Latest / DX Today | No-Hype Podcast & News About AI & DX / Executive Briefing: ADNOC's AI Agents, GDPx 12% Ceiling, UK Agent Law

Transcript

Executive Briefing: ADNOC's AI Agents, GDPx 12% Ceiling, UK Agent Law · DX Today | No-Hype Podcast & News About AI & DX

• 0:00
  SPEAKER_01: Welcome to the DX Today Executive Briefing.
• 0:03
  SPEAKER_01: Today is Tuesday, November 3rd, 2026.
• 0:06
  SPEAKER_01: I'm Elena, and this is the show where we take the morning's DX Today Executive Briefing edition apart, story by story, for the leaders who actually have to make the AI decisions inside their organizations.
• 0:19
  SPEAKER_03: And I'm Marcus.
• 0:20
  SPEAKER_03: My job here is to ask the Monday morning questions: who owns this, what breaks when you scale it, and what you should be asking your vendor before you sign anything.
• 0:29
  SPEAKER_01: Good, because today's edition practically begs for those questions.
• 0:33
  SPEAKER_01: The theme is a single sentence, and I'm quoting the edition here.
• 0:37
  SPEAKER_01: The distance between an AI pilot and an AI operating model is now the defining gap in enterprise technology.
• 0:45
  SPEAKER_01: And the edition argues that the evidence for that arrived this week from four directions at once.
• 0:52
  SPEAKER_03: Four directions.
• 0:53
  SPEAKER_03: Walk me through them before we start digging, because I suspect they connect more than they first appear to.
• 0:58
  SPEAKER_01: They do.
• 1:00
  SPEAKER_01: First, ADNOC, the national oil company of Abu Dhabi, becomes the first energy company to deploy OpenAI Frontier, and it is pointing agents at the field development plans that normally take months.
• 1:14
  SPEAKER_01: Second, the research firm Semi-Analysis launches a benchmark called GDPX and finds that the best AI agent scores just 12% on expert professional work.
• 1:25
  SPEAKER_01: Third, four British regulators issue a joint statement saying that existing law already governs personal AI agents, and the Information Commissioner's office sets a November 20th deadline for evidence.
• 1:37
  SPEAKER_01: And fourth, the National Cybersecurity Center warns that AI malware is highly likely to hit British critical infrastructure in a ransomware attack by 2028.
• 1:48
  SPEAKER_03: So one company betting big on agents, one benchmark telling us how good agents really are, one set of regulators telling us who is on the hook, and one security agency telling us the attackers are already moving.
• 2:13
  SPEAKER_01: We will get there, but let's start in Abu Dhabi.
• 2:16
  SPEAKER_01: Let's start in Abu Dhabi.
• 2:18
  SPEAKER_01: Here is what happened.
• 2:20
  SPEAKER_01: ADNOC signed a multi-year partnership with OpenAI and G42 on November 2nd to deploy OpenAI Frontier.
• 2:28
  SPEAKER_01: Frontier is the platform OpenAI launched in February for building and managing AI agents across a business.
• 2:34
  SPEAKER_01: According to the Next Web, ADNOC is the first energy company to adopt it.
• 2:40
  SPEAKER_01: The agreement was announced at ADPEC in Abu Dhabi during a visit to the United Arab Emirates by OpenAI Chief Executive Sam Altman, and Sheikh Khalid bin Mohammed bin Zayed, the crown prince of Abu Dhabi, witnessed the signing.
• 2:55
  SPEAKER_03: That is a lot of ceremony for a software contract.
• 2:58
  SPEAKER_01: Aaron Powell It is.
• 2:59
  SPEAKER_01: And the NextWeb reported it was one of four deals involving Abu Dhabi organizations that OpenAI announced on Monday.
• 3:06
  SPEAKER_01: So this is part of a broader push.
• 3:08
  SPEAKER_01: But the addition makes a point I want to underline.
