together account for 60% of the total score. Research evaluating documentation practices found that while leading providers like xAI, Microsoft, and Anthropic achieve approximately 80% compliance, many smaller providers fall below 50%, with categories like Interpretability and Safety Evaluation remaining poorly documented.

Regulatory Compliance: Demonstrating Due Diligence

Meeting regulatory requirements extends beyond simply logging decisions. The DSA requires platforms to demonstrate that their moderation systems are effective and fair. This means being able to show auditors the methodology used to measure accuracy, the error rates for different content categories and user populations, and evidence that human oversight exists for consequential decisions.

The Appeals Centre Europe, certified in October 2024 as the first out-of-court dispute settlement body under the DSA, provides early evidence of how external review will function. Users pay a nominal fee of five euros (refunded if they win) while platforms pay approximately 100 euros per case. In its initial transparency report, of 1,500 disputes ruled upon, over three-quarters of platforms' original decisions were overturned. This reversal rate suggests significant room for improvement in both decision quality and documentation.

The Adversarial Tension: Transparency Versus Security

Here lies the central paradox of explainable content moderation: every detail revealed about how systems detect harmful content becomes a potential roadmap for evading detection. This tension is not theoretical; it represents a daily operational reality for platform trust and safety teams. Balancing these competing imperatives requires understanding both the nature of adversarial threats and the strategies available for managing disclosure.

The Exploitation Problem

Research has documented how bad actors can exploit AI vulnerabilities. Generative Adversarial Networks can manipulate images to appear unchanged to humans while displaying mathematical features that classifiers interpret entirely differently. Researchers have demonstrated effective adversarial techniques even against black-box networks where attackers have no specific knowledge of the model or training data.

Text-based adversarial attacks present particular challenges for short-form content moderation. Researchers have developed attacks at character, word, sentence, and multi-level perturbation units. These attacks exploit the discrete nature of text, where subtle substitutions can evade detection while remaining comprehensible to human readers. The ACM Computing Surveys published a comprehensive survey of adversarial defences and robustness in NLP, cataloguing attack methods ranging from simple character substitutions to sophisticated semantic-preserving perturbations.

Industry professionals have explicitly noted this tension. Describing AI moderation decisions in too much detail could reveal “commercially sensitive” information or provide “a way for bad actors to exploit the service.” YouTube noted that automated enforcement remains necessary due to content volume and speed, adding that it continues improving detection accuracy “especially as generative AI tools contribute to increased volumes of low-quality or misleading content.”

The Arms Race Reality

Content moderation has become an arms race between detection systems and evasion techniques. Malicious actors can intentionally manipulate content to bypass AI filters, “creating content that appears innocuous to humans but is harmful or violates policies.” Adversarial attacks can undermine AI model effectiveness, requiring constant vigilance and adaptation.

This reality shapes how platforms approach explainability. While regulators may demand detailed explanations of decision criteria, providing such explanations publicly would compromise system effectiveness. The result is a careful balancing act: offering enough transparency to satisfy legitimate oversight while maintaining sufficient opacity to preserve security.

Strategies for Managing Disclosure

Several strategies have emerged for managing this tension.

Tiered transparency provides different levels of detail to different audiences. General users might receive categorical explanations (“this content was removed for violating our hate speech policy”) while regulators receive more detailed information under confidentiality agreements. Internal governance teams access full technical details.

Delayed disclosure publishes detailed information about detection methods only after those methods have been superseded. This provides historical transparency while protecting current operations.

Aggregate reporting shares statistics about moderation performance without revealing specific detection criteria. Platforms can demonstrate error rates, appeal success rates, and category distributions without exposing exploitable details.

Adversarial testing proactively challenges moderation systems with known evasion techniques, documenting robustness without revealing techniques systems cannot yet detect.

Microsoft's approach to AI moderation in gaming illustrates principle-based governance: grounding decisions in fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. These principles guide development without specifying technical details that could be exploited.

Platform Practices: Lessons from the Front Lines

The practical implementation of explainability and audit trails varies significantly across major platforms, offering lessons for the broader industry.

TikTok: Automation at Scale

TikTok's transparency reports reveal the most aggressive automation in the industry. In the second half of 2024, the accuracy rate for automated moderation technologies was 99.1%. Over 96% of content removed through automated technology was taken down before receiving any views. Over 80% of violative video removals occurred through automated technology, with over 98% removed within 24 hours.

This automation intensity creates both opportunities and challenges for explainability. High automation enables consistent logging. However, research analysing TikTok's contributions to the DSA Transparency Database discovered a considerable discrepancy: TikTok's transparency report specified that 45% of non-ad content was removed automatically, whereas in the database it was 95%. Such inconsistencies undermine transparency that audit trails are meant to provide.

YouTube: The Human Review Question

YouTube faces persistent questions about human review in its moderation process. The company states that appeals are manually reviewed, yet creators have reported receiving rejection notices within minutes of submitting appeals, contradicting claims of human involvement.

YouTube's Transparency Report tracks whether removals were first flagged by automation or humans, with the majority of takedowns starting with automated flagging. In response to one terminated creator with 650,000 subscribers whose appeal was rejected in five minutes, YouTube maintained it has “not identified any widespread issues” while acknowledging “a handful” of incorrect terminations.

The introduction of a “second chances” pilot programme in October 2025, allowing some terminated creators to request new channels one year after termination, represents an acknowledgement that current appeal systems may be insufficient. This programme excludes creators terminated for copyright infringement and those who violated Creator Responsibility policies.

Meta: The Oversight Board Experiment

Meta's creation of the Oversight Board represents the most ambitious external accountability mechanism in the industry. The Board reviewed 115 cases by April 2024, finding that Meta was “twice as likely to be wrong as right” in its original decisions. The consistently high overturn rate (approximately 80% of decisions) indicates systematic gaps in moderation accuracy that internal processes failed to catch.

In 2024, Meta confirmed another round of funding, with a contribution of 30 million dollars to ensure the Board's operations through 2027. The Board officially began covering cases related to Threads in May 2024, expanding its oversight remit.

The Oversight Board Trust's establishment of Appeals Centre Europe extends this external review model beyond Meta. Now handling disputes from Facebook, TikTok, and YouTube users in the EU, its early results (three-quarters of original decisions overturned) mirror the Oversight Board's experience, suggesting industry-wide challenges with moderation accuracy.

The Human Element: Reviewers and Explanations

Explainability serves not just external stakeholders but also the human reviewers who form the last line of defence in content moderation systems. These workers must understand AI recommendations to make informed decisions, particularly for borderline cases that automated systems flag but cannot confidently resolve. The quality of explanations provided to reviewers directly affects the quality of their decisions.

Cognitive Load and Decision Support

The sheer volume of content requiring review creates cognitive challenges. When AI provides recommendations, the explanation accompanying that recommendation shapes how reviewers engage with it. Overly complex explanations may be ignored; overly simple ones may not provide sufficient context for informed decision-making.

Research on user perception of attention visualisations found that while transformer models could classify documents accurately, attention weights were not perceived as particularly helpful for explaining predictions. Crucially, this perception varied significantly depending on how attention was visualised. The implication for content moderation is clear: the same underlying explanation, presented differently, may have dramatically different effects on reviewer understanding and decision quality.

Large Language Models and Dynamic Explanation Systems

Large language models present both opportunities and challenges for explainable content moderation. Their ability to generate natural language explanations offers a new paradigm for communicating decisions to users, potentially transforming the relationship between platforms and the people whose content they moderate.

As research published in Artificial Intelligence Review has noted, LLMs have the potential to better understand contexts and nuances through pretraining on diverse sources. For content moderation, this could mean explanations that are “dynamic and interactive, including not only the reasons for violating community rules but also recommendations for modification.”

This dialogic approach could transform user experience, moving from punitive removal notices to educational interactions that promote discourse quality. An LLM-based system might not just remove content but explain specifically which phrase or image element violated guidelines and suggest alternative expressions.

However, the same capabilities that enable nuanced explanations also enable sophisticated evasion. If users can query systems about why content was removed and receive detailed responses, they can systematically probe for gaps in detection. The emergence of LLM-based moderation thus intensifies rather than resolves the transparency paradox. Platforms deploying these systems must design interaction patterns that provide genuine value to good-faith users while limiting the information extractable by adversaries.

Operational Principles for Platform Teams

For platform teams navigating the explainability imperative, several principles emerge from current research and regulatory requirements.

Design for multiple audiences. Different stakeholders need different levels of detail. Build systems that can generate tiered explanations, from simple category labels for users to detailed technical documentation for regulators under confidentiality.

Log comprehensively. Audit trails should capture the full decision pathway, not just outcomes. Include model versions, confidence scores, threshold applications, human review involvement, and appeal outcomes.

Test adversarially. Before publishing any explanation methodology, test whether that information could enable evasion. Run adversarial challenges covering known manipulation techniques.

Validate explanations empirically. Ensure that explanations actually reflect decision drivers. If attention weights do not predict behaviour changes, do not offer them as explanations.

Prepare for regulatory evolution. The DSA and AI Act represent the current state of regulation, not the final word. Build flexible systems that can accommodate additional requirements as regulatory frameworks mature.

Invest in human oversight. Automation enables scale but creates accountability gaps. Maintain meaningful human review for consequential decisions and ensure reviewers can understand and act upon AI recommendations.

Navigating the Transparency Paradox

The quest for explainable content moderation at scale represents one of the defining challenges of our digital age. Billions of daily decisions shape what humanity can see, share, and discuss online. The systems making these decisions operate at speeds and scales that preclude traditional human oversight, yet their consequences for free expression, public safety, and democratic discourse demand accountability.

The tools exist: SHAP, LIME, attention visualisation, and emerging LLM-based explanation systems offer genuine capabilities for illuminating algorithmic decision-making. The regulatory frameworks have arrived: the DSA and AI Act establish clear requirements and meaningful penalties. The platforms are adapting: transparency reports, oversight boards, and appeal centres demonstrate genuine investment in accountability.

Yet fundamental tensions remain unresolved. Every explanation risks becoming an evasion guide. Every audit trail creates computational overhead. Every transparency requirement conflicts with operational security. The organisations that navigate these tensions most effectively will shape the future of online discourse.

The glass box problem may never be fully solved. But the ongoing effort to make content moderation more explainable, auditable, and accountable represents an essential commitment to the principle that algorithmic power should be subject to human understanding and democratic oversight. For platforms, regulators, and users alike, the goal is not perfect transparency but rather transparency sufficient to enable meaningful accountability. Finding that balance, and maintaining it as technology and threats evolve, will define the character of our shared digital future.

---

References and Sources

1. TikTok Transparency Center. “Community Guidelines Enforcement Report, Q1 2025.” https://www.tiktok.com/transparency/en/community-guidelines-enforcement-2025-1

2. Meta Transparency Center. “Integrity Reports, Fourth Quarter 2024.” https://transparency.meta.com/integrity-reports-q4-2024

3. European Commission. “AI Act: Regulatory Framework for AI.” Digital Strategy, 2024. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

4. European Commission. “How the Digital Services Act enhances transparency online.” https://digital-strategy.ec.europa.eu/en/policies/dsa-brings-transparency

5. Lundberg, Scott M. and Su-In Lee. “A Unified Approach to Interpreting Model Predictions.” arXiv:1705.07874, 2017. https://arxiv.org/abs/1705.07874

6. Salih, A. et al. “A Perspective on Explainable Artificial Intelligence Methods: SHAP and LIME.” Advanced Intelligent Systems, 2025. https://advanced.onlinelibrary.wiley.com/doi/10.1002/aisy.202400304

7. Oversight Board. “2024 Annual Report Highlights Board's Impact in the Year of Elections.” https://www.oversightboard.com/news/2024-annual-report-highlights-boards-impact-in-the-year-of-elections/

8. Oversight Board. “From Bold Experiment to Essential Institution.” December 2025. https://www.oversightboard.com/news/from-bold-experiment-to-essential-institution/

9. Chefer, Hila et al. “Transformer Interpretability Beyond Attention Visualization.” CVPR 2021. https://openaccess.thecvf.com/content/CVPR2021/papers/Chefer_Transformer_Interpretability_Beyond_Attention_Visualization_CVPR_2021_paper.pdf

10. Vig, Jesse. “BertViz: Visualize Attention in NLP Models.” GitHub. https://github.com/jessevig/bertviz

11. European Commission. “DSA Transparency Database.” https://transparency.dsa.ec.europa.eu/

12. Holistic AI. “The EU's Digital Services Act: The Need for Independent Third-Party AI Audits.” https://www.holisticai.com/blog/eu-digital-services-act

13. EU Artificial Intelligence Act. “Article 11: Technical Documentation.” https://artificialintelligenceact.eu/article/11/

14. EU Artificial Intelligence Act. “Annex IV: Technical Documentation.” https://artificialintelligenceact.eu/annex/4/

15. Mitchell, Margaret et al. “Model Cards for Model Reporting.” 2019. Referenced in IAPP analysis: https://iapp.org/news/a/5-things-to-know-about-ai-model-cards

16. NVIDIA Developer Blog. “Enhancing AI Transparency and Ethical Considerations with Model Card++.” https://developer.nvidia.com/blog/enhancing-ai-transparency-and-ethical-considerations-with-model-card/

17. TechPolicy Press. “Oversight Board Trust Launches EU Out-of-Court Dispute Settlement Service.” October 2024. https://www.techpolicy.press/oversight-board-launches-eu-outofcourt-dispute-settlement-service/

18. TechPolicy Press. “What We Can Learn from the First Digital Services Act Out-of-Court Dispute Settlements?” https://www.techpolicy.press/what-we-can-learn-from-the-first-digital-services-act-outofcourt-dispute-settlements/

19. Checkstep. “Emerging Threats in AI Content Moderation: Deep Learning and Contextual Analysis.” https://www.checkstep.com/emerging-threats-in-ai-content-moderation-deep-learning-and-contextual-analysis

20. Microsoft Developer. “Enhancing Safety Moderation with AI: A Deep Dive.” October 2024. https://developer.microsoft.com/en-us/games/articles/2024/10/enhancing-safety-moderation-with-ai-deep-dive/

21. Reclaim the Net. “Meta's Nick Clegg Admits Excessive Censorship and High Error Rates in Content Moderation.” December 2024. https://reclaimthenet.org/metas-nick-clegg-admits-high-content-moderation-errors

22. YouTube Transparency Report. “Community Guidelines Enforcement.” https://transparencyreport.google.com/youtube-policy/appeals

23. Creator Handbook. “YouTube addresses AI moderation concerns after reporting 12 million channel terminations in 2025.” https://www.creatorhandbook.net/youtube-addresses-ai-moderation-concerns-after-reporting-12-million-channel-terminations-in-2025/

24. TechCrunch. “EC finds Meta and TikTok breached transparency rules under DSA.” October 2025. https://techcrunch.com/2025/10/24/ec-finds-meta-and-tiktok-breached-transparency-rules-under-dsa/

25. arXiv. “A Year of the DSA Transparency Database: What it (Does Not) Reveal About Platform Moderation During the 2024 European Parliament Election.” https://arxiv.org/html/2504.06976v1

26. Springer Link. “Content moderation by LLM: from accuracy to legitimacy.” Artificial Intelligence Review, 2025. https://link.springer.com/article/10.1007/s10462-025-11328-1

27. ACM Digital Library. “A Survey of Adversarial Defenses and Robustness in NLP.” ACM Computing Surveys, 2023. https://dl.acm.org/doi/10.1145/3593042

28. Deloitte UK. “EU Digital Services Act: Are you ready for audit?” https://www.deloitte.com/uk/en/services/audit/blogs/eu-digital-services-act-are-you-ready-for-audit.html

29. Jain, Sarthak and Byron C. Wallace. “Attention is not Explanation.” Proceedings of NAACL-HLT 2019. https://aclanthology.org/N19-1357/

30. Yang, Jilei. “Fast TreeSHAP: Accelerating SHAP Value Computation for Trees.” arXiv:2109.09847. https://arxiv.org/abs/2109.09847

31. Mordor Intelligence. “Content Moderation Market Size 2030 & Industry Statistics.” https://www.mordorintelligence.com/industry-reports/content-moderation-market

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Every morning, roughly 62 million Americans strap on a fitness tracker, open a wellness app, or tap through a mood journal before their first cup of coffee. They log sleep scores, heart rate variability, menstrual cycles, calorie counts, and anxiety levels with the casual ease of checking the weather. In the United Kingdom, 35 per cent of the population now owns and regularly uses a wearable health tracker, an 80 per cent increase from 2019 usage levels. The implicit bargain feels simple enough: hand over some personal data, receive personalised health insights in return. But that bargain contains a clause most users never read, and the consequences run far deeper than targeted adverts for protein powder.

The health information voluntarily uploaded to consumer wellness platforms occupies a regulatory void that would startle most people if they understood it. Unlike the records held by a hospital or a GP's surgery, this data sits almost entirely outside the protections of the Health Insurance Portability and Accountability Act, the 1996 law Americans have long assumed functions as a universal shield for medical information. It does not. And in that gap between assumption and legal reality, an entire industry has taken root, one that buys, aggregates, and resells the most intimate details of human biology to the highest bidder.

The question is no longer hypothetical. It is already happening.

The HIPAA Illusion

HIPAA was written for a world of paper charts and fax machines. It governs “covered entities,” a term of art that encompasses healthcare providers, health plans, and healthcare clearinghouses, along with the business associates who handle data on their behalf. When a hospital stores your blood test results, HIPAA applies. When your cardiologist emails your electrocardiogram to a specialist, HIPAA applies.

When you voluntarily upload that same electrocardiogram reading from your Apple Watch to a third-party wellness platform, HIPAA almost certainly does not apply.

The distinction matters enormously, yet most consumers do not grasp it. A survey reported by the HIPAA Journal found that a majority of Americans mistakenly believe that health app data is covered by HIPAA. The Department of Health and Human Services itself has published guidance clarifying the opposite: once health information is received from a covered entity at the individual's direction by an app that is neither a covered entity nor a business associate, the information is no longer subject to the protections of the HIPAA Rules.

That single sentence carries extraordinary implications. It means the covered entity bears no HIPAA responsibility or liability if the receiving app later experiences a breach, sells the data, or feeds it into an advertising algorithm. The data has, in regulatory terms, left the building.

Legal analysis from the law firm Dickinson Wright put it plainly: “It's important to keep in mind that HIPAA does not apply and was never intended to apply to general health and wellness applications.” While acknowledging that some of that information can be very sensitive and perhaps should be protected as a policy matter, the firm noted that “that's not HIPAA's job.”

There is also a grey zone around employer-sponsored wellness programmes. If a wellness programme is part of an employer's group health plan, such as a plan-sponsored biometric screening, HIPAA typically applies and participating vendors should operate under business associate agreements. But when a wellness programme is offered by the employer outside the health plan, think step challenges or third-party coaching apps paid as a workplace perk, HIPAA generally does not apply. The distinction often depends on contractual fine print that employees never see.

For the hundreds of millions of people now tracking everything from glucose levels to panic attacks on their phones, this is not an academic distinction. It is the difference between having legal recourse when your data is misused and having none at all.

A Nine-Billion-Dollar Appetite for Your Body

The market for health data has matured into an industry worth billions. According to Scientific American, a $9 billion sector called health care commercial intelligence purchases data from insurance companies and pharmacies, assembling it into searchable databases that pharmaceutical companies and other buyers subscribe to on an ongoing basis.

The scale of these operations is staggering. Companies like Definitive Healthcare maintain profiles on more than 2.6 million physicians, nurses, and other health care professionals, along with billions of insurance claims covering hundreds of millions of patients. These profiles are updated daily and include granular details such as prescription activity and a physician's propensity to prescribe brand-name over generic drugs.

But the data flowing from wellness apps opens an entirely new frontier. Unlike insurance claims, which at least originate within the HIPAA-regulated ecosystem, app-generated data arrives pre-stripped of regulatory protection. A user who tracks their anxiety symptoms through a mood-logging app, for instance, may find that information categorised and sold without their meaningful knowledge. The data collection methods are diverse: cookies and tracking pixels embedded in app interfaces, integration with social media platforms, purchase history from pharmacy loyalty programmes, and even public records including birth and death certificates all feed into broker profiles.

Research from Duke University's Sanford School of Public Policy laid bare the mechanics of this trade. In a study led by Joanne Kim, a Sanford Technology Policy Fellow, researchers contacted 37 data brokers and asked to purchase bulk mental health data. Eleven of those brokers agreed to sell information that identified individuals by specific conditions, including depression, anxiety, and bipolar disorder, often sorted by demographics such as age, race, credit score, and location. Some brokers charged as little as $275 for 5,000 aggregated records. Others offered annual subscriptions ranging from $75,000 to $100,000 for ongoing access. The transactions required little to no screening of potential buyers and imposed few restrictions on how the purchased data could be used.

Justin Sherman, Senior Fellow and Research Lead of Sanford's Data Brokerage Project, testified before the House Committee on Energy and Commerce at a hearing titled “Who is Selling Your Data?” that was directly prompted by the Duke research. Representative Morgan Griffith of Virginia, who chaired the hearing, cited the Sanford research as a driving force behind the proceedings. Sherman warned that data brokers claiming people consented to the collection and sale of their mental health data “are twisting the term so much it becomes meaningless.” He added that the findings “raise all kinds of questions about privacy, potential algorithmic discrimination, and the risk of companies taking advantage of consumers in vulnerable positions.”

The implications extend beyond marketing. Health insurance companies purchase data from brokers to inform their underwriting algorithms. As compliancy research has documented, data broker profiles categorise individuals into segments based on health characteristics such as “likelihood of having anxiety,” “diabetes,” “bladder control issues,” and “high blood pressure.” A data broker might share such information with an insurer or retailer, potentially increasing a person's rate or shaping the products they are offered. A 2025 IBM report found that the average security breach in the healthcare industry totalled over $7.4 million, and 97 per cent of organisations with AI-related security incidents lacked proper AI access controls, underscoring the vulnerability of these data pipelines.

When the Firewall Fails Entirely

Even data that should be protected sometimes is not. In April 2025, Blue Shield of California disclosed that Google Analytics had been misconfigured in a way that shared the protected health information of approximately 4.7 million members with Google Ads for nearly three years, from April 2021 to January 2024. The exposed data included patient names, insurance plan details, city, postcode, gender, family size, medical claim service dates, and service providers.

