The Drift Desk · Vol. 01 · June 2026
Editorial. Independent. Three stories, three layers, no alarm.
01 · Identity
The voice on the phone is no longer evidence of anything.
Google's security group did the industry a real service this week, putting numbers on what everyone suspected: voice phishing now accounts for 23% of cloud-related security incidents, and the median time from a successful trick to attacker handoff has collapsed from eight hours to 22 seconds. Their recommended defenses are sound: slow the help desk down, harden the second factor, audit the disclosure path.
Read through the kernel, those fixes share one trait: each strengthens a judgment a person must make under pressure. The layer that completes them is architectural: the interaction itself carries proof of the human on it, sealed in the moment, checkable by the person on the other end. Better judgment and verifiable proof are not rivals. The second is what lets the first relax.
Solved by HumanMark™ and Heartbeat Attested™: the call carries proof of a live human, and the help desk checks it instead of judging it.
02 · Regulation
August 2 is not a documentation deadline. It is an evidence deadline.
EU AI Act Article 50 transparency obligations apply from August 2. The Commission's draft transparency guidance is published, the consultation windows are closing, and procurement, which runs months ahead of enforcement, is already asking vendors the question the law will ask operators: what disclosed this interaction as AI, and can you show it.
Policies describe. Receipts prove. The organisations that arrive in August with verifiable records of what their AI did, rather than descriptions of what it should do, will spend the autumn advising instead of explaining.
Solved by Regulayer™: a signed runtime receipt for each governed interaction, mapped pack by pack to the article.
03 · Enterprise agents
The agent in the hiring pipe is teaching every builder the same lesson.
A widening collective action over AI-driven candidate screening turns on whether the software acted as an agent in the hiring decision. We take no view on the merits, and the structural lesson is visible either way: when an automated system screens a person, the output is the only artifact, and everyone involved, the vendor most of all, is left reconstructing what the system did and what governed it.
The missing object is a signed record made at the moment of the screen: what ran, under what boundary, whether a human threshold applied. The receipt is the builder's shield. The strongest position in any such dispute belongs to whoever can simply show what governed the action.
Solved by Regulayer™ running on the operator's own hardware: a receipt at the moment of the screen, before anyone needs to reconstruct it.
Deadline watch
Archived issue. Deadlines were updated in Vol. 04.
The dates do not negotiate.
Jul 15, 2026 · China, Interim Measures for Anthropomorphic AI Interaction Services, in force
Aug 2, 2026 · EU AI Act Article 50, transparency obligations apply
Dec 2, 2026 · EU AI Act, AI-content marking obligations begin
Jan 1, 2027 · Colorado AI Act (revised), effective
Dec 2027 · EU AI Act high-risk obligations, current target
Procurement runs 6 to 12 months ahead of every date on this list. The buying window for each is open before the law is.
The desk
The Drift Desk names what happened, names the layer that answers it, and moves on. No blame. No catastrophe.
Next issue when the week earns one.