• 3:11
  SPEAKER_01: What makes the deal notable is not the brand on the model, it is the work the model is pointed at.
• 3:18
  SPEAKER_03: Which is field development planning.
• 3:21
  SPEAKER_03: Explain that for the people listening who do not run oil fields, which I would guess is most of them.
• 3:27
  SPEAKER_01: Field development planning is the slow, expensive process of deciding how to develop an oil and gas field.
• 3:34
  SPEAKER_01: According to the announcement, the system will integrate subsurface facilities and economic studies drawn from thousands of wells, multiple stacked reservoirs, and hundreds of surface facilities into a single decision.
• 3:48
  SPEAKER_01: The idea is to optimize the whole field rather than each reservoir or each facility on its own.
• 3:54
  SPEAKER_01: And AdNok says the system could produce a complete development plan in hours rather than the months the work takes today.
• 4:02
  SPEAKER_01: Could.
• 4:04
  SPEAKER_01: You did, and the addition heard it too.
• 4:06
  SPEAKER_01: We will come back to that.
• 4:07
  SPEAKER_01: But first, the second use case, which is even broader.
• 4:10
  SPEAKER_01: Adnock describes it as valuing every barrel in the ground.
• 4:14
  SPEAKER_01: That means connecting intelligence across production, processing, refining, logistics, sales, and trading, with AI agents forecasting supply, demand, prices, and margins.
• 4:27
  SPEAKER_02: Now that is interesting because that is not a productivity tool.
• 4:31
  SPEAKER_02: That is the commercial engine of the company.
• 4:34
  SPEAKER_01: Exactly the additions framing.
• 4:36
  SPEAKER_01: It calls this the logic of an integrated energy company expressed as software, and says it moves AI from answering employee questions to shaping the commercial assumptions behind capital allocation.
• 4:48
  SPEAKER_01: That is a different category of risk and a different category of value.
• 4:52
  SPEAKER_03: Let me play the operator for a minute.
• 4:54
  SPEAKER_03: When I hear that an agent is going to shape the assumptions behind capital allocation, my first question is not whether the model is smart.
• 5:02
  SPEAKER_03: It is where the data comes from, and who notices when one of those forecasts is quietly wrong.
• 5:08
  SPEAKER_03: A field plan that is off by a little can be off by a lot of money over the life of the field.
• 5:14
  SPEAKER_01: And that is precisely why the next part of the story matters.
• 5:18
  SPEAKER_01: AdNOC is not starting from zero.
• 5:20
  SPEAKER_01: According to the announcement, as published by Energy Connects, the company has already rolled out ChatGPT Enterprise to more than 40,000 employees.
• 5:30
  SPEAKER_01: It is described as the largest enterprise ChatGPT deployment in the Middle East and North Africa, with adoption above 97%.
• 5:42
  SPEAKER_03: Most enterprise rollouts would be thrilled with half that.
• 5:45
  SPEAKER_03: Whatever you think of the numbers, that tells you the workforce has already had a long stretch of getting used to working alongside these tools.
• 5:53
  SPEAKER_01: And there is more foundation underneath.
• 5:55
  SPEAKER_01: The same announcement says AdNOC's AI and Robotics Strategy includes more than 200 AI applications and 70 robotics use cases, deployed or under development.
• 6:06
  SPEAKER_01: Its existing system, called Energy AI, builds intelligence at the reservoir, asset, and operations level.
• 6:13
  SPEAKER_01: The new partnership is meant to connect that intelligence across the whole business.
• 6:18
  SPEAKER_03: So they built the pieces at the asset level first, and now they are wiring the pieces together.
• 6:23
  SPEAKER_03: That is the right order.
• 6:25
  SPEAKER_03: A common mistake is trying to connect everything before any single piece actually works.
• 6:29
  SPEAKER_01: The deal also covers cyber defense work through OpenAI's Daybreak Blue initiative and training for adnoc staff, which brings us to the architecture.