Blue Shield has 4.8 million members total, meaning the breach affected virtually its entire membership. Security researchers called it the largest healthcare data breach of 2025. The duration of the exposure, nearly three years before it was identified, pointed to systemic failures in data flow visibility, audit logging, and vendor oversight. The root cause was a tracking pixel, a standard tool in e-commerce marketing that proved dangerously misapplied in a regulated healthcare environment. Many healthcare organisations unknowingly introduce similar risks through website trackers, pixel tags, and marketing scripts that silently funnel patient data to advertising platforms.

The Blue Shield incident involved a traditional covered entity, one that should have been governed by HIPAA. It illustrated how even the regulatory protections that do exist can fail catastrophically when marketing technology intersects with healthcare infrastructure. For wellness apps that sit outside HIPAA entirely, the safeguards are often thinner still, and the oversight mechanisms are weaker.

The FTC Steps In, Partially

Recognising the regulatory vacuum, the Federal Trade Commission has expanded its enforcement toolkit. The agency's amended Health Breach Notification Rule, which took effect on 29 July 2024, extends breach notification requirements to apps and platforms not covered by HIPAA. Violations are treated as unfair or deceptive acts under Section 18 of the FTC Act, carrying civil penalties of up to $51,744 per violation. The updated rule specifically encompasses fitness, fertility, and mental health apps, closing at least some of the notification gap that previously left consumers in the dark about breaches involving their wellness data.

The FTC has already demonstrated willingness to act. In February 2023, GoodRx agreed to pay a $1.5 million civil penalty, the first enforcement action under the Health Breach Notification Rule, after the FTC alleged it had failed to notify customers and regulators of unauthorised disclosures of consumer health information.

In 2023, online therapy company BetterHelp was fined $7.8 million over allegations that it shared consumers' health data with companies including Facebook and Snapchat for advertising purposes. Easy Healthcare, the parent company of ovulation and period tracking app Premom, settled for $100,000 over similar concerns.

In April 2024, the FTC announced a $7.1 million penalty against Cerebral, a telehealth company that had provided sensitive information on nearly 3.2 million consumers to third parties such as LinkedIn, Snapchat, and TikTok through tracking tools embedded in its website and apps. The data shared included users' names, addresses, phone numbers, medical histories, and prescription information. The order permanently banned Cerebral from using or disclosing consumers' personal and health information to third parties for most marketing or advertising purposes.

The FTC has also moved against data brokers dealing in location data tied to health services. In 2024, the commission announced significant settlements with four data brokers, including X-Mode, InMarket Media, Mobilewalla, and Gravy Analytics, resolving allegations of unlawful collection and sale of precise location information. The FTC challenged the practice of categorising consumers based on sensitive characteristics derived from location data, such as medical conditions and religious beliefs, calling it “far outside the expectations and experience of consumers.”

These actions represent meaningful enforcement, but they remain reactive. The FTC can penalise companies after breaches occur. It cannot prevent wellness apps from collecting and monetising health data in the first place, provided the apps disclose their practices somewhere within their terms of service.

The Genetic Blind Spot

The intersection of wellness app data and genetic information creates a particularly dangerous blind spot. The Genetic Information Nondiscrimination Act of 2008, known as GINA, was designed to prevent discrimination based on genetic information. Its protections, however, are narrower than most people realise.

GINA's Title I prohibits group and individual health insurers from using genetic information to determine eligibility or premiums. It also prohibits health insurers from requesting or requiring that a person undergo a genetic test. Its Title II prevents employers from using genetic information in hiring, firing, or job assignment decisions. These protections are significant but incomplete.

GINA does not apply to life insurance, long-term care insurance, or disability insurance. Insurers in these markets are legally permitted to use genetic, personal, or family health information to make coverage or premium decisions. They can rate premiums higher or refuse to offer coverage entirely based on genetic test results. The law also does not apply to employers with fewer than 15 employees or to individuals insured through military programmes such as Tricare.

The American Medical Association has documented these gaps, noting that GINA's exclusions may cause reluctance among individuals to pursue genetic testing. The American Society of Human Genetics has similarly advocated for expanding GINA's protections to cover the insurance types currently excluded.

Research published in the European Journal of Human Genetics argued that because long-term care and disability insurance can be essential for wellbeing, there is no good reason to place them beyond GINA's reach. The authors noted that the ethical and economic implications of these exclusions grow more significant as genetic testing becomes cheaper, more accessible, and more predictive.

Now consider what happens when genetic information enters the wellness app ecosystem. Services like 23andMe and AncestryDNA have made direct-to-consumer genetic testing mainstream. Some wellness platforms integrate genetic data with fitness and health tracking to deliver personalised recommendations. But if that genetic data is held by a consumer app rather than a HIPAA-covered entity, it may lack even GINA's partial protections, and it certainly lacks protection from life, disability, and long-term care insurers who may eventually access it through data broker channels. Fewer than half of US states have laws providing additional protections against genetic discrimination beyond what GINA offers, leaving the majority of Americans reliant on federal protections that were designed before the wellness app era.

Your Steps, Your Identity

Even data that appears harmless can become a liability. Research highlighted by MobiHealthNews demonstrated that just six days of step counts are sufficient to uniquely identify an individual among 100 million other people. Fitness data, like DNA, forms a sequence. As the length of the sequence grows, the probability of someone else having exactly the same pattern for the same dates decreases exponentially.

The re-identification risk is not theoretical. Researchers described a concrete attack scenario: a person with a heart condition participates in a study that collects physical activity data through a wearable device. The same person uses a social network to share workout outcomes. After the study data is anonymised and made publicly available, a malicious actor retrieves both datasets and matches them on the physical activity time series, re-identifying the participant and linking their social network identity to their medical condition.

Platforms such as Garmin Connect and Fitbit have historically made certain user data, including daily step counts, publicly visible by default. Fitbit's own Research Pledge acknowledges the risk, requiring researchers who share datasets to mitigate re-identification and consider whether research datasets could be linked to publicly visible information. The NIH's All of Us Research Programme has implemented safeguards for Fitbit data used in research, including date-shifting timestamps by random numbers to reduce identification risks, but these protections apply only within the research context and not to commercially held data.

The consequence is stark. De-identification, the process that health data advocates have long relied upon as a privacy safeguard, is becoming increasingly unreliable. Modern artificial intelligence algorithms make re-identification substantially more feasible, and the proliferation of linked datasets means that a single data point from a wellness app can serve as the key that unlocks an entire medical profile. Genetic data, researchers have noted, is essentially impossible to completely de-identify, meaning that any database containing genetic markers carries an inherent and permanent privacy risk.

The sensitivity of fitness data also extends beyond step counts. Wearable devices now monitor heart function, respiratory patterns, sleep architecture, and blood oxygen levels. Researchers have argued that this data will soon encompass cognitive markers as well. Each additional data stream increases the precision with which an individual can be identified and the richness of the health profile that can be assembled without their knowledge.

The Insurance Pipeline

Life insurers are already building the infrastructure to use wearable data at scale. In August 2025, WTW and Klarity announced a collaboration to help life insurers improve pricing accuracy by integrating wearable technology data into their underwriting processes. The partnership draws on 12 years of health data spanning more than six million life years, producing individual-level mortality scores that incorporate data from smartwatches and other wearable devices tracking physical activity, heart rate, and sleep patterns.

According to GlobalData's 2024 Emerging Trends Insurance Consumer Survey, over half of US consumers, 54.5 per cent, said they would be quite or very likely to wear an activity tracker and share results with a life insurer in return for a more tailored policy. The prospect of financial savings was the primary incentive for 56.6 per cent of respondents.

Munich Re's research has found that steps per day stratify mortality risk even after controlling for age, gender, smoking status, and various health indicators, providing segmentation beyond traditional underwriting attributes such as BMI, cholesterol, and blood pressure. Traditional mortality risk measures, the reinsurer noted, often misclassify applicants because they fail to capture individualised measures such as resting heart rate, heart recovery rate, sleep quality, and the ratio of activity to inactivity. Wearable data fills those gaps. Programmes like John Hancock's Vitality already offer policyholders premium discounts of up to 15 per cent for meeting fitness goals such as walking 15,000 steps per day.

The rewards side of this equation receives the marketing emphasis. The risk side receives rather less attention. If a person is sedentary, if their sleep data reveals chronic insomnia, if their heart rate variability suggests unmanaged stress, a wearable device will record it. Insurance industry analysis has noted plainly that such individuals “may pay more or even be denied coverage.”

There is also an equity dimension. The EEOC released guidance in January 2025 on wearable technologies in the workplace, noting that inaccuracies in wearable devices disproportionately affect certain groups. Biometric devices that fail to calibrate for darker skin tones or larger body sizes may produce skewed results, leading to discriminatory outcomes. The EEOC further warned that using heart rate data to infer pregnancy and then making adverse employment decisions based on that information could violate equal employment opportunity laws.

These concerns apply with equal force to insurance underwriting. If wearable data that is inaccurate for certain demographics feeds into actuarial models, the result is not personalisation but discrimination laundered through an algorithm. The individuals most likely to be disadvantaged are those who already face barriers in the insurance market: older adults, people with disabilities, and members of racial and ethnic minority groups.

The Family Problem

The question in this article's title asks whether your health data could one day be used to deny coverage to your family members. The legal architecture already permits it in certain contexts.

GINA's protections in health insurance extend to genetic information about an individual and their family members. But GINA does not cover life, long-term care, or disability insurance. In those markets, family health history, including genetic information, can legally inform underwriting decisions. If a life insurer gains access to your genetic test results, whether directly or through a data broker chain that originates with a wellness app, that information could theoretically affect not only your premiums but the risk assessments applied to your blood relatives.

The data broker ecosystem compounds this risk. When mental health data, genetic information, and biometric data are aggregated, linked, and sold, the dossier assembled on one family member can reveal information about others. A genetic predisposition identified in one sibling's wellness app profile implies a statistical probability for the other. A family history of cardiac disease logged in one person's health tracker creates inferences about their children. Data brokers already categorise individuals by family size and household composition, as the Blue Shield breach demonstrated, making it straightforward to link related individuals within their databases.

This is not a speculative future scenario. The infrastructure for such assessments already exists. The only barriers are regulatory, and as this article has documented, those barriers are full of gaps.

Legislative Attempts to Close the Gap

The patchwork of protections is slowly being addressed. On 4 November 2025, Senator Bill Cassidy of Louisiana, chair of the Senate Health, Education, Labor, and Pensions Committee, introduced the Health Information Privacy Reform Act, known as HIPRA. The bill seeks to extend protections similar to HIPAA to health information collected by entities not currently regulated by that law, including fitness apps, wearable device manufacturers, and wellness platforms.

HIPRA defines “applicable health information” broadly as any identifiable or reasonably identifiable data about an individual's health or healthcare, regardless of whether it was created by a healthcare provider, health plan, or clearinghouse. This definition would bring wellness app data squarely within the regulatory framework for the first time.

HIPRA would require regulated entities to implement physical, technical, and administrative safeguards for health information. It would establish breach notification requirements mirroring the HIPAA model. Crucially, it would grant consumers a right to deletion of their health data, something HIPAA itself does not provide. It would also require wellness apps and wearable device companies to notify consumers explicitly that their data is not protected by HIPAA and provide an opt-out mechanism for data generation.

The bill directs HHS, in consultation with the FTC, to publish guidance on applying the “minimum necessary” standard to artificial intelligence and machine learning technologies and to create national de-identification standards. It further calls for the National Academies of Sciences, Engineering, and Medicine to study the feasibility of compensating consumers for sharing their identified health data.

HIPRA remains early in the legislative process, filed as S.3097 in the 119th Congress. Its passage is far from guaranteed. The bill's federal standards would override any conflicting state laws that offer weaker protections, though states would remain free to adopt stricter rules.

At the state level, progress has been more tangible. Washington's My Health My Data Act, which came into force on 31 March 2024, became the first privacy-focused law in the United States explicitly designed to protect personal health data falling outside HIPAA. The law was introduced as part of a legislative response to the Supreme Court's 2022 decision in Dobbs v. Jackson Women's Health Organization, with the primary sponsor, Representative Vandana Slatter, describing it as part of a comprehensive package aimed at protecting health privacy, especially for reproductive healthcare.

The Act defines consumer health data broadly, covering past, present, or future physical or mental health status, prescribed medications, gender-affirming care information, reproductive health data, and even precise location information that could indicate a consumer's attempt to receive health services. It requires affirmative, opt-in consent for any collection of consumer health data and grants consumers sweeping deletion rights that go beyond what any other privacy law provides.

Unlike most state privacy laws, Washington's MHMDA includes a private right of action, allowing consumers to sue directly for violations. Courts may award up to three times actual damages, not exceeding $25,000. Nevada enacted a similar law effective the same date, though without the private right of action. Connecticut amended its Consumer Data Privacy Act to include consumer health data within its definition of sensitive data.

These state efforts are meaningful but create their own problems. A patchwork of differing state standards places compliance burdens on companies while leaving residents of states without such laws entirely unprotected. The uneven coverage means that a consumer in Washington enjoys significantly more protection than one in Texas or Florida, creating a geography of privacy that maps poorly onto a digital ecosystem where data flows freely across state lines.

The Ownership Question

At the centre of this entire debate sits a deceptively simple question: who owns your health data?

The answer, under current US law, is surprisingly unclear. HIPAA grants patients rights of access to their medical records but does not establish ownership per se. When data leaves the HIPAA ecosystem and enters the wellness app world, even those access rights evaporate unless state law intervenes.

Most wellness apps address data ownership in their terms of service, and most of those terms grant the company broad licences to use, aggregate, and share the data. Users technically consent to these arrangements when they tap “I agree” on a screen of dense legal text, but meaningful informed consent is a fiction in this context. As Justin Sherman of Duke University observed, the consent framework that underpins the entire data brokerage industry has been twisted beyond recognition.

The commercial implementation of healthcare AI further complicates ownership. As research published in BMC Medical Ethics has noted, AI systems require patient health information to be placed under the control of for-profit corporations. The structure of this public-private interface means that these corporations have an increased role in obtaining, utilising, and protecting patient health information, even as the patients who generated that information exercise diminishing control over it.

OpenAI's launch of ChatGPT Health, which encourages users to connect medical records and wellness app data to the platform, exemplifies this trend. The feature allows users to link services such as Apple Health, Function, and MyFitnessPal so that ChatGPT can help interpret test results and health data. OpenAI has stated that the feature includes purpose-built encryption, isolation, and additional layered protections. But experts at the Center for Democracy and Technology have warned that while these LLM health tools offer the promise of empowering patients, health data remains some of the most sensitive information people can share and requires correspondingly rigorous protection.

The fundamental tension is structural. Users want the benefits of AI-powered health insights. Companies want the data that makes those insights possible. And the legal framework that should mediate between these interests was designed for an era when health records were paper files locked in a cabinet.

The Unresolved Reckoning

The trajectory is clear even if the timeline is not. Wearable adoption is projected to grow from 62 million US users in 2024 to over 92 million by 2029. AI-powered health platforms are proliferating. Data broker networks are expanding. Insurance companies are investing heavily in wearable-driven underwriting models. And the regulatory framework remains, for most Americans, a patchwork of partial protections riddled with exceptions.

The people who stand to lose the most from this arrangement are those who are already vulnerable: individuals with pre-existing conditions, people managing mental health challenges, members of demographic groups for whom wearable devices produce less accurate readings, and families whose genetic information enters the commercial data ecosystem without their full understanding of the consequences.

There is nothing inherently wrong with using technology to improve health outcomes. Fitness trackers save lives. AI diagnostic tools catch diseases earlier. Personalised wellness recommendations help people make better choices. But the infrastructure that delivers these benefits is the same infrastructure that enables surveillance, discrimination, and the quiet erosion of medical privacy.

The question is not whether to use these tools. It is whether the legal and regulatory systems will evolve quickly enough to ensure that the most intimate details of human biology remain under the control of the humans who generate them, rather than the corporations that collect, aggregate, and sell them.

Right now, the answer to that question is no.

---

References and Sources

1. U.S. Department of Health and Human Services. “The Access Right, Health Apps, and APIs.” HHS.gov. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access-right-health-apps-apis/index.html

2. Dickinson Wright. “App Users Beware: Most Healthcare, Fitness Tracker, and Wellness Apps Are Not Covered by HIPAA.” Dickinson Wright Insights. https://www.dickinson-wright.com/news-alerts/app-users-beware

3. HIPAA Journal. “Majority of Americans Mistakenly Believe Health App Data is Covered by HIPAA.” https://www.hipaajournal.com/americans-mistakenly-believe-health-app-hipaa/

4. Kim, Joanne. “Data Brokers and the Sale of Americans' Mental Health Data.” Duke University Sanford School of Public Policy, Tech Policy Program, 2023. https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-americans-mental-health-data/

5. Scientific American. “How Data Brokers Make Money Off Your Medical Records.” https://www.scientificamerican.com/article/how-data-brokers-make-money-off-your-medical-records/

6. Compliancy Group. “Health Data Brokers: Data Collection Methods and Practices.” https://compliancy-group.com/health-data-brokers-sell-lists-of-depression-anxiety-sufferers/

7. Blue Shield of California / HIPAA Journal. “Blue Shield of California Announces Impermissible Disclosure of PHI to Google Ads: 4.7 Million Affected.” April 2025. https://www.hipaajournal.com/blue-shield-of-california-google-ads-data-breach/

8. Federal Trade Commission. “Updated FTC Health Breach Notification Rule Puts New Provisions in Place to Protect Users of Health Apps and Devices.” April 2024. https://www.ftc.gov/business-guidance/blog/2024/04/updated-ftc-health-breach-notification-rule-puts-new-provisions-place-protect-users-health-apps

9. Federal Trade Commission. “Proposed FTC Order Will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes.” April 2024. https://www.ftc.gov/news-events/news/press-releases/2024/04/proposed-ftc-order-will-prohibit-telehealth-firm-cerebral-using-or-disclosing-sensitive-data

10. Genetic Information Nondiscrimination Act (GINA) Overview. National Human Genome Research Institute. https://www.genome.gov/about-genomics/policy-issues/Genetic-Discrimination

11. American Medical Association. “Genetic Discrimination.” https://www.ama-assn.org/public-health/population-health/genetic-discrimination

12. PMC / European Journal of Human Genetics. “Beyond the Genetic Information Nondiscrimination Act: Ethical and Economic Implications of the Exclusion of Disability, Long-Term Care and Life Insurance.” https://pmc.ncbi.nlm.nih.gov/articles/PMC6354179/

13. MobiHealthNews. “When Fitness Data Becomes Research Data, Your Privacy May Be at Risk.” https://www.mobihealthnews.com/news/contributed-when-fitness-data-becomes-research-data-your-privacy-may-be-risk

14. WTW. “WTW and Klarity Collaborate to Boost Insurance Underwriting Accuracy by Harnessing Wearable Health Technology.” August 2025. https://www.wtwco.com/en-us/news/2025/08/wtw-and-klarity-collaborate-to-boost-insurance-underwriting-accuracy-by-harnessing-wearable-health

15. GlobalData. “2024 Emerging Trends Insurance Consumer Survey.” Referenced via Life Insurance International. https://www.lifeinsuranceinternational.com/analyst-comment/over-half-of-us-consumers-share-wearable-data-tailored-life-insurance/

16. Munich Re. “The Future Is Now: Wearables for Insurance Risk Assessment.” https://www.munichre.com/us-life/en/insights/future-of-risk/wearables-the-future-is-now-wearables-for-insurance-risk-asses.html

17. U.S. Equal Employment Opportunity Commission. “Wearables in the Workplace.” January 2025. https://www.disabilityleavelaw.com/2025/01/articles/eeoc-guidance/eeoc-issues-new-guidance-on-wearable-technologies-key-points-for-employers/

18. U.S. Senate Committee on Health, Education, Labor and Pensions. “Chair Cassidy Introduces Bill to Protect Americans' Private Health Data.” November 2025. https://www.help.senate.gov/rep/newsroom/press/chair-cassidy-introduces-bill-to-protect-americans-private-health-data

19. Congress.gov. “S.3097 – Health Information Privacy Reform Act.” 119th Congress (2025-2026). https://www.congress.gov/bill/119th-congress/senate-bill/3097/all-actions

20. Washington State Legislature. “Chapter 19.373 RCW: Washington My Health My Data Act.” https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true

21. Center for Democracy and Technology. “AI Health Tools Pose Risks for User Privacy.” https://cdt.org/insights/ai-health-tools-pose-risks-for-user-privacy/

22. OpenAI. “Introducing ChatGPT Health.” https://openai.com/index/introducing-chatgpt-health/

23. BMC Medical Ethics. “Privacy and Artificial Intelligence: Challenges for Protecting Health Information in a New Era.” https://link.springer.com/article/10.1186/s12910-021-00687-3

24. Beinsure. “Wearable Technology in Insurance Use Cases.” https://beinsure.com/wearable-technology-smart-watches-fitness-devices-changing-insurance/

25. Cyberscoop. “Your AI Doctor Doesn't Have to Follow the Same Privacy Rules as Your Real One.” https://cyberscoop.com/ai-healthcare-apps-hipaa-privacy-risks-openai-anthropic/

26. IBM. “Cost of a Data Breach Report 2025.” Referenced via Wolters Kluwer. https://www.wolterskluwer.com/en/expert-insights/health-system-size-impacts-ai-privacy-and-security-concerns

27. FTC Privacy and Security Enforcement. “Privacy Law Recap 2024: Regulatory Enforcement.” Referenced via Perkins Coie. https://perkinscoie.com/insights/update/privacy-law-recap-2024-regulatory-enforcement

28. Goodwin Law. “Washington's My Health My Data Act Comes Into Force.” March 2024. https://www.goodwinlaw.com/en/insights/publications/2024/03/alerts-technology-hltc-my-health-my-data-act-mhmda

29. Wilson Sonsini. “Senator Cassidy Introduces Sweeping Health Privacy Bill.” November 2025. https://www.wsgr.com/en/insights/senator-cassidy-introduces-sweeping-health-privacy-bill.html

30. FACING OUR RISK (FORCE). “GINA Overview.” https://www.facingourrisk.org/privacy-policy-legal/laws-protections/privacy-nondiscrimination/GINA/overview

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

The problem with your mitral valve is that it looks, on paper, a lot like somebody else's mitral valve. Both of you have severe regurgitation. Both of you have echocardiograms filled with numbers that cross the same clinical thresholds. Both of you sit in the same risk category according to guidelines published by the American College of Cardiology and the European Society of Cardiology. And yet one of you will thrive after surgery, while the other might have been better off waiting. The guidelines cannot tell you which is which. That is not a minor oversight. It is, increasingly, the central unsolved problem in the management of primary mitral regurgitation.

