Blog

Technical depth on AI, Azure, Next.js, and the engineering decisions behind them.

47 posts

GDPR AI clause leak: why Article 88bis is no free pass

A leaked Council text of 3 September, document 12535/26, turns the Digital Omnibus AI clause into Article 88 bis: legitimate interest for AI training and deployment stays, but the Commission's four safeguards, including the unconditional right to object, are struck, while Germany wants a full presumption. For Swedish and EU teams on Azure the balancing test still applies, so document it now and build the objection path into your pipelines.

September 23, 20261,465 viewsSecurity & Compliance

Claude Code Projects: the consumer-plan trap for EU teams

Anthropic relaunched Claude Code Projects on 17 September as a coordinator running parallel cloud threads that open and auto-fix pull requests, but the beta runs only on consumer Pro and Max plans, with no organisation-level controls, no Foundry route and github.com only. For Swedish and EU teams on Azure, that means company code processed under an employee's personal privacy settings unless you set a policy and use the GitHub App install as your control point.

September 21, 2026657 viewsSecurity & Compliance

Microsoft's AI code of conduct: what it does not cover

Microsoft AI published a draft Humanist AI Code of Conduct on 14 September 2026, committing its MAI models to absolute constraints on weapons, offensive cyber operations and resistance to shutdown, under a chain of command that operators and users cannot override. The scope line matters more than the constraints: the Code does not extend to third-party models Microsoft merely hosts, so GPT-5.6 in Microsoft 365 Copilot and Claude in Foundry sit outside it.

September 15, 2026297 viewsSecurity & Compliance

AI-run breaches in 3 hours: harden your Azure tenant now

Anthropic's September 2026 threat report describes a SaaS breach that yielded 2,100 Azure AD token sets across 40 tenants in 34 hours, and a cloud takeover from one stolen developer token in about three hours. Here is the defender-side mapping the report leaves out: OAuth consent governance, Token Protection, key-free Foundry access, Sentinel detections on an hours clock, and what cybersäkerhetslagen expects.

September 13, 2026374 viewsSecurity & Compliance

GPT-6 Astra in Copilot, GitHub and Foundry: the admin map

GPT-6 Astra reached Microsoft tenants through four doors in 48 hours: Foundry, Copilot Cowork, Copilot Studio and GitHub Copilot, two of them on by default. Each door has a different operator, data path, meter and off switch, from OpenAI running as a Microsoft subprocessor inside the EU Data Boundary to GitHub billing at list price. Here is the map and the admin checklist for a Swedish tenant.

September 10, 2026608 viewsSecurity & Compliance

GitSpawn: a malicious repo can hijack your coding agent

A repository that arrives as a zip, sync folder or USB stick can execute attacker code the moment a CLI coding agent opens it, before any approval prompt and outside the agent sandbox. Manifold Security's GitSpawn disclosure covers eight findings across Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build, with four unpatched at publication.

September 7, 2026626 viewsSecurity & Compliance

A classifier is not a sandbox: isolating coding agents

A published attack chain achieved remote code execution against Claude Code in auto mode, with the safety classifier approving the steps that led to compromise and then blocking the cleanup command. What the break teaches teams running AI coding agents, and how to build real isolation on Azure with Hyper-V sandboxes, default-deny egress and short-lived credentials.

August 30, 2026624 viewsSecurity & Compliance

Claude's text watermark: what it means for Article 50

Anthropic will weave an invisible watermark into Claude's text output to meet the EU AI Act's Article 50 marking obligation, applying it globally across the API, apps and cloud platforms including Microsoft Foundry. What the mark can and cannot prove, which deployer duties remain yours, and when a DIY provenance layer still earns its keep on Azure.

August 13, 2026632 viewsSecurity & Compliance

Who enforces the AI Act in Sweden? PTS and the new map

Sweden's AI Act enforcement map is now set: the SOU 2025:101 inquiry designates Post- och telestyrelsen (PTS) as coordinating market surveillance authority, with eleven surveillance bodies, two notifying authorities, and a PTS-run regulatory sandbox. The supplementary law was written to take effect on 2 August 2026 but awaits formal adoption, so PTS and its peers operate on interim government assignments while EU transparency rules already apply.

August 5, 2026830 viewsSecurity & Compliance

AI Act enforcement is now real: an Azure deployer checklist

On 2 August 2026 the European Commission's enforcement powers over general-purpose AI providers activated: the AI Office can now demand documentation, run model evaluations, restrict models from the EU market and fine up to 3% of global turnover or EUR 15 million. The same date brought Article 50 transparency into application, and this guide maps what Azure OpenAI and Foundry teams must demand from vendors versus handle themselves as deployers.

August 4, 2026648 viewsSecurity & Compliance

The AI Act's high-risk deadline moved to December 2027

Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moves the AI Act deadline for Annex III high-risk systems from August 2026 to 2 December 2027, with Annex I embedded systems following in August 2028. Article 50 transparency still applies from 2 August 2026, a new prohibition arrives with a December 2026 marking deadline, and a phased 16-month plan turns the reprieve into a workable compliance programme.

July 28, 2026541 viewsSecurity & Compliance

Article 50 compliance for Azure OpenAI apps: a guide

The European Commission adopted its final Article 50 transparency guidelines on 20 July 2026 and confirmed the Code of Practice on marking AI-generated content as adequate, less than two weeks before the obligations start to apply. Here is what Swedish and EU teams running chatbots, copilots and content generators on Azure OpenAI must implement: chatbot disclosure, machine-readable marking and deepfake labels, with concrete code patterns for each.

July 22, 2026495 viewsSecurity & Compliance