• 6:39
  SPEAKER_01: And the edition says this part deserves attention from every regulated enterprise, not just energy companies.
• 6:45
  SPEAKER_03: Go ahead.
• 6:45
  SPEAKER_03: This is the part I care about most.
• 6:47
  SPEAKER_01: The systems will run on G42's sovereign AI infrastructure inside the United Arab Emirates.
• 6:54
  SPEAKER_01: The announcement states that human experts retain oversight of consequential decisions.
• 6:59
  SPEAKER_01: And according to the next web, G42 is also building OpenAI's Stargate data center in the country.
• 7:05
  SPEAKER_01: The editions read is that data residency, sovereign compute, and a named human decision owner are being written into the deal from the first day, rather than retrofitted after an audit finding.
• 7:17
  SPEAKER_03: That last phrase is the one I would put on a slide.
• 7:20
  SPEAKER_03: Retrofitted after an audit finding.
• 7:23
  SPEAKER_03: That is how most governance actually happens.
• 7:26
  SPEAKER_03: Something goes wrong, an auditor writes it up, and then everyone scrambles to bolt-on controls.
• 7:32
  SPEAKER_03: Designing it in from the start is cheaper and it is far less painful.
• 7:36
  SPEAKER_01: Now the caution.
• 7:38
  SPEAKER_01: The edition is explicit that executives should note what was not disclosed.
• 7:43
  SPEAKER_01: The value of the agreement and the rollout timeline were not made public.
• 7:48
  SPEAKER_01: So in the edition's words, the hours instead of months claim is a stated ambition, not a measured result.
• 7:56
  SPEAKER_03: That is my whole point about the word could.
• 8:06
  SPEAKER_01: Let me push back a little, though.
• 8:08
  SPEAKER_01: You are treating the ambition as if it were just marketing.
• 8:12
  SPEAKER_01: But the sequence ADNOC has followed is pretty disciplined.
• 8:16
  SPEAKER_01: Broad adoption first, then hundreds of applications, then a connecting layer.
• 8:22
  SPEAKER_01: A company that has done the groundwork earns a bit more benefit of the doubt on its ambitions than a company announcing its very first pilot.
• 8:31
  SPEAKER_03: That is fair.
• 8:31
  SPEAKER_03: And I will give them that.
• 8:33
  SPEAKER_03: Groundwork earns credibility.
• 8:35
  SPEAKER_03: But credibility is not measurement.
• 8:37
  SPEAKER_03: If I were on that program, the first thing I would want is a baseline.
• 8:41
  SPEAKER_03: How long does a field plan take today?
• 8:43
  SPEAKER_03: How many people touch it?
• 8:44
  SPEAKER_03: How often does the plan change after approval?
• 8:47
  SPEAKER_03: Then you can actually tell whether hours is real or whether it turns into weeks once the humans review the output.
• 8:54
  SPEAKER_01: And that human review is the point.
• 8:57
  SPEAKER_01: Even if the agent drafts the plan in hours, experts are supposed to retain oversight.
• 9:02
  SPEAKER_01: So the realistic gain may be in how many scenarios you can examine, not only in how fast the final answer arrives.
• 9:19
  SPEAKER_03: That is where the value probably lives.
• 9:21
  SPEAKER_01: The edition closes the story with Dr.
• 9:23
  SPEAKER_01: Sultan Ahmed Al-Jaber, who is the United Arab Emirates Minister of Industry and Advanced Technology, and also ADNAC managing director and group CEO.
• 9:34
  SPEAKER_01: The edition says he is framing AI as industrial infrastructure rather than office productivity.
• 9:42
  SPEAKER_01: And its conclusion is that the companies that win this phase will be the ones that pick a high-value, data-rich decision, connect the systems that feed it, and keep a human accountable for the output.
• 9:55
  SPEAKER_03: So give us the strategic takeaway in plain word.