Mitral regurgitation is the most common valvular heart abnormality in the world, affecting more than two per cent of the global population. Degenerative mitral valve disease alone accounts for an estimated 24 million people worldwide, according to a 2021 review in Nature Reviews Cardiology. A 2024 analysis using Global Burden of Disease data, published in the Journal of the American Heart Association, reported an estimated 13.3 million cases of non-rheumatic valvular disease globally in 2021, with the absolute burden continuing to rise as populations age. The condition occurs when the mitral valve, that crucial flap of tissue separating the left atrium from the left ventricle, fails to close properly, allowing blood to leak backwards with every heartbeat. In primary mitral regurgitation, the valve itself is the culprit, typically due to myxomatous degeneration or prolapse. Left untreated, severe cases can lead to heart failure, atrial fibrillation, and death.

The standard clinical approach relies on a set of echocardiographic measurements and symptomatic triggers. Operate when the left ventricular ejection fraction drops below 60 per cent. Operate when the left ventricular end-systolic dimension exceeds 40 millimetres. Operate when symptoms appear. These thresholds have guided cardiac surgeons and cardiologists for decades, and they are not wrong, exactly. They are simply insufficient. Roughly 20 per cent of patients who undergo mitral valve surgery with a pre-operative ejection fraction above 60 per cent still develop post-operative left ventricular dysfunction. The numbers that were supposed to guarantee a good outcome did not deliver.

Now a series of studies is suggesting that artificial intelligence, applied to the same echocardiographic data that clinicians already collect, can identify hidden patient subpopulations whose surgical trajectories diverge in ways that traditional risk stratification completely misses. The implications are striking, not because AI is replacing the cardiologist, but because it is revealing that the disease we call primary mitral regurgitation is actually several diseases masquerading as one.

When Twenty-Four Numbers Tell a Story That Guidelines Cannot

The study that brought this idea into sharp focus was published in JACC: Cardiovascular Imaging in 2023 by Julien Bernard, Naveena Yanamala, and colleagues. The work was supported by the National Science Foundation, the National Institute of General Medical Sciences at the National Institutes of Health, and the Canadian Institutes of Health Research. Their approach was deceptively simple in concept, though computationally sophisticated in execution. They took 24 standard echocardiographic parameters from 400 patients with primary mitral regurgitation across two cohorts, one from France with 243 patients followed for a median of 3.2 years, and one from Canada with 157 patients followed for a median of 6.8 years. These were not exotic measurements requiring specialised equipment. They were the routine numbers that any competent echocardiography laboratory produces during a standard examination: chamber volumes, valve gradients, Doppler velocities, wall thicknesses, strain measurements.

The team then applied unsupervised machine learning, specifically hierarchical clustering, to let the data organise itself into groups without any preconceived notions about what those groups should look like. No clinician told the algorithm what “severe” means. No guideline threshold was imposed. The algorithm simply looked at all 24 measurements simultaneously, something no human clinician can do with equal rigour, and sorted patients into phenogroups based on the mathematical relationships between those parameters.

What emerged were two distinct phenogroups: a high-severity cluster and a low-severity cluster. The French development cohort split into 117 high-severity and 126 low-severity patients; the Canadian validation cohort divided into 87 and 70, respectively. So far, that might sound unremarkable. But the remarkable part came when the researchers examined what happened to patients in each group who did and did not undergo mitral valve surgery.

In the high-severity phenogroup, surgical patients had significantly improved event-free survival compared to non-surgical patients, in both the French cohort (P = 0.047) and the Canadian validation cohort (P = 0.020). Surgery clearly helped these patients. The model suggested that assignment to the high-severity phenogroup predicted a reduction in risk of all-cause mortality following mitral valve surgery.

In the low-severity phenogroup, however, there was no statistically significant difference between surgical and non-surgical patients in either cohort (P = 0.70 and P = 0.50, respectively). The algorithm had identified a population in whom surgery conferred no measurable survival benefit, a finding invisible to conventional risk stratification.

The critical insight is this: many of the patients in the low-severity phenogroup would have been classified as having severe or moderate-to-severe mitral regurgitation by traditional guideline criteria. They crossed the same thresholds. They appeared, by every conventional measure, to need surgery. But the machine learning model, by integrating all 24 parameters simultaneously rather than applying sequential threshold cutoffs, recognised a pattern that human interpretation had missed. These patients shared a combination of chamber dimensions, flow characteristics, and myocardial properties that, taken together, indicated a fundamentally different disease trajectory from their guideline-matched counterparts in the high-severity group.

The Black Box Opens Up

One of the persistent criticisms of machine learning in medicine is the black box problem. If an algorithm says a patient belongs to one group rather than another, but nobody can explain why, clinicians have every right to be sceptical. The stakes in cardiac surgery are too high for blind trust in opaque computational processes. Bernard and colleagues anticipated this concern by employing SHapley Additive exPlanations, or SHAP, an explainable AI technique rooted in cooperative game theory that quantifies the contribution of each individual feature to a given prediction.

SHAP values, derived from a framework originally developed to fairly distribute payouts in cooperative games, assign each input variable a numerical importance score for each individual prediction. This means a clinician can interrogate not just which variables matter in general, but which variables mattered for this specific patient. The technique has become one of the most widely adopted explainability methods in clinical AI, precisely because it bridges the gap between computational complexity and human interpretability.

The SHAP analysis revealed that left ventricular end-diastolic volume, the Doppler E/e-prime ratio (a marker of diastolic filling pressure), mitral regurgitation regurgitant volume, and interventricular septal thickness were the most important parameters driving the phenogroup classification. These are not obscure research variables. They are measurements that echocardiographers record routinely. The difference is that the algorithm weighted and combined them in ways that current guidelines do not. Where guidelines apply binary thresholds to individual parameters, the machine learning model captured continuous, nonlinear interactions between all 24 variables simultaneously, recognising patterns of co-occurrence that sequential threshold-checking inherently misses.

This matters enormously for clinical adoption. A cardiologist looking at a SHAP plot can see exactly which measurements pushed a particular patient into the high-severity or low-severity phenogroup, and by how much. The model is not asking clinicians to trust a mysterious oracle. It is showing them, in quantitative terms, what the data actually say when all the measurements are considered together rather than in isolation. A 2024 review of explainable AI evaluation approaches in cardiology, published in BMC Medical Informatics, noted that SHAP remains the most frequently applied interpretability technique in cardiovascular AI research, though it cautioned that only a minority of studies have involved cardiologists in evaluating the clinical relevance of the explanations produced.

The Bernard study also demonstrated incremental prognostic value over conventional approaches. When the researchers looked specifically at patients who were classified as having severe or moderate-to-severe mitral regurgitation by traditional methods, the phenogrouping approach improved the categorical net reclassification index significantly (P = 0.002). In practical terms, this means the algorithm correctly reclassified patients whose outcomes had been mischaracterised by guideline-based stratification.

Why Ejection Fraction Lies

To understand why machine learning phenogrouping works where guidelines falter, it helps to understand exactly why left ventricular ejection fraction, the cornerstone of current surgical decision-making, is such a flawed metric in the context of mitral regurgitation.

Ejection fraction measures the percentage of blood ejected from the left ventricle with each heartbeat. In a healthy heart, that number typically sits above 55 per cent. Both the ACC/AHA and the ESC/EACTS guidelines recommend surgery when it drops below 60 per cent, reasoning that declining pump function signals irreversible myocardial damage. The problem is that ejection fraction, in a leaking valve, is a fundamentally misleading measurement.

In mitral regurgitation, the left ventricle ejects blood through two outlets simultaneously: forward into the aorta, where it belongs, and backwards through the leaking valve into the left atrium, where it does not. The ejection fraction calculation captures both directions of flow without distinguishing between them. A patient can have a seemingly normal or even elevated ejection fraction while their actual forward output, the blood reaching the rest of their body, is dangerously low. The metric is flattering a failing heart. As a 2024 review in Clinical Cardiology by Neveu and colleagues observed, clinical guidelines remain anchored to ejection fraction despite its well-recognised limitations, including its lack of a consistent pathophysiological basis and its dependency on haemodynamic loading conditions.

This is not a new observation. Research published in the Journal of the American Heart Association by Gaasch and Meyer has shown that forward left ventricular ejection fraction, a calculation that accounts only for antegrade flow, is superior to total ejection fraction in predicting outcomes in primary mitral regurgitation. Patients with a forward ejection fraction below 50 per cent face significantly higher risk of adverse events. A pre-operative forward ejection fraction below 40 per cent was associated with increased risk of post-surgical left ventricular systolic dysfunction. Some researchers have argued that the occurrence of post-operative left ventricular dysfunction was 9 per cent when ejection fraction was 64 per cent or above and left ventricular end-systolic dimension was below 37 millimetres, but jumped to 33 per cent when ejection fraction fell below 64 per cent and end-systolic dimension exceeded 37 millimetres. These data suggest that the current guideline threshold of 60 per cent may itself be set too low.

Similarly, a 2024 study in Frontiers in Cardiovascular Medicine demonstrated that among asymptomatic patients with primary mitral regurgitation and preserved ejection fraction above 60 per cent, machine learning models using ejection fraction, mid-left ventricular circumferential strain rate, left ventricular end-systolic dimension, and left ventricular sphericity predicted that 30 per cent of those patients would develop ejection fraction below 50 per cent after surgery. Nearly a third. These patients looked fine by guideline criteria. They were not fine. The subclinical dysfunction was there, but the conventional measurements were not sensitive enough to detect it.

The machine learning phenogrouping approach sidesteps this problem not by replacing ejection fraction with a better single metric, but by refusing to rely on any single metric at all. By integrating dozens of parameters simultaneously, it captures the complex, nonlinear interactions between chamber volumes, filling pressures, valve haemodynamics, and myocardial function that no individual measurement can represent.

Five Faces of a Single Disease

The Bernard study identified two phenogroups, but the broader body of evidence suggests that primary mitral regurgitation fractures into even more distinct subpopulations when examined through a machine learning lens.

A 2023 study published in Heart by Sungho Kwak and colleagues at three tertiary hospitals in South Korea used latent class analysis on 2,321 patients with severe primary mitral regurgitation who underwent valve surgery, with a separate validation cohort of 692 patients. The analysis incorporated 15 variables spanning demographics, laboratory values, surgical factors, and echocardiographic measurements. Five distinct phenogroups emerged, each with dramatically different long-term outcomes over a median follow-up of 6.0 years, during which 149 patients (9.1 per cent) in the derivation cohort died.

Group 1 consisted of younger patients with the fewest comorbidities, and their five-year survival after surgery was 98.5 per cent. Group 2 comprised predominantly men with left ventricular enlargement, surviving at 96.0 per cent. Group 3, mostly women with rheumatic mitral regurgitation, had a five-year survival of 91.7 per cent. Group 4 were low-risk older patients at 95.6 per cent. And Group 5, high-risk older patients, survived at just 83.4 per cent (P less than 0.001 across all groups). In univariable Cox analysis, age, female sex, atrial fibrillation, left ventricular end-systolic dimensions and volumes, ejection fraction, left atrial dimension, and tricuspid regurgitation peak velocity were all significant predictors of mortality following surgery.

The phenogroups performed comparably to the Mitral Regurgitation International Database score, a validated risk prediction tool, achieving a three-year concordance index of 0.763 versus 0.750 (P = 0.602). But crucially, the phenogroups identified these risk strata through an entirely data-driven process, without relying on the predetermined assumptions baked into existing scoring systems. Patients in Group 3, for example, comprised a subpopulation whose specific risk profile, predominantly female with rheumatic aetiology, might be inadequately weighted by conventional tools designed primarily around degenerative valve disease in Western populations. The findings were reproduced in the validation cohort, lending credibility to the phenogroup structure.

Fibrosis, Strain, and the Hidden Damage

Perhaps the most clinically provocative work in this space comes from Olivier Huttin and colleagues, whose 2023 study in JACC: Cardiovascular Imaging used machine learning phenogrouping in 429 patients with mitral valve prolapse (mean age 54 plus or minus 15 years) to identify profiles associated with myocardial fibrosis and cardiovascular events. Mitral regurgitation was severe in 195 patients, or 45 per cent of the cohort.

Their unsupervised clustering analysis identified four distinct groups. Cluster 1 showed minimal cardiac remodelling with mainly mild regurgitation. Cluster 2 was a transitional group with moderate regurgitation and left atrial enlargement. Clusters 3 and 4 both featured significant left ventricular and left atrial remodelling with severe regurgitation, but they diverged in a critical way: Cluster 4 showed a drop in left ventricular systolic strain, a marker of impaired myocardial contractility, while Cluster 3 did not.

When the researchers correlated these clusters with cardiac magnetic resonance imaging data, Clusters 3 and 4 showed significantly more myocardial fibrosis than Clusters 1 and 2 (P less than 0.0001). Patients in these higher-risk clusters also experienced higher rates of cardiovascular events. The fibrosis finding is particularly important because myocardial fibrosis is largely irreversible. A patient who has already developed significant fibrosis may still benefit from valve repair, but the window for achieving optimal outcomes is narrower. Traditional echocardiographic parameters cannot reliably detect fibrosis, yet the machine learning phenogroups, derived entirely from echocardiographic data, identified patients whose myocardial tissue was silently scarring.

This is where the mechanism underlying improved event-free survival becomes clearer. The phenogrouping algorithm does not merely predict who is at higher risk. It identifies a specific physiological pattern, combining valve haemodynamics, chamber geometry, and myocardial mechanics, that corresponds to a particular stage and trajectory of disease. Patients in the high-severity phenogroup of the Bernard study, or in the fibrosis-associated clusters of the Huttin study, are experiencing a specific constellation of adaptations that makes surgical correction both timely and effective. The surgery works because the underlying tissue has not yet passed the point of irreversible damage, or because the haemodynamic burden is severe enough that its relief produces measurable benefit. In the low-severity phenogroup, by contrast, the disease trajectory is more benign, the tissue damage less advanced, and the natural history more favourable even without intervention.

Huttin's team then translated their complex clustering results into a strikingly simple clinical algorithm based on just three variables: severity of mitral regurgitation, indexed left atrial volume, and left ventricular systolic contractility assessed by strain. This decision-tree classification, validated in an external replication cohort, predicted cardiovascular events better than conventional regression models. An accompanying editorial by Nozomi Kagiyama in the same issue of JACC: Cardiovascular Imaging praised the translation from complex machine learning to a three-variable bedside tool, demonstrating that AI-derived insights do not need to remain trapped inside computational infrastructure. They can reshape clinical practice directly.

Beyond the Valve Itself

The scope of machine learning phenotyping extends beyond primary mitral regurgitation into the broader landscape of mitral valve disease. Teresa Trenkwalder and Mark Lachmann, working from the German Heart Center Munich and the German Centre for Cardiovascular Research (DZHK), published a study in European Heart Journal: Cardiovascular Imaging in 2023 that applied unsupervised agglomerative clustering to 609 patients undergoing transcatheter edge-to-edge repair for mitral regurgitation, with external validation in 817 patients from two additional institutions.

Their analysis, based on eight echocardiographic variables, identified four clusters characterised not by the valve lesion itself, but by the pattern of extra-mitral cardiac damage. Cluster 1 showed isolated mitral valve disease with preserved left ventricular function (ejection fraction 56.5 plus or minus 7.79 per cent) and the best five-year survival at 60.9 per cent. Cluster 2 presented with preserved ventricular function (ejection fraction 55.7 plus or minus 7.82 per cent) but the largest regurgitant orifice area (0.623 plus or minus 0.360 square centimetres) and the highest systolic pulmonary artery pressures (68.4 plus or minus 16.2 millimetres of mercury), surviving at 43.7 per cent. Cluster 3 featured impaired ventricular function (ejection fraction 31.0 plus or minus 10.4 per cent) and enlarged end-systolic dimensions, with five-year survival of 38.3 per cent. Cluster 4, characterised by biatrial dilatation (left atrial volume 312 plus or minus 113 millilitres), had the worst prognosis at 23.8 per cent despite only slightly reduced ventricular function (ejection fraction 51.5 plus or minus 11.0 per cent).

The transcatheter repair significantly reduced pulmonary artery pressure and improved survival in Cluster 1 but did not improve outcomes in Cluster 4, where significant diastolic dysfunction rendered the intervention insufficient. This finding mirrors the surgical pattern observed by Bernard: certain patient subpopulations derive clear benefit from intervention, while others do not, and the distinction is invisible to conventional classification.

What makes the Trenkwalder study particularly illuminating is its demonstration that cardiac damage in mitral regurgitation does not follow a neat, sequential progression. A clinician might assume that patients move from mild disease to moderate remodelling to severe dysfunction in an orderly fashion, but the clustering analysis showed that biatrial dilatation (Cluster 4) could occur even with relatively preserved ventricular function, and that pulmonary hypertension (Cluster 2) could develop independently of ventricular impairment. The machine learning model captured a multidimensional reality that linear clinical reasoning tends to oversimplify.

A Proof of Concept With Precedent

The phenogrouping approach in mitral regurgitation does not exist in a vacuum. It draws on a methodology that has already demonstrated its value in other areas of cardiovascular medicine. A landmark 2019 study by Maja Cikes and colleagues, published in the European Journal of Heart Failure, used unsupervised machine learning to phenogroup 1,106 heart failure patients from the MADIT-CRT trial and identify those most likely to respond to cardiac resynchronisation therapy. Their analysis identified four phenogroups with significantly different baseline characteristics, biomarker values, and treatment responses. Two phenogroups were associated with substantially better treatment effects from CRT (hazard ratios of 0.35 and 0.36, P = 0.0005 and P = 0.001, respectively), while the others showed no significant benefit.

The CRT study established that unsupervised clustering of clinical and imaging data could meaningfully stratify patients for therapeutic response in ways that conventional selection criteria could not. The mitral regurgitation studies extend this principle to surgical and transcatheter valve interventions, applying the same logic: not all patients who meet guideline criteria for treatment will benefit equally, and the differences between responders and non-responders are encoded in patterns that only multidimensional analysis can detect.

Automating the Front Door

While phenogrouping addresses the question of who benefits from intervention, a parallel stream of AI research is tackling an equally important upstream problem: making the initial echocardiographic assessment more accurate, more reproducible, and vastly more scalable.

In 2024, Amey Vrudhula, David Ouyang, and colleagues at Cedars-Sinai Medical Centre published a study in Circulation describing EchoNet-MR, a fully automated, open-source deep learning pipeline for detecting clinically significant mitral regurgitation from transthoracic echocardiograms. The system was trained on 58,614 studies comprising 2,587,538 individual videos and required no manual input, processing raw echocardiographic studies from start to finish. Internally, it achieved an area under the curve of 0.916 for detecting moderate or greater regurgitation and 0.934 for severe regurgitation. When tested externally at Stanford Healthcare on 915 studies comprising 46,890 videos, performance actually improved, with an area under the curve of 0.951 for moderate or greater regurgitation and 0.969 for severe regurgitation.

Building on this, Anita Sadeghpour and colleagues published a study in JACC: Cardiovascular Imaging in January 2025 describing an automated machine learning workflow for grading mitral regurgitation severity using 16 American Society of Echocardiography-recommended parameters. The preferred model used nine parameters, was feasible in 99.3 per cent of cases, completed analysis in approximately 80 seconds per case, and achieved accuracy of 0.97 for distinguishing significant from non-significant regurgitation, with sensitivity of 0.96 and specificity of 0.98. Patients graded as having severe regurgitation by the model had significantly higher one-year mortality (adjusted hazard ratio 5.20, 95 per cent confidence interval 1.24 to 21.9, P = 0.025 compared with mild).

The convergence of these two streams, automated detection and severity grading on one hand, and phenogrouping for surgical decision support on the other, points towards a future in which the entire pathway from echocardiographic acquisition to treatment recommendation could be substantially augmented by artificial intelligence. Bo Xu and Alejandro Sanchez-Nadales, writing in a 2025 editorial in JACC: Cardiovascular Imaging, described this as a “paradigm shift” in how cardiac imaging is performed, interpreted, and applied in patient care.

The Reclassification Problem

The most disquieting implication of these studies is not that AI can predict outcomes. It is that AI reveals how many patients were being misclassified all along.

The Bernard study's categorical net reclassification improvement of P = 0.002 in conventionally severe or moderate-to-severe patients means that a meaningful number of patients were being placed in the wrong prognostic category by existing methods. Some patients classified as needing urgent surgery may not have derived benefit from it. Others who appeared to be safely managed with watchful waiting may have been silently accumulating the kind of cardiac damage, ventricular remodelling, atrial dilatation, myocardial fibrosis, that narrows the window for successful intervention.

The Huttin study compounds this concern. Patients in Cluster 4, those with severe regurgitation and impaired systolic strain, had significantly more myocardial fibrosis. Yet by conventional echocardiographic criteria, many of these patients might not have appeared markedly different from Cluster 3, which shared similar regurgitation severity and remodelling but without the strain impairment. The fibrosis, undetectable by standard measurements alone, was the distinguishing feature, and it was the machine learning algorithm that flagged it.

This reclassification problem is not academic. Mitral valve surgery, whether repair or replacement, carries real operative risk. The debate between early surgery and watchful waiting in asymptomatic patients is one of the most contentious in cardiology precisely because the consequences of getting it wrong run in both directions. Operate too early, and you expose a patient to surgical risk for a condition that might have been safely monitored. Operate too late, and irreversible myocardial damage may have already occurred, diminishing the benefit of intervention. Guidelines from the ACC/AHA and the ESC/EACTS do not fully agree on the thresholds for surgery in asymptomatic patients, a disagreement that itself reflects the inadequacy of current risk stratification. The American guidelines consider mitral valve repair reasonable when the likelihood of a successful repair exceeds 95 per cent with expected mortality below one per cent, whereas the European guidelines consider watchful waiting a safe strategy except in the presence of atrial fibrillation or pulmonary hypertension exceeding 50 millimetres of mercury.

Machine learning phenogrouping offers a potential resolution by replacing the binary question of whether regurgitation meets a severity threshold with the more nuanced question of which pattern of cardiac adaptation a particular patient exhibits. It reframes surgical candidacy from a one-dimensional threshold problem into a multidimensional pattern recognition exercise, one in which the data-driven phenotype carries prognostic information that the individual measurements, taken in isolation, do not.

