The week in AI. Read through the kernel.

01 · Identity

The voice on the phone is no longer evidence of anything.

Google's security group did the industry a real service this week, putting numbers on what everyone suspected: voice phishing now accounts for 23% of cloud-related security incidents, and the median time from a successful trick to attacker handoff has collapsed from eight hours to 22 seconds. Their recommended defenses are sound: slow the help desk down, harden the second factor, audit the disclosure path.

Read through the kernel, those fixes share one trait: each strengthens a judgment a person must make under pressure. The layer that completes them is architectural: the interaction itself carries proof of the human on it, sealed in the moment, checkable by the person on the other end. Better judgment and verifiable proof are not rivals. The second is what lets the first relax.

Architecture relevance. The development bears on a call carrying evidence of a live human that a help desk can check rather than judge. See HumanMark™ and Heartbeat.

02 · Regulation

August 2 is not a documentation deadline. It is an evidence deadline.

EU AI Act Article 50 transparency obligations apply from August 2. The Commission's draft transparency guidance is published, the consultation windows are closing, and procurement, which runs months ahead of enforcement, is already asking vendors the question the law will ask operators: what disclosed this interaction as AI, and can you show it.

Policies describe. Receipts prove. The organizations that arrive in August with verifiable records of what their AI did, rather than descriptions of what it should do, will spend the autumn advising instead of explaining.

Architecture relevance. The development bears on a signed runtime record for each governed interaction, mapped pack by pack to the article. See Regulayer.

03 · Enterprise agents

The agent in the hiring pipe is teaching every builder the same lesson.

A widening collective action over AI-driven candidate screening turns on whether the software acted as an agent in the hiring decision. We take no view on the merits, and the structural lesson is visible either way: when an automated system screens a person, the output is the only artifact, and everyone involved, the vendor most of all, is left reconstructing what the system did and what governed it.

The missing object is a signed record made at the moment of the screen: what ran, under what boundary, whether a human threshold applied. The receipt is the builder's shield. The strongest position in any such dispute belongs to whoever can simply show what governed the action.

Architecture relevance. The development bears on a record made at the moment of the screen, rather than reconstructed later. See Regulayer running on the operator's own hardware.

Deadline watch

Archived issue. Deadlines were updated in Vol. 04.

Each date below is verified against its primary source.

Jul 15, 2026 · China, Interim Measures for Anthropomorphic AI Interaction Services, in force
Aug 2, 2026 · EU AI Act Article 50, transparency obligations apply
Dec 2, 2026 · EU AI Act, AI-content marking obligations begin
Jan 1, 2027 · Colorado AI Act (revised), effective
Dec 2027 · EU AI Act high-risk obligations, current target

Procurement runs 6 to 12 months ahead of every date on this list. The buying window for each is open before the law is.

The desk

The Drift Desk names what happened, names the surface that answers it, and moves on. No blame. No catastrophe.