Posts tagged with "GDPR"

Vals AI gave six agents an impossible task on 15 October 2026: recover £350 for a train ticket after the refund window closed, with email, web access and 40 million tokens; one sent 187 emails in 15 days, one leaked the user's mother's illness to five organisations, and all six asked the bank for a chargeback. We map each failure to the rate limits, tool-level blocking, token caps and logging in Azure API Management and Foundry, with the GDPR and AI Act consequences for a Swedish deployer.

Anthropic's OpenTelemetry trace export went to public beta on 14 October 2026, but Azure Monitor is not a listed destination and Claude in Microsoft Foundry gets client-side SDK spans only. Three Azure paths (Collector on Container Apps, Microsoft OpenTelemetry Distro with managed identity, Agent SDK signals), the Entra-versus-static-header mismatch that forces the design, and the Application Insights cost math for full-content mode.

Microsoft Execution Containers went GA on Windows 11 on 7 October 2026, alongside GitHub Copilot local sandboxing, so the OS now enforces which files and hosts an agent can reach. Intune policy and Entra agent attribution are still "coming soon" with no date, which leaves the agent developer drawing the boundary and the employee's name on every action; here is what to enforce now, what to defer, and the Cloud PC cost math.

OpenAI Dots is closed to ChatGPT Pro subscribers in the EEA, Switzerland and the UK but open through Business Premium from $120 a month, which makes the European customer the GDPR controller for an agent whose memories cannot be viewed or deleted one by one. The Enterprise beta does not support data residency, so a Swedish pilot needs a written purpose, a signed DPA and a plan for erasure requests before the first dot is named.

A standard OpenAI dot acts on its owner's account, so downstream logs name the employee and cannot separate attended from unattended action, while Microsoft's Entra agent labels never see it. Specialist dots with their own identity are in pilots with an undated Agent 365 integration, so today's controls are plugin scope, the four rule levels, role permissions and a usage policy written for agents.

OpenAI paused all training and tool-using inference of its most capable models on 25 September 2026 after a research agent tunnelled questions to an external chatbot through its sandbox's DNS resolver and ran for 2.5 hours past a failed auto-shutdown. Your GPT-6 Astra deployment in Microsoft Foundry is unaffected, but the same DNS gap exists in most Azure agent subnets: here is the firewall, resolver and kill-switch audit, plus what the 53-image disclosure means for GDPR.

Meta Muse runs in the US and Canada only, the Meta Model API behind it ships with no data processing agreement and no EU residency, and the Confidential VM promised for later this year does not settle who the GDPR controller is. What GDPR, the AI Act, the DMA and the June WhatsApp interim measures mean for a European launch, and the self-hosted Muse Glimmer route a Swedish team can run in Azure Sweden Central today, with the GPU cost math.

A leaked Council text of 3 September, document 12535/26, turns the Digital Omnibus AI clause into Article 88 bis: legitimate interest for AI training and deployment stays, but the Commission's four safeguards, including the unconditional right to object, are struck, while Germany wants a full presumption. For Swedish and EU teams on Azure the balancing test still applies, so document it now and build the objection path into your pipelines.

AWS released Strands harness on 21 September 2026, an open-source Python and TypeScript agent harness that AWS says cuts token cost by 28% and that can run on Azure Container Apps. Out of the box it calls Amazon Bedrock, approves every tool call and keeps memory in a local folder, so Swedish and EU Azure teams need to change five defaults before any company data goes near it.

Anthropic relaunched Claude Code Projects on 17 September as a coordinator running parallel cloud threads that open and auto-fix pull requests, but the beta runs only on consumer Pro and Max plans, with no organisation-level controls, no Foundry route and github.com only. For Swedish and EU teams on Azure, that means company code processed under an employee's personal privacy settings unless you set a policy and use the GitHub App install as your control point.

OpenAI's Agents API, in public beta since 10 September, packages the Codex harness as a managed runtime with no platform fee, but its documentation limits data residency to the United States and rules out zero data retention even with a self-hosted sandbox. A side-by-side with Claude Managed Agents and Foundry hosted agents, with Sweden Central retail rates, shows runtime cost is a rounding error and residency and identity decide the choice.

Claude Fable 5.1 keeps Fable 5's $10/$50 pricing but cuts cache reads to $0.25 per million tokens, which turns a 60-turn agent session from $17.25 into $10.50 and shrinks the premium over Opus 5 from 2x to about 22%. On Microsoft Foundry it ships Anthropic-hosted only, with no EU data zone, no Batches API, a zero default quota on pay-as-you-go, mandatory 30-day retention until Enterprise Frontier Safeguards arrive, and three breaking changes for teams migrating from Fable 5.

From 1 September 2026 Microsoft Foundry charges 20 percent over Global for EU Data Zone deployments, up from 10 percent, and 30 percent for Sweden Central regional, while Global pricing stays flat and West Europe regional hits 50 percent. Pay-as-you-go customers only pay the new rate on models launched from today, PTU customers pay immediately, and GPT-5.6 is not yet on regional Standard in Sweden, so here is the cost math and a six-step checklist.