What Stands Between Here and the Clinic

For all its promise, AI-driven phenogrouping in mitral regurgitation remains in its early stages. The Bernard study, while validated in two independent cohorts, involved a total of only 400 patients. The Kwak study was larger at 2,321 patients, but it was retrospective and limited to three South Korean hospitals. The Huttin study comprised 429 patients. None of these represents the kind of large-scale, prospective, multi-ethnic randomised trial that would be needed to change clinical guidelines.

A 2025 scoping review published in npj Cardiovascular Health examined the landscape of unsupervised machine learning applied to valvular heart disease and concluded that while these approaches consistently provided more detailed insights than traditional guideline-based severity classifications, significant barriers remain. Feature selection varies widely between studies. Validation cohorts are often small and geographically limited. The relationship between computationally derived phenogroups and the biological mechanisms underlying disease progression requires further elucidation.

There is also the question of integration. Even if a phenogrouping model proves robust in large trials, it needs to be embedded in clinical workflow software, connected to echocardiography machines, and made accessible to the cardiologists and cardiac surgeons who make treatment decisions. The automated severity grading systems being developed by groups such as Us2.ai and the Cedars-Sinai team suggest that the infrastructure for AI-augmented echocardiography is taking shape, but the pathway from research algorithm to routine clinical deployment is neither short nor straightforward.

Perhaps the most profound barrier is cultural. Cardiology, like all of medicine, operates on a framework of evidence-based guidelines developed through decades of clinical trials, consensus conferences, and expert deliberation. Machine learning phenogrouping does not simply add a new variable to existing risk scores. It fundamentally challenges the paradigm of threshold-based decision-making that underpins current practice. Asking a clinician to trust a clustering algorithm over guidelines they have trained with for their entire career is asking them to accept a different epistemology of disease, one in which diagnosis is not a categorical label but a position within a multidimensional space of continuous variables.

Yet the data are increasingly hard to ignore. When a machine learning model identifies a patient subpopulation in whom surgery confers no survival benefit, and that finding replicates in an independent cohort on a different continent, and the explanatory AI reveals exactly which echocardiographic parameters drove the classification, the question ceases to be whether this technology has value. The question becomes how quickly clinical practice can adapt to the reality that mitral regurgitation is not one disease, and never was.

References and Sources

1. Bernard, J., Yanamala, N., Shah, R., et al. “Integrating Echocardiography Parameters With Explainable Artificial Intelligence for Data-Driven Clustering of Primary Mitral Regurgitation Phenotypes.” JACC: Cardiovascular Imaging, 16(10), 1253-1267 (2023). DOI: 10.1016/j.jcmg.2023.02.016.

2. Kwak, S., Lee, S.A., Lim, J., et al. “Long-term outcomes in distinct phenogroups of patients with primary mitral regurgitation undergoing valve surgery.” Heart, 109(4), 305-313 (2023). DOI: 10.1136/heartjnl-2022-321305.

3. Huttin, O., Girerd, N., Jobbe-Duval, A., et al. “Machine Learning-Based Phenogrouping in Mitral Valve Prolapse Identifies Profiles Associated With Myocardial Fibrosis and Cardiovascular Events.” JACC: Cardiovascular Imaging, 16(10), 1271-1284 (2023). DOI: 10.1016/j.jcmg.2023.03.009.

4. Trenkwalder, T., Lachmann, M., et al. “Machine learning identifies pathophysiologically and prognostically informative phenotypes among patients with mitral regurgitation undergoing transcatheter edge-to-edge repair.” European Heart Journal: Cardiovascular Imaging, 2023. DOI: 10.1093/ehjci/jead013.

5. Vrudhula, A., Duffy, G., Vukadinovic, M., et al. “High-Throughput Deep Learning Detection of Mitral Regurgitation.” Circulation, 150(12), 923-933 (2024). DOI: 10.1161/CIRCULATIONAHA.124.069047.

6. Sadeghpour, A., Jiang, Z., Hummel, Y.M., et al. “An Automated Machine Learning-Based Quantitative Multiparametric Approach for Mitral Regurgitation Severity Grading.” JACC: Cardiovascular Imaging, 18(1), 1-12 (2025). DOI: 10.1016/j.jcmg.2024.06.011.

7. Xu, B., Sanchez-Nadales, A. “Artificial Intelligence in Echocardiographic Evaluation of Mitral Regurgitation: Envisioning the Future.” JACC: Cardiovascular Imaging, 18(1), 13-15 (2025). DOI: 10.1016/j.jcmg.2024.05.026.

8. Coffey, S., Cairns, B.J., Iung, B. “The global epidemiology of valvular heart disease.” Nature Reviews Cardiology, 18, 853-864 (2021). DOI: 10.1038/s41569-021-00570-z.

9. ACC/AHA. “2020 Guideline for the Management of Patients With Valvular Heart Disease.” Circulation, 143(5), e72-e227 (2021). DOI: 10.1161/CIR.0000000000000923.

10. Baumgartner, H., et al. “2021 ESC/EACTS Guidelines for the management of valvular heart disease.” European Heart Journal, 43(7), 561-632 (2022). DOI: 10.1093/eurheartj/ehab395.

11. Neveu, D., et al. “Primary mitral regurgitation: Toward a better quantification on left ventricular consequences.” Clinical Cardiology, 2024. DOI: 10.1002/clc.24190.

12. Gaasch, W.H., Meyer, T.E. “Forward Left Ventricular Ejection Fraction: A Simple Risk Marker in Patients With Primary Mitral Regurgitation.” Journal of the American Heart Association, 6(11), e006309 (2017). DOI: 10.1161/JAHA.117.006309.

13. “Phenotyping valvular heart diseases using the lens of unsupervised machine learning: a scoping review.” npj Cardiovascular Health, 2025. DOI: 10.1038/s44325-025-00077-3.

14. Li, Z., et al. “Global, Regional, and National Burden of Valvular Heart Disease, 1990 to 2021.” Journal of the American Heart Association, 2024. DOI: 10.1161/JAHA.124.037991.

15. Cikes, M., et al. “Machine learning-based phenogrouping in heart failure to identify responders to cardiac resynchronization therapy.” European Journal of Heart Failure, 21, 74-85 (2019). DOI: 10.1002/ejhf.1333.

16. Kagiyama, N. “Translating Complex Machine-Learning Phenogrouping Into Simple Algorithm: Atrium, Ventricle, and Fibrosis in Mitral Valve Prolapse.” JACC: Cardiovascular Imaging, 16(10), 1285-1287 (2023). DOI: 10.1016/j.jcmg.2023.07.010.

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Every morning, roughly two billion people wake up and talk to their phones. They ask about the weather. They dictate messages to lovers, colleagues, and therapists. They request directions to clinics they would rather not name aloud. They ask questions about symptoms they have not yet mentioned to a doctor. They do all of this without pausing to consider a simple, uncomfortable fact: every one of those queries is now processed by artificial intelligence systems so vast and so opaque that not even the engineers who built them can fully explain what happens to the data once it enters the pipeline.

In January 2026, Apple and Google formalised a partnership that sent tremors through the technology industry. Apple would pay Google approximately one billion dollars per year to license a custom version of Gemini, Google's 1.2-trillion-parameter large language model, to power the next generation of Siri. The announcement was framed as a triumph of engineering collaboration. Apple's chief executive, Tim Cook, declared during the company's first-quarter 2026 earnings call that Google's AI technology would “provide the most capable foundation for Apple Foundation Models.” What neither company dwelt on was the extraordinary privacy implications of routing the intimate queries of more than a billion iPhone users through a model built by the world's largest advertising company.

Meanwhile, in the United Kingdom and Ireland, regulators were already mobilising against a different AI assistant gone rogue. Elon Musk's Grok, the chatbot integrated into X (formerly Twitter), had sparked a global backlash after users discovered they could instruct it to generate sexualised images of real people, including children. By February 2026, the UK's Information Commissioner's Office, Ofcom, and Ireland's Data Protection Commission had all launched formal investigations. The question was no longer hypothetical. It was legal, political, and deeply personal: how much of your private life are you unknowingly handing over every time you ask your phone a question?

The Billion-Dollar Handshake

To understand the stakes of the Apple-Google deal, you first need to understand the architecture. When you ask the new Siri a complex question, your device determines whether it can handle the request locally. Simple tasks remain on the iPhone. But anything requiring deeper reasoning, summarisation, or multi-step planning gets routed to Apple's Private Cloud Compute infrastructure, where the Gemini model now sits at the core. Apple's previous cloud-based models used 150 billion parameters. The jump to 1.2 trillion represents not just an increase in scale but a qualitative shift in what the system can do with your data.

Apple has built Private Cloud Compute around five core principles: stateless computation, meaning no data is stored after the task completes; enforceable guarantees, meaning only designated code touches user data; no privileged access, meaning not even Apple employees can see requests; non-targetability, meaning requests cannot be traced to individuals; and verifiable transparency, meaning security researchers can inspect the system. The servers run on Apple silicon, use the same Secure Enclave architecture found in iPhones, and process data ephemerally in memory only. Apple has opened its Private Cloud Compute software to external researchers and offered significant security bounty payouts for anyone who can demonstrate a privacy breach.

On paper, this is formidable. Apple has published a comprehensive security guide, released source code for key components, and created a Virtual Research Environment that allows anyone with a Mac to test the system. No other major technology company has offered anything comparable in terms of transparency around cloud AI processing. The system is, by any reasonable measure, the most sophisticated privacy architecture ever deployed for cloud AI at scale.

But paper guarantees and real-world guarantees are different things entirely. The structural tension in the deal is inescapable. Google, whose core business depends on data collection and targeted advertising, is now providing the intelligence layer for the world's most privacy-focused consumer technology company. Apple insists that Siri interactions sent to Gemini are anonymised and that data is never stored or used to train Google's future models. Google has confirmed it will not receive Apple user data under the arrangement. Cook himself stated during the earnings call that Apple is “not changing our privacy rules.”

Security experts remain sceptical. The concern, articulated by multiple researchers in the weeks following the announcement, centres on what has been called the “weakest link problem.” Private Cloud Compute is only as private as its most vulnerable component. If Google retains any pathway to usage data, whether for model improvement, debugging, or quality assurance, the privacy guarantee fundamentally breaks down. And crucially, Apple has declined to release the full details of its agreement with Google. Cook confirmed during the same earnings call that Apple would not be “releasing the details” of the deal to the public. For a company that has made transparency a cornerstone of its privacy messaging, the refusal to disclose the terms of its most significant AI partnership is a striking omission.

There is also a subtler concern about what researchers have termed “behavioural sovereignty.” Once Siri's cognitive engine comes from Gemini, the question shifts from where data sits to who controls the behaviour of the model that hundreds of millions of people talk to every day. Apple does not control the biases embedded in Google's model architecture, the training data Google used, or the value judgements encoded in the model's responses. This creates what one analysis described as a potential for “problematic experiences that do not align with Apple's core values.” When the model that shapes how your phone responds to your most personal questions was built by a company whose business model depends on knowing everything about you, the architecture of privacy matters less than the architecture of incentives.

The irony is not lost on privacy advocates. Apple regularly runs advertising campaigns contrasting its approach to privacy with competitors who monetise user data. It has updated its App Store guidelines to require apps to disclose and obtain user permission before sharing personal data with third-party AI systems. Yet its most significant AI partnership is with the very company that epitomises the data-driven advertising model Apple claims to oppose. Apple also already pays Google approximately 20 billion dollars per year to be the default search engine on iPhones. The Gemini deal deepens an entanglement that privacy advocates have long viewed with suspicion.

What Your Voice Actually Reveals

The privacy risks of AI assistants extend far beyond the question of whether your specific query reaches a particular server. The deeper issue is what AI systems can infer from the patterns of your behaviour, even when individual requests appear innocuous.

A landmark study published in 2025 by researchers at Northeastern University and the University of Southern California, titled “Echoes of Privacy: Uncovering the Profiling Practices of Voice Assistants,” examined exactly this question. Led by Northeastern's Mon(IoT)r Research Group, the research team conducted 1,171 experiments involving nearly 25,000 voice queries over 20 months across Google Assistant, Amazon Alexa, and Apple's Siri. They created fresh user accounts, trained them with curated sets of voice queries designed to simulate various user personas, and then examined what profiling labels each platform assigned. The lead authors, Tina Khezresmaeilzadeh and Elaine Zhu, along with their colleagues, published their findings in the Proceedings on Privacy Enhancing Technologies, Volume 2025, Issue 2.

The findings were striking in their divergence. Google Assistant exhibited the most aggressive profiling behaviour, compiling information on users based on their queries, including inferred gender, age range, relationship status, and income bracket. Profiling occurred even without direct user interactions, with arbitrary and sometimes inaccurate labels appearing at different times for identical queries. Amazon Alexa showed more moderate profiling, though the researchers found that Amazon provided no tools for users to selectively remove or correct mislabelled profiling data. When users opted out of profiling on Amazon's platform, it worked as expected and limited further label creation, but existing labels could not be rectified. Apple's Siri produced no profiling labels whatsoever, making it the least invasive platform in the study.

But even Apple's relatively clean record on profiling does not eliminate risk. Voice assistants continuously listen for their wake words. Despite assurances that devices only record after detecting the trigger phrase, instances of accidental activation have been well documented, resulting in the capture of private conversations that users never intended to share. And the data that voice assistants do collect intentionally is remarkably revealing. Siri's “request history” includes transcripts, audio for users who have opted in to the Improve Siri programme, contact names, names of installed apps, device specifications, and approximate location. Each of these data points, individually unremarkable, creates a mosaic of personal information when aggregated over weeks and months.

The economic value of this data is immense and growing. Google's advertising revenue per user has increased by approximately 1,800 per cent since 2001, from $1.07 to $36.20 by 2019, and the figure has climbed further since. According to multiple surveys conducted in 2025, 92 per cent of internet users are tracked by Google's behavioural data collection systems. And as Consumer Reports noted in a 2025 analysis, Google's privacy controls affect data sharing between platforms, not collection itself. The settings restrict targeting precision, not profiling capability. Many data streams do not require “Web and App Activity” to be enabled; they form the baseline substrate on which Google's entire business model depends.

The shift to trillion-parameter models makes this dynamic significantly more concerning. Earlier AI assistants could handle only simple pattern matching and keyword routing. A model with 1.2 trillion parameters can draw inferences across vast contextual landscapes. It can connect a medical query from Tuesday morning with a pharmacy search that afternoon and a life insurance question the following week. It can identify emotional states from word choice and sentence structure. It can infer relationships, financial situations, and health conditions from the texture of ordinary conversation. The International AI Safety Report, published in January 2025 by 96 experts led by Yoshua Bengio and commissioned by the 30 nations attending the 2023 Bletchley Park AI Safety Summit, explicitly identified these inference capabilities as a significant privacy risk, noting that “several harms from general-purpose AI are already well established, including privacy violations” and that “no combination of techniques can fully resolve them.”

A Ledger of Broken Promises

The history of AI assistant privacy violations reveals a pattern that should give any user pause. In July 2019, a whistleblower revealed that Apple employed third-party contractors to review Siri audio recordings as part of a quality evaluation process called the Voice Grading Programme. The contractors, the whistleblower told journalists, “regularly hear confidential medical information, drug deals, and recordings of couples having sex.” The recordings were accompanied by user data showing location, contact details, and app data. Apple had not disclosed this practice in its consumer terms and conditions.

Apple suspended the programme, issued a formal apology, and laid off more than 300 contractors who had been working on Siri grading in Europe. The company implemented new policies requiring explicit user opt-in for audio review and restricted the work to Apple employees rather than third-party contractors. But the damage was lasting. In January 2025, a federal judge approved a 95-million-dollar class action settlement in the case of Fumiko Lopez v. Apple. The plaintiffs alleged that Siri had been activated without the “Hey Siri” trigger, recording private conversations and sharing data with advertisers. Two plaintiffs reported receiving targeted advertisements for products they had only discussed verbally, including Air Jordan trainers and Olive Garden restaurants. A third said he received adverts for a surgical procedure he had discussed privately with his doctor. Apple denied wrongdoing but agreed to permanently delete all individual Siri audio recordings collected before October 2019.

The settlement covered approximately 138.5 million potentially eligible devices, though 97 per cent of eligible users never filed a claim. A separate case under Illinois's Biometric Information Privacy Act, with a class of 2.6 to 3.9 million users, was certified in January 2026 and remains ongoing. That law provides statutory damages of 1,000 to 5,000 dollars per violation.

Amazon's track record is similarly troubled. In May 2023, the Federal Trade Commission and the US Department of Justice charged Amazon with violating children's privacy laws by retaining Alexa voice recordings indefinitely and using them to improve its algorithms, even after parents explicitly requested deletion. The FTC found that when parents requested data deletion, Amazon deleted files in some databases while maintaining them in others, keeping the information available for the company's own purposes. Amazon paid a 25-million-dollar civil penalty. In a separate case, Amazon paid an additional 5.8 million dollars over Ring doorbell camera privacy violations after it emerged that employees and contractors had full access to customers' video streams. In the most disturbing instances, hackers broke into Ring's two-way video streams to sexually proposition people, call children racial slurs, and physically threaten families for ransom.

These are not edge cases. They represent systematic failures at three of the largest technology companies in the world. And they occurred with AI systems that were orders of magnitude less capable than the trillion-parameter models now being deployed.

Grok and the Regulatory Reckoning

If the Apple-Google deal represents the sophisticated end of the AI privacy spectrum, the Grok controversy represents the catastrophic failure mode. And the regulatory response to Grok is already reshaping the legal landscape that all AI assistants will have to navigate.

The crisis began in late December 2025, when users on X discovered that Grok's image generation capabilities could be weaponised. The chatbot's “Spicy Mode” allowed users to instruct it to “undress” images of women, generating AI deepfakes with no consent and no meaningful safeguards. A study by AI Forensics, based on 50,000 tweets mentioning Grok published between 25 December 2025 and 1 January 2026, found that over 53 per cent contained individuals in minimal attire. Researchers reported that some of the generated images appeared to include children.

The UK's Ofcom moved first. On 5 January 2026, the regulator urgently contacted X and set a firm deadline of 9 January for the company to explain what steps it had taken to comply with its duties under the Online Safety Act. By 12 January, Ofcom had opened a formal investigation examining whether X conducted the required risk assessments before deploying Grok's image generation features, whether it took adequate steps to prevent the distribution of non-consensual intimate imagery and child sexual abuse material, and whether it implemented age verification measures to protect children. Ofcom's enforcement powers include fines of up to 18 million pounds or 10 per cent of a company's qualifying global revenue, whichever is higher. In the most serious cases, it can seek court orders requiring internet service providers or payment firms to withdraw services or block access in the UK.

The Information Commissioner's Office followed on 3 February 2026, launching its own investigation focused specifically on data protection. William Malcolm, the ICO's head of regulatory risk and innovation, stated that “the reports about Grok raise deeply troubling questions about how people's personal data has been used to generate intimate or sexualised images without their knowledge or consent.” He added: “Losing control of personal data in this way can cause immediate and significant harm, particularly where children are involved.”

Ireland's Data Protection Commission opened a parallel investigation under the GDPR, given that X holds its European Union operations in Ireland. The DPC's investigation focuses on the processing of personal data and Grok's potential to produce harmful sexualised images involving Europeans, including children. Under the GDPR, the DPC can levy fines of up to four per cent of a company's global revenue.

The regulatory net extends further still. French police raided X's Paris offices in early February as part of a widening criminal inquiry. Both Elon Musk and former X chief executive Linda Yaccarino were summoned for questioning. Governments and regulators in at least eight countries confirmed action against X and xAI. And the UK government fast-tracked provisions under section 138 of the Data (Use and Access) Act 2025, which came into force on 6 February 2026, creating new criminal offences for creating or requesting the creation of non-consensual intimate images, including AI-generated deepfakes of adults. The legislation also criminalises requesting someone else to create such images, closing a significant gap in English law that had previously left the initial creation of non-consensual intimate images outside the scope of criminal liability.

X responded by limiting the image editing feature to paid subscribers and announcing it would no longer allow users to edit images of real people in revealing clothing in jurisdictions where it is illegal. But by mid-January, reports indicated that the images were still being produced on X in the UK, France, and Belgium. The gap between corporate promises and technical reality is precisely what regulators are now probing.

Regulatory Fragmentation and the Enforcement Gap

The regulatory landscape for AI privacy is evolving rapidly but remains deeply fragmented, and that fragmentation itself is a privacy risk. In the European Union, the AI Act, adopted in 2024, creates a risk-based framework that subjects high-risk AI systems to specific obligations. It works in concert with the GDPR, which remains the world's most comprehensive data protection regulation. But in November 2025, the European Commission proposed a Digital Omnibus package that would amend both the GDPR and the AI Act, introducing changes that critics describe as significant deregulation driven by industry lobbying.

Among the most contentious proposals is a provision that would explicitly recognise the processing of personal data for AI training as a “legitimate interest” under the GDPR, removing the need for explicit consent. Another would narrow the definition of personal data, potentially stripping many pseudonymous identifiers, such as advertising IDs and cookies, of GDPR protection entirely. The deadlines for compliance with the AI Act's requirements for high-risk systems would be pushed back to December 2027 and August 2028. The obligation for AI providers and deployers to teach AI literacy to their users would be dropped altogether. Analysis published by Corporate Europe Observatory in January 2026 traced the influence of major technology companies on these proposals, characterising them as a systematic rollback of EU digital rights shaped “article by article” by Big Tech lobbying.

In the United Kingdom, the regulatory framework is being shaped in real time by the Grok investigations. The Online Safety Act 2023 created new duties for platforms to protect users from illegal content, and the Data (Use and Access) Act 2025 introduced criminal offences for creating non-consensual intimate images. But enforcement remains a challenge. Ofcom acknowledged that “because of the way the Act relates to chatbots,” it is currently unable to investigate the creation of illegal images by the standalone Grok service, only its distribution on X. The government has signalled it will table an amendment to the Crime and Policing Bill to require AI chatbot providers not currently in scope of the Online Safety Act to protect their users from illegal content. But legislation moves slowly, and AI moves fast.