• 9:59
  SPEAKER_01: The edition addresses it to CIOs, chief digital officers, and energy and industrial executives.
• 10:07
  SPEAKER_01: Broad assistant adoption first, then agents aimed at one high-value planning decision.
• 10:13
  SPEAKER_01: Run them on infrastructure that meets sovereignty rules.
• 10:17
  SPEAKER_01: Keep humans owning the final call.
• 10:20
  SPEAKER_01: And before you buy an agent platform, name the single decision it will accelerate, the data it must connect, and the executive who signs off on its output.
• 10:29
  SPEAKER_01: Finally, treat vendor time savings as hypotheses to measure, not results to bank.
• 10:35
  SPEAKER_03: That last line is the one I would tattoo on every procurement team.
• 10:39
  SPEAKER_03: Hypotheses to measure, not results to bank.
• 10:42
  SPEAKER_03: If your vendor's business case says hours instead of months, your contract should say how you will check.
• 10:49
  SPEAKER_01: And that is a perfect bridge to the second story because it is about measurement.
• 10:54
  SPEAKER_01: Specifically, what happens when someone actually measures how well these agents do on expert work?
• 11:01
  SPEAKER_03: All right, set it up.
• 11:02
  SPEAKER_03: A benchmark that says the best agent scores 12%.
• 11:06
  SPEAKER_03: That is not a number of vendors we'll be putting in their keynote decks.
• 11:10
  SPEAKER_01: Probably not.
• 11:11
  SPEAKER_01: On November 2nd, semi-analysis launched GDPX, a benchmark built to measure whether frontier models can complete economically valuable professional work as agents.
• 11:21
  SPEAKER_01: The launch post was written by Max Kahn, Andrew Megala, and Dylan Patel.
• 11:26
  SPEAKER_01: And the edition says it states the uncomfortable headline plainly.
• 11:31
  SPEAKER_01: Even the best model scores just 12%.
• 11:34
  SPEAKER_03: Before I react to the number, I want to know how they got it.
• 11:38
  SPEAKER_03: Benchmarks are easy to design in a way that flatters or punishes whoever you like.
• 11:43
  SPEAKER_01: And the edition agrees that the design is what makes the result credible.
• 11:47
  SPEAKER_01: According to semi-analysis, GDPX contains 206 tasks across 11 domains.
• 11:54
  SPEAKER_01: Those domains include chip design, cybersecurity, biology, finance, legal work, quant trading, recursive self-improvement, hardware design, material science, alignment, and software engineering.
• 12:07
  SPEAKER_01: It was built with 14 data partners.
• 12:09
  SPEAKER_03: That is a broad spread.
• 12:11
  SPEAKER_03: It is not one company grading its own homework on coding puzzles.
• 12:16
  SPEAKER_01: And here is the detail I find most important.
• 12:18
  SPEAKER_01: The default time limit for a task is eight hours, which the addition notes is far longer than typical benchmarks allow.
• 12:26
  SPEAKER_01: The headline score is pass at one across three attempts, and every domain is weighted equally.
• 12:31
  SPEAKER_01: So a model cannot hide weak domains behind one strong one.
• 12:35
  SPEAKER_03: Eight hours matters a lot.
• 12:38
  SPEAKER_03: Most real work is not a single question and a single answer.
• 12:42
  SPEAKER_03: It is a long chain of steps where a small mistake early on poisons everything after it.
• 12:47
  SPEAKER_03: If you only test agents on short tasks, you never see that compounding.
• 12:52
  SPEAKER_01: Right.
• 12:53
  SPEAKER_01: And equal weighting matters for buyers, too.
• 12:56
  SPEAKER_01: If your business spans finance and legal and engineering, you care about the weak domain because that is where the agent will hurt you.
• 13:04
  SPEAKER_01: So who won?
• 13:06
  SPEAKER_01: The leaderboard places Cloud Opus 5.5 first at 12.0.
