The week in AI. Read through the kernel.

01 · Enterprise

Three and a half billion dollars in one week, spent on the last mile rather than the model.

On June 30, 2026 AWS announced a 1 billion dollar investment in a forward-deployed engineering unit that embeds AI engineers inside customer organizations. Two days later Microsoft answered with Frontier, a new subsidiary carrying 2.5 billion dollars and 6,000 specialists aimed at the same problem. With comparable units launched by the two largest model labs in May, the industry has committed more than 6.5 billion dollars to deployment in roughly ten weeks. The number underneath all of it comes from MIT's Project NANDA: 95 percent of enterprise generative AI pilots deliver zero measurable impact on profit and loss.

Read the two figures together and the week explains itself. Pilots do not die on capability, they die at the trust boundary, the point where a system must touch real customers, real ledgers, real records, and someone must answer for what it does. An embedded engineer can wire the model in. What moves a pilot to production is the evidence around the action: what the system did, under whose authority, within what limits, provable later to a risk committee that was not in the room. Deployment is not an engineering problem with a governance step. It is a governance problem with an engineering step.

Solved by Regulayer™: the evidence layer a deployment stands on, a signed record made at the moment the system acts.

02 · Identity

The deepfake that worked was not aimed at a bank. It was aimed at a grandmother, for a year.

An 86-year-old woman in Sault Ste. Marie, Ontario lost more than 900,000 dollars to a crypto investment scam that began in the summer of 2025 with a Facebook ad featuring a deepfake video of Prime Minister Mark Carney, a case reported in the first days of July. Deepfakes of sitting heads of government and central bankers endorsing investment platforms are now among the most common vectors in fraud against elderly investors. The same weekly casebook carried a quieter entry: the widow of voice actor Phil Sayer found an AI clone of his voice listed on a consumer cloning platform, uploaded without the family's permission, nearly a decade after his death.

Both frauds borrowed authority, a head of government's face, a familiar voice, and no detector stands between a social media ad and a retiree's savings. Detection at the point of consumption will always be outrun by distribution. The scalable answer sits on the genuine article: when a public figure's real statements carry proof of presence, made at the moment of recording and checkable by anyone, the absence of that proof becomes the signal a platform, a bank, or a family member can act on. When the real thing carries proof, the fake has to explain itself.

Solved by HumanMark™ and Heartbeat Attested™: proof a real person was present when the real thing was made, verifiable by anyone.

03 · Regulation

China's companion rules land July 15. The country's largest AI app is deleting its agents first.

The Interim Measures for the Administration of AI Anthropomorphic Interactive Services, issued April 10, 2026 by the Cyberspace Administration of China and four partner agencies, take effect July 15. They cover services that simulate human personality and sustain emotional interaction, and they require role filing, full-chain real-time review, tiered management for minors, and risk traceability. Rather than rebuild for the deadline, ByteDance's Doubao, China's most-used AI app at roughly 345 million monthly active users, and Alibaba's Qwen are discontinuing user-created agents on July 15, with Doubao telling users their agent data becomes unrecoverable in-app after October 15.

The load-bearing phrase in the measures is risk traceability. A regulator who asks for traceability is asking for records that exist before the question is put, and an operator who cannot show what its agents did, or would do, finds the cheapest form of compliance is switching the capability off. That is a rational decision, and it is also the cost of building capability without building its record. The operator who can trace risk ships the feature. The operator who cannot deletes it.

Solved by SDKontrol™ and Regulayer™: limits set in advance and a signed trace of what the agent did, the traceability the rule asks for.

04 · Courts

Two citations that never existed reached the High Court. The review that followed is the real story.

The Crown Prosecution Service admitted this week that two non-existent authorities, which may have originated from generative AI, were placed before the High Court in two appeals against extradition orders. The errors entered in grounds of opposition, were carried into respondent submissions, and remained before the court through the permission stage before being caught ahead of the substantive hearing. A Chief Crown Prosecutor told the court that a full internal review examined 78 other cases handled by the same lawyer and found no similar issues. Mr Justice Sweeting said AI in legal work may be necessary and beneficial, while warning against its use for legal research without oversight.

The review deserves the praise the judge gave the candour. It also shows the price of the current architecture: answering one question about two citations took a manual sweep of 78 case files, because nothing in the workflow distinguished what a tool produced from what a person verified. Verification that leaves no trace has to be reconstructed, at whatever the reconstruction costs. A record made at the moment of work answers in minutes what a review answers in weeks. The cheapest audit is the one recorded while the work happens. This is precisely the record The Witness keeps.

Solved by Regulayer™: a signed record of what was generated and what was checked, made at the moment of work rather than reconstructed after.

05 · Platforms

Android's AI layer is opening by law. Attribution just became the scarce good.

On July 8, 2026 the EU General Court ruled that designated gatekeepers cannot seek judicial review of Digital Markets Act obligations before the Commission issues a specific enforcement decision. We take no view on the merits. The practical effect arrives fast: the Commission's specification decision, expected July 27, would require Android's system-level AI integration points, today available only to Gemini, to open to rival assistants, giving competing agents enforceable access to the same contacts, messages, and settings surfaces on more than three billion devices.

Interoperability by statute means several vendors' agents acting on one device surface, and the moment two agents share a surface, the operative question after any action becomes which one did it, on whose instruction. That answer protects every party equally: the platform that opened the surface, the rival that gained access, and the user whose device it is. A signed receipt of which agent acted completes the interoperability the law demands, and it is the piece no court order can supply after the fact. An open platform without attribution is a shared account. Receipts make it a marketplace.

Solved by Regulayer™: a signed receipt of which agent acted, made at the moment it acted, whichever vendor built it.

Deadline watch

The dates do not negotiate.

Jul 15, 2026 · China, Interim Measures on AI anthropomorphic interactive services take effect
Jul 22, 2026 · EU, signatory window closes for the Code of Practice on marking AI-generated content (18:00 CET)
Jul 27, 2026 · EU, Commission specification decision expected on Android AI interoperability under the DMA
Aug 2, 2026 · EU AI Act Article 50, transparency obligations apply
Dec 2, 2026 · EU AI Act, marking compliance for generative systems already on the EU market
Jan 1, 2027 · Colorado Automated Decision-Making Technology Act, effective (replaces the Colorado AI Act)
Aug 2027 · EU AI Act, high-risk obligations, current target

Procurement runs 6 to 12 months ahead of every date on this list. The buying window for each is open before the law is.

The desk

The Drift Desk names what happened, names the layer that answers it, and moves on. No blame. No catastrophe.

Past issues: Vol. 01 · Vol. 02 · Vol. 03 · Vol. 04 · full archive on Substack