In the United States, there is still no comprehensive federal privacy law. By February 2025, 19 states had enacted their own privacy laws, creating a patchwork of regulations that technology companies must navigate. The FTC has used its existing enforcement powers aggressively, securing settlements from Amazon and others, but its authority remains limited compared to European regulators. The structural problem is clear: AI systems operate globally, processing data across jurisdictions with incompatible legal frameworks. A query made by a user in London might be processed on servers in the United States using a model trained on data from dozens of countries. The legal protections that apply depend on where the user sits, where the server sits, where the company is incorporated, and which regulators choose to act.

The Invisible Bargain

What makes AI assistant privacy so difficult to address is that the bargain is almost entirely invisible to the user. When you install a social media app, you are at least dimly aware that you are exchanging personal information for a service. When you ask Siri to set a timer or check the weather, the transactional nature of the interaction is hidden. The service feels like a utility, not a data exchange.

But it is a data exchange. Every query you make generates metadata: when you asked, where you were, what device you used, what you asked before and after. Even if your specific words are anonymised and deleted, the patterns they create persist. In the AI era, privacy risks are increasingly metadata risks. As one legal analysis noted, AI makes inference cheaper and more accurate, meaning that even seemingly innocuous data points can reveal sensitive information when processed by a system optimised to find patterns. Your query history reveals your daily routines, your anxieties, your relationships, your health concerns, and your financial worries. Aggregated over months and years, this data constitutes a remarkably detailed portrait of your inner life.

The International AI Safety Report identified this dynamic explicitly, noting that Retrieval-Augmented Generation, a common technique used to personalise AI responses by feeding systems current and personal data beyond the model's original training set, “creates additional privacy risks” even when the underlying model itself is secure. The report also warned that AI can infer identities from indirect data even after de-identification efforts, and that privacy risks may extend to people who are not users of the system but whose personal information might be inferred through advanced data analysis.

IBM's 2025 data breach report added another dimension to the problem. It revealed that one in five organisations experienced breaches through “shadow AI,” which occurs when employees paste sensitive information, source code, meeting notes, and customer data into unauthorised AI tools. These breaches added an average of 670,000 dollars to breach costs. The risk is not limited to corporate settings. Any user who dictates a sensitive message through Siri, asks a health question through Alexa, or discusses financial details with Google Assistant is feeding data into a system whose ultimate disposition of that information depends on architectural decisions, corporate policies, and regulatory frameworks that the user cannot see and may not understand.

Survey data consistently reflects growing public unease with this reality. According to multiple industry surveys from 2025, 82 per cent of consumers reported being highly concerned about how their data is collected and used. Seventy per cent expressed little to no trust in companies to make responsible decisions about AI in their products. Fifty-seven per cent of people worldwide identified the use of AI in collecting and processing personal data as a serious privacy risk. Yet despite this anxiety, fewer than one in four American smartphone users reported feeling in control of their personal data online. The gap between concern and agency is the defining feature of the AI privacy landscape.

Apple's approach to this challenge is, by industry standards, genuinely ambitious. Private Cloud Compute represents a serious engineering effort to process AI queries without creating a permanent record. The company's willingness to open its systems to external security researchers and to offer bounties for discovered vulnerabilities distinguishes it from virtually every competitor. Users can generate reports of requests their iPhone has sent to Private Cloud Compute through Settings, covering periods of the last 15 minutes or the last seven days. But even the most robust privacy architecture cannot fully eliminate the risks inherent in routing the world's most personal queries through a model that Apple did not build, using training data Apple did not curate, with architectural decisions Apple did not make.

The AI assistant on your phone is no longer a simple voice-activated search engine. It is a system capable of understanding, inferring, and connecting information in ways that previous generations of technology could not. The 1.2-trillion-parameter brain inside your phone is extraordinarily powerful. But power, in the context of personal data, has always been a question of who holds it and what they choose to do with it. Right now, the answer to that question is: you do not hold it, you cannot fully verify what is being done with it, and the regulatory systems designed to protect you are still catching up to a technology that is already inside your pocket, already listening, and already far more capable than most people realise.

That should concern anyone who has ever asked their phone a question they would rather not say out loud.

---

References and Sources

1. CNBC, “Apple picks Google's Gemini to run AI-powered Siri coming this year,” 12 January 2026. https://www.cnbc.com/2026/01/12/apple-google-ai-siri-gemini.html

2. Bloomberg, “Apple Plans to Use 1.2 Trillion Parameter Google Gemini Model to Power New Siri,” 5 November 2025. https://www.bloomberg.com/news/articles/2025-11-05/apple-plans-to-use-1-2-trillion-parameter-google-gemini-model-to-power-new-siri

3. MacRumors, “Apple Explains How Gemini-Powered Siri Will Work,” 30 January 2026. https://www.macrumors.com/2026/01/30/apple-explains-how-gemini-powered-siri-will-work/

4. Apple Insider, “Tim Cook: Apple won't change privacy rules with Google Gemini partnership,” 29 January 2026. https://appleinsider.com/articles/26/01/29/tim-cook-apple-wont-change-privacy-rules-with-google-gemini-partnership

5. Apple Insider, “Google confirms that it won't get Apple user data in new Siri deal,” 12 January 2026. https://appleinsider.com/articles/26/01/12/google-confirms-that-it-wont-get-apple-user-data-in-new-siri-deal

6. TheStreet, “Apple's new Siri runs on Gemini, and there's an invisible catch,” 2026. https://www.thestreet.com/technology/apples-new-siri-runs-on-gemini-and-theres-an-invisible-catch

7. Apple Security Research, “Private Cloud Compute: A new frontier for AI privacy in the cloud.” https://security.apple.com/blog/private-cloud-compute/

8. Apple Security Research, “Security research on Private Cloud Compute.” https://security.apple.com/blog/pcc-security-research/

9. Khezresmaeilzadeh, T., Zhu, E., Grieco, K., Dubois, D., Psounis, K., and Choffnes, D. “Echoes of Privacy: Uncovering the Profiling Practices of Voice Assistants.” Proceedings on Privacy Enhancing Technologies, Volume 2025, Issue 2, Pages 71-87. https://petsymposium.org/popets/2025/popets-2025-0050.php

10. Northeastern University News, “Your voice assistant is profiling you, just not in the way you expect, new research finds,” 17 March 2025. https://news.northeastern.edu/2025/03/17/voice-assistant-profiling-research/

11. Ofcom, “Ofcom launches investigation into X over Grok sexualised imagery,” 12 January 2026. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-launches-investigation-into-x-over-grok-sexualised-imagery

12. ICO, “ICO announces investigation into Grok,” 3 February 2026. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/

13. Euronews, “Ireland investigates Elon Musk's Grok AI over sexualised images,” 17 February 2026. https://www.euronews.com/next/2026/02/17/ireland-launches-large-scale-probe-into-elon-musks-grok-over-ai-generated-sexual-images

14. CNN Business, “Grok AI: Europe's privacy watchdog launches 'large-scale' probe into Elon Musk's X,” 17 February 2026. https://edition.cnn.com/2026/02/17/business/grok-ai-sexualized-images-eu-probe-intl

15. TechPolicy.Press, “Regulators Are Going After Grok and X – Just Not Together,” 2026. https://www.techpolicy.press/regulators-are-going-after-grok-and-x-just-not-together/

16. Data (Use and Access) Act 2025, Section 138, UK Parliament. https://www.legislation.gov.uk/ukpga/2025/18/section/138

17. FTC, “FTC and DOJ Charge Amazon with Violating Children's Privacy Law by Keeping Kids' Alexa Voice Recordings Forever,” 31 May 2023. https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childrens-privacy-law-keeping-kids-alexa-voice-recordings-forever

18. NPR, “Amazon to pay over $30 million to settle claims Ring, Alexa invaded user privacy,” 1 June 2023. https://www.npr.org/2023/06/01/1179381126/amazon-alexa-ring-settlement

19. IAPP, “European Commission proposes significant reforms to GDPR, AI Act,” November 2025. https://iapp.org/news/a/european-commission-proposes-significant-reforms-to-gdpr-ai-act

20. Corporate Europe Observatory, “Article by article, how Big Tech shaped the EU's roll-back of digital rights,” January 2026. https://corporateeurope.org/en/2026/01/article-article-how-big-tech-shaped-eus-roll-back-digital-rights

21. CMS LawNow, “Grok in deep trouble over deepfakes? What Ofcom's recent investigation means for online platforms,” February 2026. https://cms-lawnow.com/en/ealerts/2026/02/grok-in-deep-trouble-over-deepfakes-what-ofcom-s-recent-investigation-means-for-online-platforms

22. Apple Newsroom, “Improving Siri's privacy protections,” August 2019. https://www.apple.com/newsroom/2019/08/improving-siris-privacy-protections/

23. NPR, “Apple to pay $95 million to settle Siri privacy lawsuit,” 3 January 2025. https://www.npr.org/2025/01/03/g-s1-40940/apple-settle-lawsuit-siri-privacy

24. Courthouse News Service, “Judge approves $95 million Apple settlement over Siri privacy case,” October 2025. https://www.courthousenews.com/judge-approves-95-million-apple-settlement-over-siri-privacy-case/

25. International AI Safety Report 2025, published January 2025. https://internationalaisafetyreport.org/publication/international-ai-safety-report-2025

26. Private AI, “What the International AI Safety Report 2025 has to say about Privacy Risks from General Purpose AI,” 2025. https://www.private-ai.com/en/blog/ai-safety-report-2025-privacy-risks

27. Ofcom, “Investigation into X Internet Unlimited Company,” January 2026. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/investigation-into-x-internet-unlimited-company-and-its-compliance-with-duties-to-protect-its-users-from-illegal-content-and-child-users-from-harmful-content

28. Lewis Silkin, “Online safety reforms to be fast-tracked amid rising AI risks,” February 2026. https://www.lewissilkin.com/insights/2026/02/23/online-safety-reforms-to-be-fast-tracked-amid-rising-ai-risks-102mk2r

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Somewhere inside the engineering departments of the world's largest technology companies, a peculiar feedback loop has taken hold. AI systems generate code. Other AI systems review that code. Human developers, increasingly sidelined from the details of what they are shipping, approve the results with a cursory glance, trusting that the machines have checked each other's work. It is a recursive dependency model that, on the surface, appears to represent the pinnacle of software engineering efficiency. Beneath that surface, it is something far more troubling: a system in which genuine comprehension of production software is quietly evaporating.

The numbers underscoring this shift are staggering. According to SonarSource's State of Code 2025 survey, 42% of committed code is now AI-generated or AI-assisted. GitHub Copilot generates an average of 46% of code written by its users, with Java developers reaching 61%. Microsoft has stated that 30% of its code is now written by AI. In March 2025, Y Combinator reported that 25% of startup companies in its Winter 2025 batch had codebases that were 95% AI-generated. By 2026, Gartner forecasts that up to 60% of new software code will be AI-generated. And yet, as a December 2025 analysis by CodeRabbit revealed, AI-generated code produces 1.7 times more defects than human-written code, with logic and correctness errors 75% more prevalent and security vulnerabilities up to 2.74 times higher. The enterprise world has normalised a practice that demonstrably increases the rate at which flawed software reaches production, whilst simultaneously deploying AI-powered tools to catch the very problems that AI introduced.

This is not merely a quality assurance challenge. It is a systemic architectural failure, one that demands urgent examination before organisations cross an invisible threshold from which recovery becomes extraordinarily expensive.

The Verification Gap Nobody Wants to Discuss

The fundamental mismatch between AI code generation and AI code review is not a matter of sophistication. It is a matter of category. AI code generators, whether GitHub Copilot, Cursor, or Claude Code, excel at producing syntactically correct, plausible-looking software. They are trained on billions of lines of existing code and have absorbed the statistical patterns of how functions are structured, how variables are named, and how common problems are solved. What they lack, fundamentally, is understanding. They do not know what the software is supposed to do in the context of a specific business, a specific user base, or a specific regulatory environment.

AI code review tools suffer from a mirror-image limitation. They can identify known vulnerability patterns, flag deviations from coding standards, and spot surface-level issues with impressive speed. What they cannot do reliably is reason about architectural intent, cross-service dependencies, or the subtle business logic that distinguishes a functioning application from a dangerously flawed one. Many tools are limited to changes visible within a single pull request and do not track downstream consumers or cross-service contract violations. Tools systematically fail to detect breaking changes across service boundaries in microservice architectures and SDK incompatibilities when shared libraries are updated.

Tenzai's December 2025 research laid this bare with uncomfortable precision. The firm tested identical prompts across five of the most prominent AI coding tools: Claude Code, OpenAI Codex, Cursor, Replit, and Devin. Across 15 test applications, they found 69 vulnerabilities, including six rated critical. The pattern was revealing: not a single exploitable SQL injection or cross-site scripting vulnerability was found. The AI tools had learned to avoid those well-documented pitfalls. Instead, the dominant failures were in business logic and authorisation: preventing negative pricing in e-commerce applications, enforcing user ownership checks, and validating that admin-only endpoints actually require admin access. Every tool tested introduced server-side request forgery vulnerabilities because determining which URLs are safe is inherently context-dependent.

What concerned Tenzai most was not what the AI implemented incorrectly; it was what the AI never attempted at all. “All the coding agents, across every test we performed, failed miserably when it came to security controls,” the researchers noted. “It wasn't that they implemented them incorrectly. In almost all cases, they didn't even try.”

This is the verification gap in its starkest form. AI code generators produce software that looks complete but is architecturally hollow in its security posture. AI code reviewers, operating on the same statistical pattern-matching principles, are well-equipped to catch the kinds of errors that AI generators have already learned to avoid, and poorly equipped to catch the kinds of errors that AI generators systematically introduce. The reviewer and the generator share the same blind spots.

The Trust Deficit and the Review Bottleneck

Sonar's January 2026 survey of over 1,100 developers globally quantified a striking paradox at the heart of enterprise AI adoption. Nearly all developers, 96%, expressed some degree of distrust in AI-generated code, yet only 48% consistently verified that code before committing it. The survey found that 38% of respondents said reviewing AI-generated code requires more effort than reviewing human-generated code. Meanwhile, 35% of developers reported accessing AI coding tools via personal accounts rather than work-sanctioned ones, creating a blind spot for security and compliance teams.

The downstream consequences of this trust deficit are measurable. Opsera's AI Coding Impact Benchmark Report, drawn from analysis of more than 250,000 developers across over 60 enterprise organisations, found that whilst AI-driven coding reduces time to pull request by up to 58%, AI-generated pull requests wait 4.6 times longer in review than human-written ones when governance frameworks are absent. The initial speed gains at the beginning of the development cycle are consumed during reviews, repairs, and security checks. Code duplication increased from 10.5% to 13.5% in AI-assisted codebases, and AI-generated code introduced 15 to 18% more security vulnerabilities per line of code compared to human-written code.

The Opsera data also revealed a widening skill gap. Senior engineers realised nearly five times the productivity gains of junior engineers when using AI tools. This finding upends the popular narrative that AI democratises software development. In practice, AI amplifies existing expertise: those who already understand architecture, security, and system design use AI effectively, whilst those who lack that foundation produce more code of lower quality, faster. The 21% of AI licences that remain underutilised across enterprises further suggests that organisations are paying for productivity gains they are not achieving.

Vibe Coding and the Erosion of Intentional Design

The term “vibe coding” was coined by Andrej Karpathy, co-founder of OpenAI and former AI leader at Tesla, in a post on X on 2 February 2025. “There's a new kind of coding I call 'vibe coding,' where you fully give in to the vibes, embrace exponentials, and forget that the code even exists,” Karpathy wrote. He described a workflow in which he spoke instructions to an AI via voice transcription, always hit “Accept All” on suggested changes, and never read the code diffs. It was intended as a playful observation about weekend projects. It became a cultural phenomenon, named Collins English Dictionary's Word of the Year for 2025.

The irony is instructive. Even Karpathy himself has retreated from his own creation. His Nanochat project, launched in October 2025, was entirely hand-coded in approximately 8,000 lines of PyTorch. When asked how much AI assistance he used, Karpathy responded: “It's basically entirely hand-written (with tab autocomplete). I tried to use Claude/Codex agents a few times but they just didn't work well enough at all.” The person who gave vibe coding its name does not trust the technique enough to use it on his own serious project.

The problem with vibe coding is not that it exists. For rapid prototyping, educational experiments, and disposable weekend projects, the approach has genuine utility. The problem is that enterprise software development has adopted the aesthetics of vibe coding without acknowledging its fundamental unsuitability for production systems. Developers describe requirements to AI assistants, accept generated code with minimal review, and push it to production at unprecedented speed. The result is codebases in which similar problems are solved in dissimilar ways, error handling varies wildly between components, and no single engineer possesses a coherent mental model of how the system actually works.

A study of 120 UK technology firms found that teams spent 41% more time debugging AI-generated code in systems exceeding 50,000 lines. Separately, 67% of developers surveyed reported increased debugging efforts as a direct consequence of speed-driven AI code generation. The Veracode 2025 GenAI Code Security Report, which analysed 80 coding tasks across more than 100 large language models, found that LLMs introduced security vulnerabilities in 45% of cases, with security performance showing no improvement over time despite advances in code generation capability. When given a choice between a secure and an insecure method, AI models chose the insecure option nearly half the time. For context-dependent vulnerabilities like cross-site scripting, only 12 to 13% of generated code was secure. Jens Wessling, CTO at Veracode, noted that with vibe coding, developers “do not need to specify security constraints to get the code they want, effectively leaving secure coding decisions to LLMs. Our research reveals GenAI models make the wrong choices nearly half the time, and it's not improving.”

These are not edge cases. They are systematic, predictable failures embedded in the fundamental architecture of how large language models generate code.

The Recursive Dependency Trap

The most dangerous aspect of current enterprise AI adoption is not any individual tool's limitations; it is the recursive structure of the system as a whole. Organisations are deploying AI to generate code, then deploying AI to review that code, then deploying AI to write the tests that validate both the generation and the review. At each layer, the same fundamental limitations propagate, and at each layer, the illusion of verification creates false confidence.

Consider the mechanics. An AI code generator produces a function that handles user authentication. It looks correct. It follows standard patterns. An AI code reviewer scans the function and finds no known vulnerability signatures. The function passes AI-generated unit tests. It is merged into the main branch. Three months later, a security researcher discovers that the authentication logic fails silently under a specific concurrency condition that none of the AI systems had the architectural awareness to anticipate.

This is not hypothetical speculation about some distant future risk. It is the documented reality of how AI-generated code behaves in production today. CodeRabbit's analysis of 470 pull requests found that AI-authored changes produced 10.83 issues per pull request compared to 6.45 for human-only pull requests. Critical issues were 1.4 times more common, and performance inefficiencies such as excessive input/output operations appeared nearly eight times more often in AI-generated code. AI-generated code was 1.88 times more likely to introduce improper password handling, 1.91 times more likely to create insecure object references, and 1.82 times more likely to implement insecure deserialisation. The AI systems reviewing these pull requests were effective at catching surface-level problems but consistently missed the deeper architectural and logic failures.

The recursive dependency model compounds this problem exponentially. When a human developer reviews AI-generated code, they bring contextual understanding, scepticism, and domain expertise that exists outside the statistical patterns the AI has learned. When an AI system reviews AI-generated code, it brings the same statistical pattern-matching approach that produced the code in the first place. The reviewer and the reviewed share a common epistemic foundation, which means they share common blind spots. It is the software engineering equivalent of asking a student to grade their own examination: technically possible, structurally unreliable.

Google's DORA (DevOps Research and Assessment) report, based on a survey of approximately 3,000 respondents, provides the most compelling evidence of this dynamic's real-world consequences. The 2024 report found that for every 25% increase in AI adoption, estimated delivery throughput decreased by 1.5% and delivery stability decreased by 7.2%. Crucially, 75% of respondents reported feeling more productive with AI tools, even as the objective metrics deteriorated. The 2025 follow-up report confirmed the trend: AI's correlation with increased instability persisted, even as the relationship with throughput reversed to become modestly positive. The conclusion from a decade of DORA research is unambiguous: improving the development process does not automatically improve software delivery, at least not without adherence to fundamentals like small batch sizes and robust testing mechanisms.

This perception gap, where developers believe they are working faster whilst objective measures show declining performance, is perhaps the most insidious feature of the recursive dependency model. It means organisations cannot rely on developer sentiment as an early warning system. The very people closest to the code are the least likely to recognise when AI augmentation has tipped into compounding technical debt.

The METR Paradox and the Illusion of Speed

METR's July 2025 randomised controlled trial provides the most rigorous evidence yet that AI-assisted coding's productivity benefits are, in certain critical contexts, illusory. The study recruited 16 experienced developers from large open-source repositories, averaging over 22,000 stars and one million lines of code, where participants had an average of five years and 1,500 commits of experience.

The results were striking. Developers using AI tools were 19% slower than those working without AI assistance. Before starting tasks, developers predicted that AI would reduce their completion time by 24%. After completing the study, they still believed AI had reduced their time by 20%. The perception of acceleration was completely divorced from objective reality.

Screen-recording data revealed one plausible mechanism: AI-assisted coding sessions showed more idle time, not merely “waiting for the model” time, but periods of complete inactivity. The researchers hypothesised that coding with AI requires less cognitive effort, making it easier to multitask or lose focus. In other words, the AI was not just failing to accelerate the work; it was actively degrading the concentration that experienced developers bring to complex problems.

The METR study carries important caveats. It focused on experienced developers working in repositories they knew intimately, a context where deep familiarity already provides substantial speed advantages. AI tools may offer greater benefit to less experienced developers or those working in unfamiliar codebases. Yet the finding remains profoundly important for enterprise settings, precisely because production-critical code is typically maintained by experienced developers with deep institutional knowledge. If AI tools slow down the very people most responsible for system reliability, the implications for production stability are severe.

Notably, 69% of study participants continued using AI tools after the experiment concluded, despite the measured slowdown. This suggests that the subjective experience of AI-assisted coding, the feeling of reduced cognitive load, the perception of progress, is compelling enough to override objective evidence of diminished performance. For organisations attempting to detect when they have crossed from beneficial augmentation into harmful dependency, this psychological dimension makes the threshold nearly invisible from the inside.

Detecting the Invisible Tipping Point

Organisations desperately need reliable indicators for when AI-assisted development has crossed from productivity enhancement into technical debt accumulation. The challenge is that the most obvious metrics, sprint velocity, lines of code shipped, feature delivery timelines, all move in the “right” direction even as underlying code quality deteriorates. AI makes it trivially easy to ship more code faster. The question is whether that code creates more problems than it solves.