• 13:10
  SPEAKER_01: Gemini 4 Carbon is second at 10.9, and GPT-6 Astra is third at 9.6.
• 13:18
  SPEAKER_01: At the bottom of the displayed rankings, Grok 4.7 scores 3.9, and GLM 5.3 scores 2.7.
• 13:26
  SPEAKER_03: So the spread from top to bottom is real, but the top is still low in absolute terms.
• 13:32
  SPEAKER_03: Even the leader is failing on the large majority of the work.
• 13:35
  SPEAKER_00: Semi-analysis calls Opus 5.5 the best all-around model, winning in quant trading, hardware design, and chip design.
• 13:44
  SPEAKER_01: And it says Muse Wonderful is the best available cyber model by a meaningful margin.
• 13:50
  SPEAKER_03: Which is a useful reminder that best overall is not the same as best for your job.
• 13:55
  SPEAKER_03: If cybersecurity is your use case, the leaderboard winner is not necessarily your answer.
• 14:00
  SPEAKER_01: And now the caveat, which I think is the most underappreciated line in the whole story.
• 14:05
  SPEAKER_01: Semi-analysis says Opus 5.5 and GPT-6 Astra have sandbagged overall scores because their safety classifiers block some tasks.
• 14:15
  SPEAKER_03: Explain sandbagged for anyone who has not heard the term in this context.
• 14:20
  SPEAKER_01: It means their scores are held down below what the underlying capability might deliver because the safety systems refuse certain tasks before the model even attempts them.
• 14:30
  SPEAKER_01: So, in the edition's words, part of the gap between leaders and laggards reflects safety policy rather than raw capability.
• 14:38
  SPEAKER_01: And the addition's advice is that buyers comparing models on any public leaderboard should ask which tasks a vendor's guardrails refuse.
• 14:47
  SPEAKER_03: I want to stay on that for a second, because it cuts both ways.
• 14:50
  SPEAKER_03: A procurement team might see a refusal as a defect.
• 14:54
  SPEAKER_03: But in a regulated business, a model that refuses a borderline cyber task might be exactly what your risk committee wants.
• 15:03
  SPEAKER_03: The question is not whether it refuses.
• 15:05
  SPEAKER_03: The question is whether it refuses the things you need done.
• 15:08
  SPEAKER_01: Aaron Ross Powell That is a fair distinction, and I think the edition would agree.
• 15:13
  SPEAKER_01: It is not saying refusals are bad.
• 15:15
  SPEAKER_01: It is saying you cannot read a leaderboard number without knowing what was refused.
• 15:20
  SPEAKER_03: Now, give me the domain detail, because I suspect that is where the real story is.
• 15:25
  SPEAKER_01: It is.
• 15:25
  SPEAKER_01: And the edition says the domain detail is where executives should spend their attention.
• 15:30
  SPEAKER_01: Start with finance.
• 15:32
  SPEAKER_01: Semi-analysis reports that all the models score 0% under binary grading.
• 15:37
  SPEAKER_01: That is why the leaderboard reports average partial scores for finance instead.
• 15:42
  SPEAKER_03: 0%.
• 15:43
  SPEAKER_01: Every model.
• 15:44
  SPEAKER_01: Every model under binary grading.
• 15:46
  SPEAKER_01: And the reasoning for using binary grading in finance is worth repeating.
• 15:50
  SPEAKER_01: Finance tasks are high stakes.
• 15:52
  SPEAKER_01: And a model that is mostly right on evaluation is still wrong.
• 15:57
  SPEAKER_03: That sentence should be framed and hung in every finance department considering an agent.
• 16:02
  SPEAKER_03: Mostly right is a perfectly good outcome for drafting an email.
• 16:06
  SPEAKER_03: It is a terrible outcome for a valuation that someone is going to make a decision on.
• 16:12
  SPEAKER_01: Then there is the legal example, which I found genuinely striking.