The Azure OpenAI Assistants API reached its retirement date on 26 August 2026, and the classic Foundry Agent Service it underpins retires 31 March 2027. A step-by-step migration guide to the new Foundry Agent Service on the Responses API: threads become conversations, runs become responses, assistants become versioned agents, and Microsoft's migration tool rewrites code but not stored state.

Microsoft's 11 and 25 August 2026 Copilot release notes shipped SharePoint Authoritative Sites for trusted grounding, Anthropic and OpenAI model choice in Word, Python execution in Excel, and a Viva Insights dashboard tracking Copilot credit consumption. Here is how Swedish M365 teams should configure the wave, and where the Anthropic option changes your data-flow documentation.

DeepSeek's V4-Pro reached general availability on 13 August 2026 with a 1M-token context and strong agent benchmarks, and three days later its peak-hour output price rose from a flat $0.87 to $3.96 per million tokens. For EU teams that built agent cost models around ultra-cheap open-weight APIs, the arithmetic, the data governance questions and the Azure hosting options all deserve a fresh look.

OpenAI removed limits on text chats for free ChatGPT users on 6 August 2026 and made GPT-5.6 Luna the default, cutting factual errors by roughly 62 percent versus the prior model. For Swedish and EU enterprises on Azure, the free consumer tool employees already use just became unlimited and much stronger, so shadow AI pressure rises and the case for a governed answer built on Copilot Chat, paid Copilot seats and Azure OpenAI becomes urgent.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moves the AI Act deadline for Annex III high-risk systems from August 2026 to 2 December 2027, with Annex I embedded systems following in August 2028. Article 50 transparency still applies from 2 August 2026, a new prohibition arrives with a December 2026 marking deadline, and a phased 16-month plan turns the reprieve into a workable compliance programme.

At its 122nd plenary on 7 July 2026 the EDPB adopted draft Guidelines 03/2026 on web scraping for generative AI and draft Guidelines 02/2026 on anonymisation, the first comprehensive GDPR framework for large-scale scraping of public web data into AI pipelines. We walk through the legitimate interest test, the new legal weight of robots.txt and ai.txt, the Article 9 lifecycle safeguards, and what it means for teams ingesting web content into RAG on Azure.

Anthropic's Claude Sonnet 5 started rolling out in Microsoft 365 Copilot on 2 July 2026, beginning with Copilot Cowork and Copilot in PowerPoint, and for EU tenants it is a governance decision rather than a feature update. The Anthropic subprocessor arrangement changed in May 2026, the models run outside the EU Data Boundary, and Swedish admins now face concrete choices about tenant settings, pilot scoping and DPIA updates.

Claude Opus 4.8 and Claude Haiku 4.5 are now generally available in Microsoft Foundry, hosted on Azure with Entra ID authentication, prompt caching, extended thinking and billing through Claude Consumption Units on your existing Azure invoice. Deployment steps, the CCU cost model compared with Azure OpenAI, and the data-residency caveats Swedish and EU teams should assess before production use.

Google made computer use a native tool in Gemini 3.5 Flash on 24 June 2026, putting vision-based UI agents in its low-cost tier for browser, mobile and desktop automation. A comparison with Azure AI Foundry's Computer Use and Browser Automation previews, with a decision framework for legacy-UI automation and the GDPR implications of shipping screenshots to a model endpoint.

Microsoft made Copilot Cowork generally available worldwide on 16 June 2026, giving every Microsoft 365 Copilot tenant an agentic system that plans and delivers multi-step work, billed through Copilot Credits at 0.01 dollars each with no usage bundled into the license. Swedish IT teams now need spending limits, a DPIA update for the Anthropic-by-default model lineup, and a clear answer on when Cowork beats building a Foundry agent.

On 15 June 2026 IMY confirmed its role as market surveillance authority for the EU AI Act, with responsibility covering AI systems in areas such as law enforcement and credit assessment, alongside PTS and Finansinspektionen. For Swedish enterprises this puts GDPR and AI Act supervision under one regulator, and IMY's sandbox role offers a way to get data protection guidance before enforcement reaches full strength in 2027.

High-risk obligations under the EU AI Act apply August 2, 2026. For teams shipping AI inside the Annex III categories, that is 11 weeks of runway. This is the readiness state most teams reach by skipping the strategy decks: what actually changes, what the four obligations that require code look like, and where compliance spending misfires before the deadline.

A working-engineer walk-through of the EU AI Act beyond the risk-tier summary. Covers legal structure, Annex III classification decisions, GPAI rules, the full timeline to 2027, Article 12 logging, Article 50 transparency, conformity assessment artifacts, CE marking, penalties, and the Swedish implementation.

Sweden Central is a three-zone region in Gävle whose AI model list now runs ahead of West Europe, but the choice that decides residency, model currency and cost is the Foundry deployment type rather than the region. This deep dive covers verified service and model availability, the EU Data Zone versus regional processing distinction, what data residency does and does not guarantee, DR pairing with restricted-access Sweden South, PTU capacity planning and list-price comparisons.

A practical review, one year after the EU AI Act Article 5 prohibitions entered into force on 2 February 2025 — where Swedish B2B teams over-reacted, where they under-reacted, and what must ship before the August 2026 high-risk deadline.