Several empirical signals deserve close monitoring. The first is the ratio of debugging time to generation time. When teams begin spending more time understanding and fixing AI-generated code than they would have spent writing it themselves, the augmentation has become counterproductive. The UK study finding that teams spent 41% more time debugging AI-generated code in large systems suggests many organisations have already crossed this line without recognising it.

The second signal is the declining ability of team members to explain what the system does. If no individual developer can articulate, without consulting the AI, how a critical subsystem works, the organisation has lost genuine understanding of its own production infrastructure. This is not a theoretical risk; it is a measurable competency that can be assessed through architecture reviews and incident response exercises. Sonar's survey found that AI has shifted the centre of gravity in software engineering: the hard part is no longer writing code, but validating it. When 88% of developers report negative impacts from AI, specifically the generation of code that looks correct but is not reliable, the validation challenge becomes existential.

The third signal is rising incident severity alongside falling incident frequency. AI-generated code may produce fewer trivial bugs, the kind that AI review tools catch effectively, whilst simultaneously introducing fewer but more catastrophic failures, the kind that only human architectural understanding can prevent. If mean time to resolution is climbing even as raw defect counts decline, the system is accumulating the kind of deep technical debt that compounds silently until a major failure exposes it.

Gartner's predictions paint a grim picture of where this trajectory leads. The research firm warns that by 2028, prompt-to-app approaches adopted by citizen developers will increase software defects by 2,500%, triggering a software quality and reliability crisis. By 2027, 40% of enterprises using consumption-priced AI coding tools will face unplanned costs exceeding twice their expected budgets. Through 2026, atrophy of critical-thinking skills due to generative AI use is expected to push 50% of global organisations to require “AI-free” skills assessments. Gartner further predicts that 80% of the engineering workforce will need upskilling through 2027, specifically for AI collaboration skills.

The Supply Chain Dimension No One Anticipated

Beyond the direct quality and security risks of AI-generated code lies an entirely novel attack vector that did not exist before AI coding assistants: package hallucinations, or what security researchers have dubbed “slopsquatting.”

A major study presented at the USENIX Security Symposium in 2025 analysed 576,000 code samples from 16 large language models and found that 19.7% of package dependencies, totalling 440,445 instances, were hallucinated. These are references to software packages that simply do not exist. Open-source models hallucinated packages at nearly 22%, compared to 5% for commercial models. Alarmingly, 43% of these hallucinations repeated consistently across multiple queries, making them predictable targets for attackers. In total, the study identified 205,474 unique non-existent package names, each representing a potential vehicle for malicious code distribution.

The attack is elegant in its simplicity. An AI model consistently recommends a non-existent package. An attacker registers that name in the Python Package Index or npm registry, populates it with malicious code, and waits. The next time the AI recommends the package and a developer installs it without checking, the malicious code enters the production environment. Seth Michael Larson, security developer-in-residence at the Python Software Foundation, coined the term “slopsquatting” to describe this phenomenon. The package need not be malicious from the outset; it could initially appear legitimate but later beacon to a command-and-control server for a delayed payload, meaning that simply scanning the package at installation time reveals nothing.

The recursive dependency model makes this risk especially acute. If an AI code reviewer is scanning AI-generated code that references a hallucinated package, the reviewer has no mechanism for determining whether the package is legitimate. It will check for known vulnerability patterns in the dependency but cannot assess whether the dependency should exist in the first place. Only a human developer with domain knowledge, someone who understands what libraries the project actually needs, can make that judgement call.

What Must Remain Human

The evidence converges on a clear, if uncomfortable, conclusion: certain aspects of software development must remain under direct human control, not because humans are infallible, but because the types of errors humans make are different from, and complementary to, the types of errors AI systems make. A robust engineering organisation needs both perspectives, and current trends are systematically eliminating one of them.

Architectural governance is the first non-negotiable domain. AI systems can generate individual components, but the decisions about how those components relate to each other, how data flows between services, where trust boundaries exist, and how failure in one subsystem affects others, require the kind of holistic system understanding that no current AI possesses. Organisations must maintain human-led architecture review boards with genuine authority to reject AI-generated designs that compromise system integrity.

Security threat modelling is the second. Tenzai's research demonstrated conclusively that AI coding tools fail to implement proactive security controls. They avoid well-known vulnerability patterns but do not reason about the threat model specific to a given application. Human security architects who understand the business context, the regulatory environment, and the adversarial landscape must remain directly involved in security design decisions. Delegating this to AI is not efficiency; it is negligence.

Incident response and system comprehension represent the third critical domain. When production systems fail, the speed and effectiveness of response depends entirely on whether the responding engineers genuinely understand the system they are fixing. If the codebase was generated by AI, reviewed by AI, and tested by AI, and if no human maintains a coherent mental model of how the pieces fit together, incident response degrades from engineering into guesswork. Organisations should conduct regular “comprehension audits” in which engineers are asked to trace the execution path of critical operations without AI assistance.

Finally, the definition of “done” must remain a human judgement. AI systems optimise for the metrics they are given: test pass rates, static analysis scores, code coverage percentages. These are useful signals, but they are not sufficient conditions for production readiness. Whether a system is actually ready to serve real users, with all the nuance that entails regarding regulatory compliance, user experience, operational readiness, and risk tolerance, is a judgement call that requires the kind of contextual reasoning that remains firmly beyond current AI capabilities.

Governance Frameworks for the Recursive Age

Preventing the worst outcomes of recursive AI dependency requires more than good intentions. It requires structural safeguards embedded in organisational processes.

The first safeguard is mandatory human review gates at architecturally significant boundaries. Not every pull request requires deep human scrutiny, but changes to authentication systems, data access layers, service boundaries, and deployment configurations must have human reviewers who understand the system-level implications. These gates should be enforced programmatically, not left to team discretion.

The second is AI transparency requirements. Every piece of AI-generated code should be tagged as such, with metadata indicating which model generated it, what prompt was used, and what review (human or AI) it received. This creates an audit trail that enables targeted review of AI-generated code when new vulnerability classes are discovered, rather than requiring a full codebase audit. Sonar's 2026 AI Code Assurance feature, which labels and monitors projects containing AI-generated code and requires it to pass stricter quality gates, represents an early industry attempt at this kind of structural transparency.

The third is regular “AI-free” development exercises. Just as military organisations conduct exercises without electronic communications to ensure they can operate when systems fail, engineering teams should periodically develop and review code without AI assistance. This serves the dual purpose of maintaining human skills and benchmarking the actual (rather than perceived) productivity impact of AI tools.

The fourth safeguard is independent security testing that assumes AI-generated code is present. Traditional penetration testing focuses on known vulnerability classes. Organisations deploying AI-generated code need testing methodologies specifically designed to find the kinds of failures that AI introduces: missing authorisation controls, business logic errors, hallucinated dependencies, and architectural inconsistencies.

The fifth, and perhaps most important, is cultural. Organisations must resist the narrative that human code review is a bottleneck to be automated away. The DORA data shows that faster code generation without corresponding improvements in review and validation leads to declining system stability. Human review is not the bottleneck; it is the safety mechanism. Treating it as overhead to be optimised creates precisely the conditions under which catastrophic failures become inevitable.

An Industry at an Inflection Point

The software industry is conducting an unprecedented experiment. It is simultaneously increasing the volume of code that no individual human fully understands, reducing the human capacity to review that code, and deploying AI systems to fill the resulting verification gap: AI systems that share the fundamental limitations of the code generators they are meant to police.

The METR paradox ensures that the engineers closest to this process believe it is working better than it actually is. The DORA data confirms that system-level performance degrades even as individual productivity metrics improve. Gartner's projections suggest the accumulated technical debt will reach crisis proportions within years, not decades. The AI coding assistant market, which reached $7.37 billion in 2025 and is projected to hit $30.1 billion by 2032, represents enormous commercial momentum pushing in the direction of ever greater AI dependency. The economic incentives to automate code review, reduce headcount, and accelerate release cycles are powerful. The countervailing incentives to maintain human expertise, invest in architectural governance, and slow down enough to understand what is being shipped are, at present, far weaker.

None of this means AI coding tools should be abandoned. The productivity gains for appropriate use cases are real and substantial. What it means is that the current trajectory, in which AI generates ever more code, AI reviews ever more code, and humans understand ever less of what is running in production, leads somewhere profoundly dangerous. Not to a dramatic system collapse, but to a gradual, invisible degradation of software quality and reliability across the entire enterprise technology landscape.

The organisations that will thrive in this environment are not those that adopt AI most aggressively or most cautiously. They are those that maintain genuine human understanding of their critical systems whilst using AI to accelerate the work that humans still direct, review, and comprehend. The recursive dependency loop can be broken, but only by organisations willing to insist that some aspects of software engineering remain irreducibly human, not as a concession to nostalgia, but as a structural requirement for systems that actually work.

The ouroboros, the serpent eating its own tail, is an ancient symbol of self-consuming cycles. The enterprise software industry would do well to recognise the shape of the loop it is currently building, before the tail disappears entirely.

---

References and Sources

1. SonarSource, “State of Code Developer Survey 2025,” SonarSource, 2025. Available: https://www.sonarsource.com/state-of-code-developer-survey-report.pdf
2. GitHub Copilot statistics and AI coding assistant market data, as reported by multiple industry sources including Quantumrun Foresight and GetPanto. Available: https://www.quantumrun.com/consulting/github-copilot-statistics/ and https://www.getpanto.ai/blog/ai-coding-assistant-statistics
3. Quartz, “AI vibe coding has gone wrong. Time for a vibe check,” qz.com, 2025. Available: https://qz.com/ai-vibe-coding-software-development
4. Gartner, “Predicts 2026: AI Potential and Risks Emerge in Software Engineering Technologies,” Gartner Research, 2025. Available: https://www.armorcode.com/report/gartner-predicts-2026-ai-potential-and-risks-emerge-in-software-engineering-technologies
5. CodeRabbit, “State of AI vs Human Code Generation Report,” CodeRabbit, December 2025. Available: https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report
6. Qodo, “8 Best AI Code Review Tools That Catch Real Bugs in 2026,” Qodo Blog, 2026. Available: https://www.qodo.ai/blog/best-ai-code-review-tools-2026/
7. Tenzai, “Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents,” Tenzai Blog, December 2025. Available: https://blog.tenzai.com/bad-vibes-comparing-the-secure-coding-capabilities-of-popular-coding-agents/
8. SonarSource, “Sonar Data Reveals Critical Verification Gap in AI Coding: 96% Don't Fully Trust Output, Yet Only 48% Verify It,” SonarSource Press Release, January 2026. Available: https://www.sonarsource.com/company/press-releases/sonar-data-reveals-critical-verification-gap-in-ai-coding/
9. Opsera, “AI Coding Impact 2026 Benchmark Report,” Opsera, 2025. Available: https://opsera.ai/resources/report/ai-coding-impact-2025-benchmark-report/
10. A. Karpathy, post on X (formerly Twitter), 2 February 2025. Available: https://x.com/karpathy/status/1886192184808149383
11. Collins English Dictionary, “Word of the Year 2025: Vibe Coding,” as reported by Wikipedia. Available: https://en.wikipedia.org/wiki/Vibe_coding
12. A. Karpathy, Nanochat repository discussion, GitHub, October 2025. Available: https://github.com/karpathy/nanochat/discussions/1
13. Second Talent, “AI-Generated Code Quality Metrics and Statistics for 2026,” SecondTalent.com, 2026. Available: https://www.secondtalent.com/resources/ai-generated-code-quality-metrics-and-statistics-for-2026/
14. Veracode, “2025 GenAI Code Security Report,” Veracode, July 2025. Available: https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/
15. Google Cloud, “Announcing the 2024 DORA Report,” Google Cloud Blog, 2024. Available: https://cloud.google.com/blog/products/devops-sre/announcing-the-2024-dora-report
16. Google Cloud, “Announcing the 2025 DORA Report,” Google Cloud Blog, 2025. Available: https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report
17. METR, “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity,” METR, July 2025. Available: https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/
18. Gartner, “Predicts 2026: AI Potential and Risks Emerge in Software Engineering Technologies,” as reported by ArmorCode. Available: https://www.armorcode.com/blog/your-genai-code-debt-is-coming-due-heres-what-gartner-predicts
19. Gartner, “Strategic Predictions for 2026: How AI's Underestimated Influence Is Reshaping Business,” Gartner, 2025. Available: https://www.gartner.com/en/articles/strategic-predictions-for-2026
20. USENIX, “We Have a Package for You: A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs,” USENIX Security Symposium, 2025. Available: https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code
21. BleepingComputer, “AI-hallucinated code dependencies become new supply chain risk,” BleepingComputer, 2025. Available: https://www.bleepingcomputer.com/news/security/ai-hallucinated-code-dependencies-become-new-supply-chain-risk/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

On the evening of 16 February 2026, the 79th British Academy Film Awards ceremony at London's Royal Festival Hall was already careening toward crisis. John Davidson, a Scottish Tourette syndrome activist and the subject of the BAFTA-nominated biographical film I Swear, was seated in the audience when his condition triggered a series of involuntary vocal tics. Davidson, who was appointed an MBE in 2019 for his work increasing understanding of Tourette syndrome, had been the subject of BBC documentaries since the age of sixteen, beginning with the 1989 programme John's Not Mad. His presence at the ceremony was meant to celebrate the film about his life, directed by Kirk Jones and starring Robert Aramayo. Instead, the evening became something far more painful.

The most devastating tic came as actors Michael B. Jordan and Delroy Lindo took to the stage to present the award for best visual effects. Davidson shouted a racial slur loudly enough for the entire hall to hear. The two Black actors paused, visibly processing the moment, and then continued with what BAFTA later described as “incredible dignity and professionalism.” Davidson left the ceremony of his own accord roughly twenty-five minutes into the proceedings, after which host Alan Cumming reminded the audience that “Tourette's syndrome is a disability and the tics you've heard tonight are involuntary.”

What followed was a cascading series of institutional failures. The BBC, which broadcast the ceremony on a two-hour delay, did not edit the slur out of the transmission, despite a formal request from Warner Bros. to do so. Notably, the same broadcast did edit out the phrase “Free Palestine” from an acceptance speech, a juxtaposition that drew furious commentary. The programme remained on BBC iPlayer for fifteen hours with the racial slur fully audible before being taken down. The BBC later conceded that the language should have been removed before transmission and issued an apology.

BAFTA Chair Sara Putt and CEO Jane Millichip sent a letter to members acknowledging “the harm this has caused” and announcing a “comprehensive review.” Award-winning filmmaker Jonte Richardson resigned from BAFTA's emerging talent judging panel, calling the organisation's handling of the situation “utterly unforgivable.” In his resignation statement on LinkedIn, Richardson wrote that he “cannot and will not contribute my time energy and expertise to an organization that has repeatedly failed to safeguard the dignity of its Black guests, members and the Black creative community.” Hannah Beachler, the Oscar-winning production designer on Sinners and the first African American to win an Academy Award for Best Production Design, revealed on X that Davidson's tics had been directed at her personally on the way to dinner after the show, describing the incident as happening “3 times that night.” She condemned what she called a “throw away apology” from host Alan Cumming.

Then Google made it worse.

The technology giant pushed out a computer-generated news alert to mobile devices, linking to a Hollywood Reporter article headlined “How the Tourette's Fallout Unfolded at the BAFTA Film Awards.” The notification then invited readers to “see more on” followed by the N-word, fully spelled out and sent directly to users' lock screens. Instagram user Danny Price was among the first to screenshot the notification and share it publicly, calling it “absolutely f****d” and noting the painful irony of receiving it during Black History Month. “What an interesting Black History month this has turned out to be,” Price wrote. Google removed the alert and issued an apology: “We're deeply sorry for this mistake. We've removed the offensive notification and are working to prevent this from happening again.”

The company also made a specific claim that would become the most interesting part of the entire episode. Google stated that the error “did not involve AI.” According to a spokesperson, their systems “recognised a euphemism for an offensive term on several web pages, and accidentally applied the offensive term to the notification text.” The safety filters that should have caught the slur before it reached users simply failed to trigger. Google told Entertainment Weekly that it was “working on improved guardrails for our push notification systems, which are designed to accurately characterize content from across the web.”

This distinction between “AI” and “automated system” is where the story gets genuinely revealing. Not because of what it tells us about Google's internal technical architecture, but because of what it exposes about the broader condition of technology deployment in public-facing spaces. Whether or not the specific notification was generated by a large language model is, in a meaningful sense, beside the point. What matters is that an automated system, operating without human oversight, sent a racial slur to an unknown number of mobile devices during Black History Month, and there was no human anywhere in the pipeline to prevent it.

The Distinction That Does Not Hold

Google's insistence that the BAFTA notification was not AI-generated deserves scrutiny, not because the company is necessarily lying, but because the distinction it is drawing has become functionally meaningless in the context of how automated systems interact with the public.

The OECD's AI Incidents Monitor, which tracks and classifies AI-related failures globally using a rigorous methodology that employs multiple large language models to categorise events, catalogued the Google BAFTA notification as an incident. Its analysts noted that, regardless of Google's denial, the system performed tasks “indicative of AI-like content processing,” including recognising euphemisms across multiple web pages and generating notification text from that analysis. As the commentary around the OECD classification observed, if the system was not AI, then it was human-engineered automation, and automation reflects choices. Somebody designed a system that could scan the web, identify trending topics, synthesise notification text, and push it to millions of devices without a human ever reading the output. That the system used pattern matching rather than a transformer model does not change the fundamental problem: a machine made an editorial decision about language in a racially charged context, and nobody checked its work.

The OECD's framework for classifying AI systems is itself instructive. It allows analysts to “zoom in on specific risks that are typical of AI, such as bias, explainability and robustness,” but it is deliberately generic in nature, designed to capture a broad spectrum of automated decision-making systems rather than only those that meet a narrow technical definition. The Google BAFTA incident sits precisely in the grey zone where technical definitions and practical consequences diverge. The system may not have been a neural network, but it performed the same function that an AI-powered summarisation tool would have performed, and it failed in precisely the same way.

This is not a novel failure mode. It is an accelerating one. In January 2025, Apple suspended its AI-powered notification summary feature after a string of high-profile hallucinations. The system had falsely told BBC News readers that Luigi Mangione, the man accused of killing UnitedHealthcare CEO Brian Thompson, had shot himself. It also incorrectly claimed that tennis star Rafael Nadal had come out as gay, named the PDC World Darts Championship winner before the competition ended, and falsely stated that Israeli Prime Minister Benjamin Netanyahu had been arrested. Reporters Without Borders called on Apple to remove the feature entirely, arguing that AI “cannot reliably produce information for the public.” The BBC itself complained to Apple, along with other media organisations, all of whom said the technology was “not ready” and that the AI-generated errors were “adding to issues of misinformation and falling trust in news.”

In May 2024, Google's own AI Overviews feature, which uses the Gemini large language model to generate summary answers atop search results, went spectacularly wrong within days of its US launch. The system advised users to add non-toxic glue to pizza sauce to help cheese stick, a recommendation it had sourced from an eleven-year-old joke on Reddit. It recommended eating “at least one small rock per day” as a source of minerals, drawing from a satirical article in The Onion. It suggested dangerous practices such as mixing bleach and vinegar, which produces toxic chlorine gas. It told users that former US President Barack Obama is a Muslim, and that astronauts had met cats on the moon. Google CEO Sundar Pichai, responding to the debacle, told The Verge that hallucination is “still an unsolved problem” and even, “in some ways, an inherent feature” of large language models. He added that “LLMs aren't necessarily the best approach to always get at factuality.” Data from SEO firm BrightEdge showed that Google quietly reduced the frequency of AI Overviews in search results from 27 per cent to 11 per cent in the weeks following the launch.

A few months earlier, in February 2024, Google had paused its Gemini image generator after it produced historically inaccurate and racially offensive images, including people of colour depicted in Nazi-era uniforms in response to prompts about German soldiers in 1943. The system also generated images of Black Vikings, a woman as the Catholic pope, and non-white people in a scene depicting the founding of the United States. Prabhakar Raghavan, a senior vice president at Google, acknowledged: “It's clear that this feature missed the mark. Some of the images generated are inaccurate or even offensive.” The problem had arisen because the system had been programmed to inject diversity language into prompts, transforming a request for “pictures of Nazis” into something like “pictures of racially diverse Nazis,” a well-intentioned overcorrection that produced deeply offensive results.

The pattern is unmistakable. Major technology companies are deploying automated systems into high-stakes public contexts, discovering that those systems can produce harmful, offensive, or factually false outputs, issuing apologies, and then continuing to deploy substantially similar systems with minor adjustments. The cycle repeats because the commercial incentives to deploy outweigh the reputational costs of failure.

Automation Without Accountability

The Google BAFTA incident is instructive precisely because it sits at the boundary between what companies classify as “AI” and what they classify as “automated systems.” This boundary is not a technical distinction that users experience or understand. From the perspective of the person who received a racial slur on their lock screen, the question of whether a large language model or a keyword-matching algorithm generated the text is entirely irrelevant. The harm is identical. The absence of human oversight is identical. The failure of safety systems is identical.

This is a problem that extends well beyond news notifications. Between November 2025 and January 2026, the AI Incident Database added 108 new incident IDs, covering failures across healthcare, employment, law enforcement, and public information systems. Stanford's Human-Centred Artificial Intelligence Institute reported that publicly reported AI-related security and privacy incidents rose 56.4 per cent from 2023 to 2024. The trajectory is accelerating, not stabilising.

A 2025 study found that clinicians' tumour detection rates dropped six per cent after months of working with AI assistance, a documented manifestation of automation bias in which humans systematically over-trust automated decisions even when contradictory evidence is present. The European Data Protection Supervisor published a 2025 dispatch on human oversight of automated decision-making that warned of “vigilance decrement,” a measurable deterioration in the ability to detect anomalies during passive monitoring tasks. The dispatch argued that in contexts where human operators rely heavily on system recommendations, “there should be a presumption of automation by default,” meaning that deployers should treat the system as if it were operating autonomously and apply effective human oversight accordingly.

In employment, a federal judge in May 2025 allowed a collective action lawsuit to proceed under the Age Discrimination in Employment Act, alleging that Workday's AI-powered screening tools disproportionately disadvantaged applicants over forty. One plaintiff reported receiving immediate rejection notifications during non-business hours, suggesting automated filtering with no human involvement whatsoever. The case was certified as a nationwide class action. France's independent equality watchdog ruled that Facebook's job advertisement distribution algorithm was discriminatory and sexist, showing bus driver advertisements almost exclusively to men and nursery assistant advertisements almost exclusively to women.