• 16:15
  SPEAKER_01: In one legal task, 14 of 20 runs took a client's email describing desired provisions and applied those terms, even though they retraded terms that had already been agreed, and the agent did not flag the conflict.
• 16:30
  SPEAKER_03: So the agent did what it was told faithfully, and that was the problem.
• 16:36
  SPEAKER_01: That is exactly the addition's analysis.
• 16:39
  SPEAKER_01: It says, and I'm quoting the addition here, that is not a hallucination problem.
• 16:44
  SPEAKER_01: It is a judgment problem.
• 16:45
  SPEAKER_01: An agent doing exactly what it was asked when a competent associate would have stopped and raised a hand.
• 16:51
  SPEAKER_03: This is the part that I think most organizations are not testing for.
• 16:55
  SPEAKER_03: Most of the worry so far has been about the model making things up.
• 16:59
  SPEAKER_03: Fair enough.
• 17:00
  SPEAKER_03: But the more dangerous failure in agent work is the model doing precisely what the instruction said when the instruction itself was wrong, and nobody noticed because the output looked clean.
• 17:12
  SPEAKER_01: Let me test you on that, though.
• 17:14
  SPEAKER_01: Isn't that also true of junior humans?
• 17:17
  SPEAKER_01: Plenty of new associates would follow the client's email too.
• 17:20
  SPEAKER_03: Aaron Powell Some would.
• 17:21
  SPEAKER_03: But a junior associate has a supervisor, a firm culture of checking, and a reason to be nervous.
• 17:28
  SPEAKER_03: The agent has none of that unless you build it in.
• 17:31
  SPEAKER_03: That is why I keep saying the controls are the product.
• 17:34
  SPEAKER_03: If the agent is not designed to escalate a conflict, it will not escalate a conflict.
• 17:42
  SPEAKER_01: And the addition connects this directly to the adnoc story.
• 17:46
  SPEAKER_01: It says, the finding lands in the same week AdNOC committed to agents for field planning, and the two stories are not intention.
• 17:55
  SPEAKER_03: I was going to ask about that.
• 17:57
  SPEAKER_03: On the surface, one story says, go big on agents, and the other says agents fail at expert work most of the time.
• 18:04
  SPEAKER_01: The edition resolves it this way: bounded workflows with clear data and human sign-off are where agents earn their keep today.
• 18:13
  SPEAKER_01: Open-ended expert work, where the task is to notice what the instruction left out, remains the hard frontier.
• 18:20
  SPEAKER_01: So adnoc is pointing agents at a specific planning decision with structured data and human oversight.
• 18:27
  SPEAKER_01: That is very different from asking an agent to be an unsupervised lawyer.
• 18:31
  SPEAKER_03: That is a useful way to sort any proposal that lands on your desk.
• 18:36
  SPEAKER_03: Is this bounded?
• 18:37
  SPEAKER_03: Is the data clear?
• 18:38
  SPEAKER_03: Is a human signing off?
• 18:40
  SPEAKER_03: If the answer to all three is yes, you are in the zone where agents work.
• 18:44
  SPEAKER_03: If the answer is no, you are in benchmark territory.
• 18:47
  SPEAKER_03: And the benchmark says 12%.
• 18:49
  SPEAKER_01: The edition also says GDPX gives buyers a vocabulary for that distinction.
• 18:54
  SPEAKER_01: And a reason to be skeptical of demos that show an agent finishing a task without showing how often it finishes it correctly.
• 19:02
  SPEAKER_03: Aaron Powell Every demo is the one run that worked.
• 19:05
  SPEAKER_03: Nobody shows you the other runs.
• 19:06
  SPEAKER_01: Which leads to the procurement lesson.
• 19:08
  SPEAKER_01: The edition says teams should build internal evaluations that mirror the discipline of GDPX.