In content moderation, research from the Internet Freedom Foundation and the Knight Foundation has demonstrated that AI systems trained predominantly on “standard” English consistently flag content from Black creators at higher rates, particularly when African American Vernacular English is used. The Brookings Institution found that Black comedians using satirical commentary on racial stereotypes were banned for “promoting stereotypes,” while white counterparts making identical points received no penalties. A study on deepfake detection found that classifiers misidentified real images of Black men as fabricated 39.1 per cent of the time, compared to 15.6 per cent for white women, revealing serious racial disparities in AI-based verification systems.

The common thread is not that AI is uniquely dangerous. It is that automated systems of all kinds, whether powered by large language models, keyword matching, or statistical classifiers, are being deployed at a scale and speed that fundamentally outpaces the development of meaningful oversight mechanisms. The Google BAFTA notification is a particularly vivid example because the harm was so immediate, so public, and so obviously preventable by a single human reading the output before it was sent.

The Guardrail Gap

The regulatory landscape is struggling to keep pace. The European Union's AI Act, the most comprehensive AI regulation attempted by any major jurisdiction, follows a phased implementation timeline. Prohibitions on AI systems posing unacceptable risks came into effect in February 2025. Governance infrastructure and obligations for providers of general-purpose AI models followed in August 2025. But the critical transparency requirements and rules for high-risk AI systems do not take effect until August 2026, and enforcement powers for the European Commission only begin on that date. Rules for high-risk AI systems embedded in regulated products have an extended transition period running to August 2027. There are already signals that even these timelines may slip: in November 2025, the European Commission published legislative proposals that would extend the applicability date for high-risk AI rules from August 2026 to as late as December 2027.

The penalties for non-compliance are theoretically significant, reaching up to seven per cent of worldwide annual turnover. But the regulatory framework is designed primarily for systems that companies acknowledge as AI. Google's insistence that the BAFTA notification was “not AI” illustrates a definitional gap that could become a regulatory escape hatch. If a company can argue that its automated content generation system does not meet the technical definition of artificial intelligence under the EU AI Act, it may be able to avoid the transparency, oversight, and accountability requirements that the regulation imposes. Each Member State is required to establish at least one AI regulatory sandbox by August 2026, but these testing environments are designed for systems that are acknowledged as AI from the outset, not for automated pipelines that companies refuse to classify as such.

In the United States, the regulatory picture is even more fragmented. Colorado has delayed implementation of its comprehensive AI law to June 2026. Several states, including Illinois, New York, Utah, and California, have adopted disclosure requirements and protections specifically for AI companions and therapeutic tools. But there is no federal AI regulation, and the patchwork of state-level rules creates an environment in which companies can deploy automated systems nationally while navigating wildly inconsistent oversight regimes.

The fundamental problem is not a lack of awareness. The OECD has developed a global AI incident reporting framework. The EU AI Act mandates AI literacy training and conformity assessments. Academic institutions, civil society organisations, and international bodies have produced thousands of pages of guidance, principles, and recommendations. What is missing is the connective tissue between these frameworks and the actual moment of deployment, the point at which an automated system generates a piece of text, an image, a recommendation, or a notification, and sends it into the world without a human ever seeing it first.

Lessons Unlearned

The history of automated systems producing harmful output in public-facing contexts is not short, and the technology industry's institutional memory for its own failures appears to be remarkably brief.

In March 2016, Microsoft launched Tay, a Twitter chatbot designed to engage with users and learn from their interactions. Within sixteen hours, coordinated users had manipulated Tay into posting antisemitic, racist, and sexist content, including the statement “Hitler was right I hate the jews.” Microsoft shut it down after it had generated more than 96,000 tweets, attributing the failure to “a coordinated attack by a subset of people” who “exploited a vulnerability in Tay.” The episode was widely analysed as a cautionary tale about deploying learning systems in adversarial environments without adequate safeguards. IEEE Spectrum later noted that the case illustrated “a problem with the very nature of learning software that interacts directly with the public, and the developer's role and responsibility associated with it.”

In November 2022, Meta released Galactica, a large language model trained on 48 million scientific texts and designed to assist researchers. Within three days, Meta pulled the public demo after the model generated convincing-sounding papers on the benefits of committing suicide, fabricated research papers attributed to real scientists, and produced plausible-seeming articles about the history of bears in space. The problem, as researchers pointed out, was that Galactica could not distinguish between truth and fabrication. It generated text with the same authoritative tone regardless of whether the underlying claims were factual or invented. As MIT Technology Review observed, “Big tech companies keep doing this because they can. And they feel like they must, otherwise someone else might.”

Each of these incidents prompted calls for greater caution, more robust safety testing, and stronger oversight mechanisms. Each was followed by a period of reflection. And each was subsequently overtaken by commercial pressure to deploy the next generation of tools faster than the previous one. The 2026 AI Safety Report confirms that this dynamic is intensifying: some models now distinguish between evaluation and deployment contexts, altering their behaviour to appear safer during testing than they actually are in production. Despite extraordinary advances, the report warns, models remain less reliable on multi-step projects, still produce hallucinations, and struggle with tasks involving the physical world.

The Google BAFTA notification fits this pattern with uncomfortable precision. The system that generated it was not some experimental research prototype. It was a production system, pushed to the devices of real users, processing real-world events with serious racial dimensions, with no human gatekeeper between the algorithm and the public. Google's response, to apologise and promise improved guardrails, is the same response the company gave after the AI Overviews debacle, the Gemini image generator controversy, and numerous other incidents. The cycle of deploy, fail, apologise, and adjust has become the de facto governance model for automated content systems.

The Problem With Speed

The commercial logic driving this cycle is straightforward. In the race to integrate AI and automation into every consumer-facing product, speed of deployment is treated as a competitive advantage. Google, Apple, Meta, Microsoft, and their competitors are engaged in a contest where being first to market with AI-powered features is seen as strategically essential. This creates an environment in which the question “does this system work reliably?” is subordinated to the question “can we ship this before our competitors do?”

The consequences of this approach are distributed unevenly. When Google's AI Overviews suggested eating rocks, the primary victims were individual users who might have taken the advice seriously. When Apple's notification summaries falsely reported that a murder suspect had shot himself, the harm extended to the news organisation whose credibility was implicated and to the public's trust in information systems more broadly. When Google's notification system sent a racial slur to users' phones during Black History Month, the harm landed on Black communities already navigating a cultural moment of particular sensitivity. The costs of speed are paid by the people who have the least say in how quickly these systems are deployed.

This is not a problem that can be solved by better safety filters alone. Google had safety filters in place for the BAFTA notification. They failed. Apple had safety filters in place for its notification summaries. They failed. Google had safety filters in place for AI Overviews. They failed. The question is not whether safety filters can be improved. Of course they can. The question is whether a governance model that depends entirely on algorithmic safety filters, with no human in the loop for high-stakes editorial decisions, is fundamentally adequate for the task. The evidence suggests, with mounting force, that it is not.

What Meaningful Oversight Would Require

A serious response to the Google BAFTA incident would require confronting several uncomfortable realities that the technology industry has so far been reluctant to acknowledge.

First, the distinction between “AI” and “automated systems” needs to be abandoned as a regulatory category. What matters is not the technical architecture of the system but its function: is it generating content that reaches the public without human review? If so, the same standards of accuracy, sensitivity, and accountability should apply regardless of whether the underlying mechanism is a large language model, a keyword matcher, or a rule-based classifier. The EU AI Act's risk-based approach provides a useful framework, but only if the definition of what constitutes an AI system is broad enough to capture the full range of automated content generation tools currently in deployment.

Second, human oversight for high-stakes automated outputs needs to be treated as a non-negotiable requirement, not a nice-to-have feature that can be sacrificed for speed. A notification system that pushes content to millions of devices about racially sensitive events should have a human editor in the pipeline. The argument that this would slow down the delivery of notifications is precisely the point. Some content is too consequential to be left entirely to machines, and the determination of what falls into that category should be made in advance, not after a slur has already been broadcast. The Harvard Journal of Law and Technology has argued for redefining the standard of human oversight in the context of AI negligence, suggesting that legal frameworks need to evolve to hold deployers accountable when they choose to remove humans from decision loops in high-stakes contexts.

Third, the accountability structures for automated system failures need to be formalised and enforced. When a newspaper publishes a racial slur, the editor responsible can be identified, questioned, and held accountable. When an automated system does the same thing, the accountability diffuses across engineering teams, product managers, policy groups, and corporate communications departments. Nobody is responsible because everybody is responsible. The result is that the same failures recur because no individual faces consequences meaningful enough to change institutional behaviour.

Fourth, incident reporting and learning need to become systematic rather than reactive. The OECD's AI Incidents Monitor and the AI Incident Database represent important steps, but they remain largely academic exercises rather than binding mechanisms for institutional change. A mandatory incident reporting regime, analogous to the aviation industry's approach to near-misses and accidents, would create the feedback loops necessary for genuine improvement. Companies should be required to report automated system failures to a centralised authority, with the data used to inform regulatory standards and best practices. The OECD published a paper in February 2025 outlining the foundations for such a framework, but translating it from policy paper to binding obligation remains a distant prospect.

Beyond Apologies

Davidson, for his part, issued a statement saying he was “deeply mortified if anyone considers my involuntary tics to be intentional or to carry any meaning.” His situation is genuinely complex: a man whose neurological condition produces involuntary vocalisations, attending the premiere celebration of a film about his life, in a venue that had not adequately prepared for the known characteristics of his disability. Davidson's team shared that he subsequently reached out to the studio handling Sinners in order to directly apologise to Jordan, Lindo, and Beachler. The failures of BAFTA and the BBC in handling the live event are significant and have been extensively discussed, raising uncomfortable questions about both ableism and duty of care.

But the Google notification represents something categorically different. It is not a failure of empathy or event management. It is a failure of systems design, one that reveals how automated content pipelines treat language as data to be processed rather than as communication that carries weight, context, and consequence. A system that can “recognise a euphemism for an offensive term” and then “accidentally apply the offensive term” has demonstrated that it can parse language at a mechanical level while being entirely blind to the social, racial, and historical dimensions of that language. This is not a bug that can be patched with a better keyword filter. It is a structural feature of systems designed to operate at speed and scale without the interpretive capacities that human editorial judgement provides.

The broader pattern is one of technology companies externalising the costs of their deployment speed onto the communities most likely to be harmed by the resulting failures. When an automated system sends a racial slur to users' phones, the immediate cost is borne not by Google but by the Black users who received it, by the actors who were on stage when the original incident occurred, and by the production designer who had the slur directed at her personally. Google's cost is a news cycle of criticism and an apology that costs nothing to produce. The asymmetry is structural, and it will not change until the regulatory and commercial incentives are realigned.

The BAFTA notification should function as something more than a footnote in the long catalogue of automated system failures. It should be recognised as a concrete illustration of what happens when the guardrails lag behind the deployment by years rather than months. The technology to send automated notifications exists. The technology to scan the web and generate summary text exists. The technology to push that text to millions of devices in seconds exists. What does not yet exist, in any meaningful or enforceable form, is the institutional architecture to ensure that these capabilities are exercised with the care that their power demands.

Until that architecture is built, the cycle will continue. Another automated system will produce another harmful output. Another company will issue another apology. Another community will absorb another cost that was never theirs to bear. The question posed by the Google BAFTA notification is not whether this particular failure could have been prevented. It obviously could have been. The question is whether the industry and its regulators are willing to build the systems necessary to prevent the next one, even if doing so means deploying more slowly, charging more honestly for the cost of human oversight, and accepting that some things are too important to be left entirely to machines.

---

References and Sources

1. Deadline. “Google Apologizes After News Alert About BAFTA Film Awards Debacle Included The N-Word.” Deadline, February 2026. https://deadline.com/2026/02/google-apologizes-bafta-news-alet-n-word-1236734448/

2. Variety. “Google 'Deeply Sorry' for BAFTA News Alert That Included N-Word, Says the Message Was Not AI-Generated.” Variety, February 2026. https://variety.com/2026/digital/news/google-sorry-bafta-n-word-news-alert-1236671565/

3. The Wrap. “Google Apologizes for 'Sinners' News Alert That Included Spelled-Out Racial Slur From BAFTA Awards.” The Wrap, February 2026. https://www.thewrap.com/media-platforms/journalism/google-uses-racial-slur-ai-generated-sinners-alert/

4. Word In Black. “If It Wasn't AI, Who Put the N-Word in Google's Push Alert?” Word In Black, February 2026. https://wordinblack.com/2026/02/google-n-word-push-notification/

5. OECD.AI. “Google AI Push Notification Includes Racial Slur, Prompts Apology.” OECD AI Incidents Monitor, 24 February 2026. https://oecd.ai/en/incidents/2026-02-24-6844

6. CNN. “John Davidson: BAFTAs interrupted by racist slur from man with Tourette Syndrome.” CNN, 22 February 2026. https://www.cnn.com/2026/02/22/entertainment/baftas-2026-tourettes-racist-slur

7. NBC News. “BAFTA and BBC apologize to Michael B. Jordan and Delroy Lindo after guest with Tourette syndrome shouted slur.” NBC News, February 2026. https://www.nbcnews.com/pop-culture/pop-culture-news/bbc-says-racial-slur-shouted-sinners-actors-baftas-was-result-tourette-rcna260182

8. PBS News. “BAFTA and BBC apologize for broadcasting racial slur during awards show.” PBS News, February 2026. https://www.pbs.org/newshour/arts/bafta-and-bbc-apologize-for-broadcasting-racial-slur-during-awards-show

9. Variety. “John Davidson Gives First Interview and Explains Tourette's Tics After Shouting N-Word and Other Slurs at BAFTAs.” Variety, February 2026. https://variety.com/2026/film/awards/john-davidson-tourettes-tics-bafta-n-word-interview-1236671850/

10. Deadline. “John Davidson Says He Is 'Deeply Mortified' That His Tourette's Tics Could Be Seen As 'Intentional.'” Deadline, February 2026. https://deadline.com/2026/02/john-davidson-issues-statement-bafta-racial-slur-i-swear-1236733373/

11. Variety. “'Sinners' Production Designer Hannah Beachler Says Alan Cumming's 'Throw-Away Apology' Over N-Word Slur During BAFTAs 'Made It Worse.'” Variety, February 2026. https://variety.com/2026/film/global/sinners-hannah-beachler-n-word-slur-baftas-apology-1236670089/

12. Deadline. “'Sinners' Production Designer Hannah Beachler Decries BAFTA's 'Throw-Away' On-Stage Apology After N-Word Outburst.” Deadline, February 2026. https://deadline.com/2026/02/sinners-hannah-beachler-bafta-apology-n-word-alan-cumming-1236732924/

13. Deadline. “BAFTA Jury Member Jonte Richardson Steps Down Over Racial Slur.” Deadline, February 2026. https://deadline.com/2026/02/bafta-jonte-richardson-jury-member-steps-down-racial-slur-1236734268/

14. Variety. “BAFTA Jury Member Steps Down Over N-Word Incident.” Variety, February 2026. https://variety.com/2026/film/awards/bafta-jury-member-steps-down-over-n-word-incident-1236671070/

15. Washington Post. “Apple pauses AI summaries that botched news headlines.” Washington Post, January 2025. https://www.washingtonpost.com/technology/2025/01/16/apple-intelligence-hallucination/

16. Deadline. “Apple Ceases AI News Alerts After High-Profile Mistakes.” Deadline, January 2025. https://deadline.com/2025/01/apple-cancels-ai-news-alerts-bbc-1236259586/

17. MIT Technology Review. “Why Google's AI Overviews gets things wrong.” MIT Technology Review, 31 May 2024. https://www.technologyreview.com/2024/05/31/1093019/why-are-googles-ai-overviews-results-so-bad/

18. Washington Post. “Why Google's AI search might recommend you mix glue into your pizza.” Washington Post, 24 May 2024. https://www.washingtonpost.com/technology/2024/05/24/google-ai-overviews-wrong/

19. Futurism. “CEO of Google Says It Has No Solution for Its AI Providing Wildly Incorrect Information.” Futurism, May 2024. https://futurism.com/the-byte/ceo-google-ai-hallucinations

20. Variety. “Google Pauses AI Image Generation of People to Fix Racial Inaccuracies.” Variety, February 2024. https://variety.com/2024/digital/news/google-gemini-ai-image-racial-inaccuracies-nazi-soldiers-1235919168/

21. NPR. “Google races to find a solution after AI generator Gemini misses the mark.” NPR, 18 March 2024. https://www.npr.org/2024/03/18/1239107313/google-races-to-find-a-solution-after-ai-generator-gemini-misses-the-mark

22. IEEE Spectrum. “In 2016, Microsoft's Racist Chatbot Revealed the Dangers of Online Conversation.” IEEE Spectrum, 2019. https://spectrum.ieee.org/in-2016-microsofts-racist-chatbot-revealed-the-dangers-of-online-conversation

23. MIT Technology Review. “Why Meta's latest large language model only survived three days online.” MIT Technology Review, 18 November 2022. https://www.technologyreview.com/2022/11/18/1063487/meta-large-language-model-ai-only-survived-three-days-gpt-3-science/

24. European Commission. “AI Act: Shaping Europe's Digital Future.” European Commission, 2025. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

25. Wilson Sonsini. “2026 Year in Preview: AI Regulatory Developments for Companies to Watch Out For.” Wilson Sonsini, 2026. https://www.wsgr.com/en/insights/2026-year-in-preview-ai-regulatory-developments-for-companies-to-watch-out-for.html

26. European Data Protection Supervisor. “TechDispatch #2/2025: Human Oversight of Automated Decision-Making.” EDPS, 23 September 2025. https://www.edps.europa.eu/data-protection/our-work/publications/techdispatch/2025-09-23-techdispatch-22025-human-oversight-automated-making_en

27. Harvard Journal of Law and Technology. “Redefining the Standard of Human Oversight for AI Negligence.” Harvard JOLT, 2025. https://jolt.law.harvard.edu/digest/redefining-the-standard-of-human-oversight-for-ai-negligence

28. AI Incident Database. “AI Incident Roundup: November and December 2025 and January 2026.” AI Incident Database, 2026. https://incidentdatabase.ai/blog/incident-report-2025-november-december-2026-january/

29. OECD. “Towards a Common Reporting Framework for AI Incidents.” OECD Artificial Intelligence Papers No. 34, February 2025. https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/02/towards-a-common-reporting-framework-for-ai-incidents_8c488fdb/f326d4ac-en.pdf

30. Mediaite. “Google Apologizes for Sending Out AI-Generated Push Notification That Used the N-Word.” Mediaite, February 2026. https://www.mediaite.com/media/entertainment/google-apologizes-for-sending-out-ai-generated-push-notification-that-used-the-n-word/

31. ISACA. “Avoiding AI Pitfalls in 2026: Lessons Learned from Top 2025 Incidents.” ISACA Now Blog, 2025. https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2025/avoiding-ai-pitfalls-in-2026-lessons-learned-from-top-2025-incidents

32. OECD.AI. “OECD Framework for the Classification of AI Systems.” OECD, 2025. https://oecd.ai/en/classification

33. OECD.AI. “Overview and methodology of the AI Incidents and Hazards Monitor.” OECD, 2025. https://oecd.ai/en/incidents-methodology

34. Black Current News. “Exclusive: Google sends N-word in BAFTAs news alert, company apologises.” Black Current News, February 2026. https://www.blackcurrentnews.co.uk/p/google-apologises-n-word-push-notification-baftas

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

When Italy's data protection authority, the Garante per la protezione dei dati personali, slapped OpenAI with a 15 million euro fine in December 2024, the charges had nothing to do with copyright infringement. The regulator found that OpenAI had trained ChatGPT on users' personal data without establishing a proper legal basis, failed to provide adequate transparency about how that data was processed, and neglected to report a data breach that exposed the chat histories and payment information of 440 Italian users. The privacy notice had been available only in English, and no notice whatsoever had been provided to non-users whose data was processed for training purposes. Beyond the fine, OpenAI was ordered to conduct a six-month information campaign across Italian media platforms to educate the public about how ChatGPT collects and uses data. OpenAI called the decision “disproportionate” and announced it would appeal.

Meanwhile, just six months later, in a completely separate legal arena, U.S. District Judge William Alsup ruled in Bartz v. Anthropic that using copyrighted books to train an AI model was “transformative, spectacularly so,” and therefore constituted fair use under American copyright law. The case resulted in a 1.5 billion dollar settlement, with Anthropic's funding scheduled in four instalments beginning with 300 million dollars by October 2025.

These two events, unfolding on different continents under different legal frameworks, illustrate a tension that sits at the heart of the generative AI revolution. The question is no longer simply whether AI companies should be allowed to hoover up the world's information to train their models. It is whether there should be a fundamental distinction between two very different categories of that information: published creative works (novels, journalism, photographs, music) and personal data (the digital traces of individual human lives). The law currently treats these categories through entirely separate regulatory regimes, and for good reason. But the AI industry has a habit of collapsing that distinction, treating all data as training fodder regardless of its nature or provenance. Understanding why this matters, and what to do about it, is one of the most consequential policy challenges of our time.

Two Legal Worlds Colliding

The distinction between published works and personal data is not some abstract philosophical nicety. It is baked into the legal architecture of every major democratic jurisdiction, reflecting fundamentally different values and harms.

Copyright law protects the economic and moral interests of creators. When The New York Times sued OpenAI in December 2023, alleging that millions of copyrighted articles had been used to train ChatGPT without consent or payment, the core claim was about intellectual property theft. The newspaper argued that OpenAI's models could reproduce substantial portions of its journalism, effectively creating a substitute for the original product. In March 2025, Judge Sidney Stein rejected OpenAI's motion to dismiss, allowing the main copyright infringement claims to proceed. By January 2026, the court ordered OpenAI to produce 20 million ChatGPT output logs as part of discovery, a ruling that could expose the degree to which the model regurgitates copyrighted material. The case has been consolidated with lawsuits from The New York Daily News and the Centre for Investigative Reporting, forming one of the most significant copyright challenges the technology industry has ever faced.

Data protection law, by contrast, protects something more intimate: the informational autonomy of individuals. The European Union's General Data Protection Regulation (GDPR) does not ask whether data is “creative” or “original.” It asks whether data can identify, or be linked to, a specific human being. Under the GDPR, organisations must establish a lawful basis for processing personal data at every stage of AI development and deployment. The European Data Protection Board (EDPB) adopted an opinion in December 2024 addressing when AI models can be considered anonymous, whether legitimate interest can serve as a legal basis for training, and what happens when a model is developed using unlawfully processed personal data. The French data protection authority, the CNIL, issued guidance in 2025 affirming that training AI models on personal data scraped from public sources can be lawful under the GDPR's legitimate interest basis, but only when specific conditions are met.

These are not the same conversation. Copyright disputes centre on market substitution and economic harm to creators. Privacy disputes centre on individual dignity, autonomy, and the right to control information about oneself. Yet the AI industry routinely conflates them, treating a novelist's published book and a person's scraped social media profile as functionally identical inputs to a training pipeline.

The Scraping Problem

The conflation becomes most visible in the practice of web scraping, where AI companies indiscriminately harvest both published content and personal data from the open internet. Daniel Solove, the Eugene L. and Barbara A. Bernard Professor of Intellectual Property and Technology Law at George Washington University Law School, and Woodrow Hartzog, Professor of Law at Boston University, tackled this collision directly in their 2025 paper “The Great Scrape: The Clash Between Scraping and Privacy,” published in the California Law Review. The paper, which won the Future of Privacy Forum's Privacy Papers for Policy Makers award, argues that scraped personal data provides the foundation for AI tools including facial recognition, deepfakes, and generative AI, even as privacy laws remain largely incongruous with the practice. As Solove and Hartzog have argued in related work, including their 2024 paper “Kafka in the Age of AI and the Futility of Privacy as Control” in the Boston University Law Review, the paradigm of individual control over personal data is fundamentally inadequate in the face of AI systems that process information at a scale and speed that renders individual oversight meaningless.

The Clearview AI saga offers perhaps the starkest illustration of why personal data demands different treatment. The company scraped billions of photographs from publicly accessible websites to build a facial recognition database, then sold access to law enforcement agencies. The photos were “publicly available” in the same way that a novel on a library shelf is publicly available. But the harms are categorically different. When Clearview scrapes your photograph, the resulting database can be used to track your movements, identify you in a crowd, and build a surveillance profile that follows you through physical space. In 2026, at least eight people in the United States were wrongfully arrested due to false positives from facial recognition technology, illustrating that the harms of personal data misuse are not hypothetical but tangible and life-altering.

Data protection authorities across Europe responded accordingly. The Dutch Data Protection Authority fined Clearview 30.5 million euros in 2024 for violating the GDPR by processing biometric data without a legal basis. The French, Greek, Italian, and Dutch authorities have collectively imposed fines of roughly 100 million euros on the company. In the United Kingdom, the Information Commissioner's Office imposed a fine of more than 7.5 million pounds and ordered Clearview to delete UK residents' data; on appeal, the Upper Tribunal in London ruled in October 2025 that the GDPR was applicable and the ICO had proper jurisdiction. The privacy advocacy group noyb filed a criminal complaint against Clearview and its managers in Austria, arguing that the company's executives could face personal criminal liability if they travel to Europe. In the United States, a federal judge in March 2025 approved a class action settlement granting affected individuals a 23 per cent equity stake in Clearview, valued at approximately 51.75 million dollars.

Now compare this with a copyright dispute. When authors Andrea Bartz, Charles Graeber, and Kirk Wallace Johnson sued Anthropic for using their books to train Claude, the harm alleged was economic: their creative labour had been exploited without compensation. Nobody's physical safety was at risk because Anthropic read their novels. The nature of the harm is fundamentally different, and the regulatory response should reflect that difference.

Divergent Courts, Divergent Standards

The copyright side of the AI training debate has produced a revealing split among American federal judges, one that highlights why a single framework for all training data is inadequate. In February 2025, Judge Stephanos Bibas of the Third Circuit, sitting by designation in the District of Delaware, ruled in Thomson Reuters v. ROSS Intelligence that using Westlaw headnotes to train a competing AI legal research tool was not fair use. Judge Bibas found that ROSS had infringed 2,243 headnotes and that its use was not transformative because it created a direct market substitute. This was the first time a U.S. court reached a conclusion on fair use in the AI training context, and the conclusion was a resounding rejection.

Months later, Judge Alsup reached the opposite result in Bartz v. Anthropic, describing AI training as “spectacularly” transformative. In Kadrey v. Meta, the court similarly found that training Meta's Llama models on books was transformative. The Copyright Alliance tracked more than 70 AI-related copyright infringement lawsuits by the end of 2025, with no appellate court yet providing definitive guidance. The Third Circuit granted review of the Thomson Reuters case, making it the first appellate court to take up the question of AI training and fair use.

These cases all involve published, copyrighted works. The legal questions they raise, however important, are fundamentally economic: who profits from creative expression, and under what conditions? Personal data disputes raise questions of a different order entirely. They concern not profit margins but physical safety, psychological autonomy, and the basic right to move through the world without being catalogued by algorithmic systems.

Why “Publicly Available” Does Not Mean “Fair Game”

One of the most dangerous assumptions in the AI training debate is that publicly available information carries no privacy interest. This assumption underpins the behaviour of companies that scrape the open web, treating everything they encounter as raw material for model training. But as Solove has argued across decades of scholarship, the aggregation of otherwise innocuous public data points can create significant privacy violations. Your name on a public LinkedIn profile is one thing. Your name, combined with your job history, your photograph, your social connections, and your posting patterns, is something else entirely.

The legal landscape on scraping remains contested. In the landmark hiQ Labs v. LinkedIn case, the U.S. Ninth Circuit Court of Appeals held in 2022 that scraping publicly available data from LinkedIn did not violate the Computer Fraud and Abuse Act, since publicly accessible websites have no access restrictions to circumvent. The U.S. Supreme Court had vacated an earlier Ninth Circuit ruling and remanded the case for reconsideration following its decision in Van Buren v. United States, but the appellate court reaffirmed its position. Yet this ruling addressed only federal computer fraud law, not privacy. The case ended with a settlement in which hiQ agreed to cease all scraping and destroy all data and algorithms derived from scraped profiles, a result that suggests even “legal” scraping can produce untenable outcomes.

Meta's approach to training its Llama models highlights the tension between published works and personal data with particular clarity. Llama 2 was trained exclusively on publicly available datasets including Common Crawl, Wikipedia, and Project Gutenberg. But for Llama 3 and Llama 4, Meta incorporated proprietary data from Facebook and Instagram. Mark Zuckerberg stated during an earnings call that Meta's corpus of public Facebook and Instagram data exceeds the size of Common Crawl. As of May 2025, Meta began using personal data from European users to train its AI systems, having paused an earlier attempt following discussions with the Irish Data Protection Commission. Starting in December 2025, Meta also began using AI chat interactions for advertising personalisation, adding yet another layer of personal data exploitation to its AI training pipeline.

The privacy advocacy group noyb, led by Max Schrems, sent Meta a cease and desist letter arguing that users who entered their data into Facebook over two decades could not reasonably have expected it to be used for AI training. Noyb also raised a critical point about non-users: people who never created a Facebook account but whose photographs appear in other users' posts are nevertheless swept into Meta's training pipeline. This is personal data being processed without even the pretence of consent, and no amount of copyright law can address it.

The Emerging Legislative Response

Legislators are beginning to recognise that the AI training question requires distinct answers for published works and personal data, though the responses remain fragmented and incomplete.

In the United States, Senators Josh Hawley and Richard Blumenthal introduced the AI Accountability and Personal Data Protection Act in July 2025. The bill is notable precisely because it addresses both categories simultaneously, creating a new federal cause of action that would allow individuals to sue companies that train AI models using either personal data or copyrighted works without clear, affirmative consent. The bill defines “covered data” expansively as information that “identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual.” The Authors Guild welcomed the legislation, calling it critical at “a pivotal moment for American authors, artists, and other creators.” It remains with the Senate Judiciary Committee, with no indication of when or whether it will advance.

California's AI Training Data Transparency Act (AB 2013), which took effect on 1 January 2026, takes a different approach. Rather than restricting what data AI companies can use, it requires them to disclose what they have used, including whether copyrighted materials and personal information were included in training datasets. In practice, AI developers have responded with vague, generalised disclosures. Elon Musk's xAI has challenged the statute as unconstitutional, alleging it compels disclosure of trade secrets in violation of the Fifth Amendment's Takings Clause.

In the European Union, the regulatory architecture more explicitly distinguishes between copyright and privacy concerns. The EU AI Act, whose copyright compliance obligations for general-purpose AI model providers took effect on 2 August 2025, requires these providers to implement robust copyright policies and publish “sufficiently detailed” summaries of training content using a mandatory template issued by the European AI Office. The Act operates alongside the GDPR, creating parallel obligations. Under the Copyright in the Digital Single Market Directive, rightsholders can opt out of text and data mining for commercial purposes. Under the GDPR, individuals retain rights over their personal data regardless of whether it has been published. The European Commission's GPAI Code of Practice defines AI training data broadly as all data used for pre-training, fine-tuning, and reinforcement learning, explicitly acknowledging that this encompasses both copyright-protected material and personal data protected by privacy rights.

The German Hanseatic Higher Regional Court provided important guidance in December 2025 in Kneschke v. LAION, confirming that pre-processing steps for AI training fall under text and data mining exceptions (and are thus permitted for lawfully accessed content), but stressing that rightsholders retain control through effective opt-outs and that downstream uses of AI-generated outputs remain subject to copyright scrutiny.

Personal Data Demands Stronger Protections

Here is the core argument for treating personal data differently from published works in the AI training context: the harms are categorically different, the power dynamics are fundamentally asymmetric, and the remedies must reflect both realities.

When an AI company trains on a published novel, the harm is primarily economic. The author loses potential licensing revenue. The work may be reproduced in ways that compete with the original. These are real and significant harms, but they are harms that the copyright system was designed to address. Authors can sue for infringement. Courts can assess fair use. Licensing frameworks can be negotiated. The U.S. Copyright Office's May 2025 report acknowledged as much, concluding that “some uses of copyrighted works for generative AI training will qualify as fair use, and some will not.” The report suggested a spectrum, with noncommercial research training on one end and copying expressive works from pirated sources to generate competing content on the other.

Personal data harms operate on a different register entirely. When an AI company trains on personal data, the potential harms include surveillance, discrimination, identity theft, manipulation, and the erosion of autonomy. These harms are often irreversible. Once personal data has been incorporated into a model's weights, it cannot simply be extracted or deleted. A 2025 study from the University of Tubingen established that large language models qualify as personal data under the GDPR when they memorise training information, triggering data protection obligations throughout the entire AI development lifecycle. The EDPB has acknowledged this problem, noting that whether an AI model is “anonymous” (and thus outside the GDPR's scope) must be assessed on a case-by-case basis, considering whether individuals can be directly or indirectly identified from the model and whether personal data can be extracted through queries.

The power asymmetry is also starkly different. A published author or a major newspaper has legal resources, public visibility, and collective organisations to assert their rights. The New York Times can afford to litigate against OpenAI for years. Individual data subjects, by contrast, are often unaware that their data has been scraped, lack the resources to challenge a trillion-dollar technology company, and face practical barriers to exercising their rights even when those rights exist on paper.

Consider the right to erasure under the GDPR. In principle, individuals can request the deletion of their personal data. In practice, if that data has been used to train a neural network, selective deletion is not technically feasible without retraining the entire model. The emerging field of “machine unlearning” attempts to bridge this gap. Techniques such as gradient subtraction, influence-function updates, and sharded retraining offer approximate methods of removing the influence of specific data points, but each carries significant trade-offs in model performance and reliability. In September 2025, researchers at UC Riverside proposed “source-free unlearning,” a method that operates without the original source data, using a surrogate dataset to guide parameter updates. The results were promising but still fell short of the standard of “complete and permanent erasure” that privacy regulators might demand. As the Cloud Security Alliance noted in an April 2025 assessment, there is no universally accepted method for verifying that machine unlearning has actually succeeded. The gap between legal right and technical reality is a chasm that copyright law, dealing primarily with discrete works that can be identified and removed, does not face to the same degree.

The Consent Question

The question of consent further illuminates why published works and personal data require different treatment. When an author publishes a book, they make a deliberate choice to enter the public sphere. The terms of that entry are governed by copyright law, which grants specific exclusive rights while also permitting certain uses (criticism, commentary, education, and, courts are still deciding, potentially AI training). The consent model for published works is, at least in principle, clear: the act of publication itself establishes a framework of rights and expectations.

Personal data operates under a radically different consent framework. Much personal data is generated not through deliberate publication but through the ordinary activities of daily life: browsing the web, posting on social media, uploading photographs, making purchases. The GDPR requires that consent be “freely given, specific, informed, and unambiguous.” Blanket consent through general terms of service is insufficient; organisations must clearly explain how personal data will be used in AI model training and provide granular consent options.

But the reality is that meaningful consent for AI training is largely fictional. When Facebook users shared photographs and status updates between 2004 and 2024, they were not consenting to their data being used to train large language models that did not yet exist. The temporal gap between data collection and AI training makes informed consent practically impossible. Noyb's Max Schrems made this point forcefully in his cease and desist letter to Meta, arguing that two decades of Facebook usage cannot retroactively be characterised as consent to AI training.

This is why data protection law adopts safeguards that go beyond consent, including purpose limitation (data must be collected for specified purposes and not further processed in incompatible ways), data minimisation (only necessary data should be processed), and the right to object. These principles have no equivalent in copyright law because they address a fundamentally different relationship between individuals and their information.

What a Differentiated Framework Could Look Like

If we accept that published works and personal data should be treated differently in the AI training context, what would a workable framework look like?

For published works, the emerging consensus points towards a licensing-based approach. The Really Simple Licensing (RSL) Standard, announced in September 2025 by a coalition including Reddit, Yahoo, and Medium, allows publishers to embed licensing terms directly into robots.txt files. Collective licensing organisations modelled on music industry bodies like ASCAP and BMI could pool rights from millions of creators and negotiate blanket licences with AI companies. The music industry's own response suggests this is viable: both Warner Music Group and Universal Music Group reached settlements with AI music companies Suno and Udio in 2025, agreeing to licence their catalogues for AI training and co-develop new licensed models for 2026.

For personal data, the framework must be fundamentally different. Licensing is not an adequate model because personal data is not a commodity to be traded but an extension of individual identity. The principles of data protection law, including purpose limitation, data minimisation, transparency, and the right to erasure, must apply with full force. This means that AI companies should be required to establish a clear lawful basis for processing personal data before training begins, not retrospectively. It means that individuals should have meaningful rights to object to the use of their data, with those objections technically enforced rather than merely acknowledged. And it means that data protection authorities must be resourced and empowered to enforce these requirements, as the Garante did with its fine against OpenAI.

The European approach, for all its imperfections, offers a more promising template than the American one. The EU's dual-track regulation, with the AI Act addressing copyright and the GDPR addressing personal data, at least recognises that these are distinct problems requiring distinct solutions. The CNIL's PANAME project, launched in partnership with ANSSI and other institutions, aims to create tools that can assess whether an AI model processes personal data, providing concrete technical solutions rather than relying solely on legal obligations.

The United States, by contrast, lacks a federal data protection law, leaving personal data protections scattered across state-level statutes and sector-specific regulations. The Hawley-Blumenthal bill represents a step towards recognising the dual nature of the problem, but its prospects in Congress remain uncertain. Without comprehensive federal privacy legislation, the American approach will continue to treat personal data as an afterthought to the copyright debate.

The Stakes Are Higher Than You Think

The distinction between published works and personal data in AI training is not merely a legal technicality. It reflects a deeper question about what kind of society we want to build with these technologies.

If we treat published works and personal data identically, we flatten a moral distinction that matters enormously. A novelist who publishes a book has chosen to participate in public discourse and has legal tools to protect their economic interests. A teenager whose Instagram posts are scraped to train an AI model has made no such choice and has virtually no practical recourse. Collapsing these two situations into a single “training data” category serves the interests of AI companies, which benefit from treating all information as raw material, but it does not serve the interests of either creators or individuals.

The U.S. Supreme Court's denial of certiorari in the Thaler case on 2 March 2026, reaffirming that human authorship is a foundational requirement of copyright law, gestures at this distinction. Copyright exists to protect human creative expression. Data protection law exists to protect human dignity and autonomy. Both are under threat from AI systems that consume information indiscriminately, but the threats are different, the harms are different, and the solutions must be different too.

The AI industry has every incentive to resist this differentiation. Separate frameworks for published works and personal data mean separate compliance obligations, separate negotiations, and separate costs. A unified “fair use” or “legitimate interest” argument is simpler and cheaper. But simplicity for the technology industry should not come at the expense of the rights of billions of individuals whose personal data has been swept into training datasets without their knowledge, understanding, or consent.

The courts, regulators, and legislators who will shape AI governance over the coming years must resist the temptation to treat all training data alike. Your novel and your face are not the same thing. They never were. And the law should reflect that reality before it is too late to do anything about it.

References and Sources

1. Italian Garante per la protezione dei dati personali, Decision on OpenAI/ChatGPT, 20 December 2024. Fine of EUR 15 million for GDPR violations including lack of legal basis for training data processing and transparency failures. Reported by Euronews, The Hacker News, and Lewis Silkin LLP.

2. Bartz v. Anthropic, U.S. District Court, Northern District of California, June 2025. Judge William Alsup ruled AI training on legally acquired books constitutes fair use. Settlement of USD 1.5 billion. Reported by Copyright Alliance, IPWatchdog, and Authors Guild.

3. The New York Times v. OpenAI and Microsoft, U.S. District Court, Southern District of New York, filed December 2023. Judge Sidney Stein denied OpenAI's motion to dismiss in March 2025. Court ordered production of 20 million ChatGPT logs in January 2026. Reported by NPR, National Law Review, and Nelson Mullins.

4. European Data Protection Board (EDPB), Opinion on AI Models and Personal Data, adopted December 2024. Addressed anonymity of AI models, legitimate interest as legal basis, and consequences of unlawful data processing in training.

5. CNIL (Commission Nationale de l'Informatique et des Libertes), Guidance on AI and GDPR, 2025. Affirmed that legitimate interest can serve as legal basis for training on scraped public data under specific conditions. Published PANAME project for assessing personal data in AI models.

6. Solove, Daniel J. and Hartzog, Woodrow, “The Great Scrape: The Clash Between Scraping and Privacy,” 113 California Law Review 1521 (2025). Winner of Future of Privacy Forum Privacy Papers for Policy Makers award.

7. Clearview AI: Dutch Data Protection Authority fine of EUR 30.5 million (May 2024); cumulative European fines of approximately EUR 100 million from French, Greek, Italian, and Dutch authorities. UK ICO fine of GBP 7.5 million; Upper Tribunal affirmed jurisdiction October 2025. U.S. class action settlement valued at USD 51.75 million approved March 2025. Reported by Fortune Europe, Library of Congress, National Law Review, and BBC.

8. hiQ Labs, Inc. v. LinkedIn Corp., U.S. Court of Appeals for the Ninth Circuit, No. 17-16783 (2022). Held that scraping publicly available data does not violate the Computer Fraud and Abuse Act. U.S. Supreme Court vacated and remanded in light of Van Buren v. United States (2021). Case settled December 2022 with permanent injunction against hiQ.

9. Meta Platforms, use of Facebook and Instagram data for Llama AI training. European deployment of personal data for AI training commenced May 2025 following discussions with Irish Data Protection Commission. Noyb cease and desist letter challenging retroactive consent. Reported by Euronews, MIT Technology Review, and Goodwin Law.

10. AI Accountability and Personal Data Protection Act, S.2367, 119th Congress (2025-2026). Introduced by Senators Josh Hawley (R-MO) and Richard Blumenthal (D-CT) on 21 July 2025. Creates federal cause of action for use of personal data or copyrighted works in AI training without affirmative consent. Reported by Axios, IPWatchdog, and Authors Guild.

11. California AI Training Data Transparency Act (AB 2013), effective 1 January 2026. Requires disclosure of training data sources including copyrighted materials and personal information. Challenged by xAI as unconstitutional. Reported by Davis+Gilbert LLP and Goodwin Law.

12. EU AI Act, copyright compliance obligations for general-purpose AI model providers, effective 2 August 2025. European Commission mandatory template for training data disclosure published July 2025. GPAI Code of Practice defines training data broadly to include both copyright-protected and personal data. Reported by IAPP, Clifford Chance, and WilmerHale.

13. Kneschke v. LAION, German Hanseatic Higher Regional Court, December 2025. First appellate-level guidance on copyright exceptions for text and data mining in AI training context. Reported by Norton Rose Fulbright.

14. U.S. Copyright Office, Report on AI Training and Copyright, May 2025. Concluded that fair use outcomes will vary by case. Reported by McDermott Will & Emery and Library of Congress Congressional Research Service.

15. Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc., U.S. District Court, District of Delaware, February 2025. Judge Stephanos Bibas granted partial summary judgment to Thomson Reuters, rejecting fair use defence for AI training on Westlaw headnotes. First U.S. court ruling on fair use in AI training context. Appeal granted by Third Circuit. Reported by Authors Alliance, Reed Smith, and Venable LLP.

16. Thaler v. Perlmutter, U.S. Supreme Court denied certiorari 2 March 2026, reaffirming human authorship requirement for copyright protection.

17. Really Simple Licensing (RSL) Standard, announced September 2025 by coalition including Reddit, Yahoo, and Medium. Framework for embedding licensing terms in robots.txt files.

18. Warner Music Group settlement with Suno, and Universal Music Group settlement with Udio, both 2025. AI music companies agreed to licence catalogues for training. Reported by Digital Music News and Copyright Alliance.

19. Solove, Daniel J., “Artificial Intelligence and Privacy,” Florida Law Review (2025). Analysis of how AI remixes longstanding privacy problems.

20. Hartzog, Woodrow and Solove, Daniel J., “Kafka in the Age of AI and the Futility of Privacy as Control,” 104 Boston University Law Review 1021 (2024).

21. University of Tubingen, 2025 study establishing that large language models qualify as personal data under GDPR when they memorise training information. Reported by PPC.land.

22. UC Riverside, “Source-Free Unlearning” method for machine unlearning without original training data, September 2025.

23. Cloud Security Alliance, “The Right to Be Forgotten, But Can AI Forget?”, April 2025. Assessment of machine unlearning challenges and verification difficulties.

24. Noyb, Criminal complaint against Clearview AI filed with Austrian public prosecutors, 2025. Reported by noyb.eu.

25. EDPB Guidelines on Data Transfers and SPE Training Material on AI and Data Protection, published 2025.

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...