• 19:15
  SPEAKER_01: Long time horizons, multiple attempts, binary grading where errors are expensive, and explicit tests for whether an agent escalates conflicting instructions.
• 19:25
  SPEAKER_03: And that last one is the one almost nobody runs.
• 19:28
  SPEAKER_03: If I were building an evaluation, I would deliberately plant conflicts in the test cases.
• 19:33
  SPEAKER_03: Give the agent an instruction that contradicts something already agreed, and see whether it raises it.
• 19:38
  SPEAKER_03: That tells you more than a long list of clean tasks.
• 19:41
  SPEAKER_01: The edition puts the stakes bluntly.
• 19:43
  SPEAKER_01: A model that scores well on a vendor's chosen benchmark but silently retrades a contract term is a liability, not an asset.
• 19:52
  SPEAKER_03: So the strategic takeaway.
• 19:53
  SPEAKER_01: It is addressed to CTOs, chief AI officers, and heads of legal and finance operations.
• 20:00
  SPEAKER_01: Treat a 12% ceiling on expert agent work as the planning assumption, not a pessimistic outlier.
• 20:06
  SPEAKER_01: Deploy agents where the output can be checked cheaply and the workflow is bounded.
• 20:12
  SPEAKER_01: Require escalation when instructions conflict.
• 20:18
  SPEAKER_01: And ask every vendor which tasks its safety classifiers refuse, because that shapes both its benchmark score and its fit for your work.
• 20:27
  SPEAKER_03: I want to push on the phrase planning assumption because I think it is the strongest part.
• 20:32
  SPEAKER_03: If you plan as though agents will succeed on expert work most of the time, you will underinvest in review and you will be surprised.
• 20:41
  SPEAKER_03: If you plan as though they succeed rarely on open-ended expert work, you design the checks first, and anything better is upside.
• 20:50
  SPEAKER_01: Although I would add a counterweight, 12% on open-ended expert tasks over eight hours is not the same as 12% on everything.
• 20:59
  SPEAKER_01: Bounded tasks are a different measurement.
• 21:02
  SPEAKER_01: So the planning assumption is about the hard frontier, not a reason to dismiss agents altogether.
• 21:07
  SPEAKER_03: Aaron Powell Agreed.
• 21:08
  SPEAKER_03: Low score on the hardest work, not a verdict on all work.
• 21:12
  SPEAKER_03: That is a fair correction.
• 21:14
  SPEAKER_01: And it sets up our third story nicely because if agents need human accountability around them, the obvious next question is who the law says is accountable.
• 21:23
  SPEAKER_01: And British regulators just answer that.
• 21:26
  SPEAKER_03: Aaron Powell So story three.
• 21:27
  SPEAKER_03: A lot of people have been saying that agents live in a regulatory gray zone.
• 21:31
  SPEAKER_03: It sounds like London disagrees.
• 21:34
  SPEAKER_01: London disagrees directly.
• 21:37
  SPEAKER_01: The edition says companies hoping that AI agents sit in a regulatory gray zone received a direct answer.
• 21:44
  SPEAKER_01: On October 30th, four regulators, the Competition and Markets Authority, the Financial Conduct Authority, the Information Commissioner's Office, and Ofcom, acting together through the Digital Regulation Cooperation Forum, published a joint statement.
• 22:00
  SPEAKER_01: On protecting people and businesses in an agentic economy.
• 22:04
  SPEAKER_03: For regulators acting together is itself the news.
• 22:08
  SPEAKER_03: Usually you get one regulator at a time, each with its own angle.
• 22:12
  SPEAKER_01: And the central sentence, as reported by LexisNexis and Result Sense, is unambiguous.
• 22:18
  SPEAKER_01: Existing legal and regulatory frameworks apply to personal AI agents.
• 22:23
  SPEAKER_03: That is a very short sentence with very long consequences.
• 22:27
  SPEAKER_01: It gets sharper.
• 22:28
  SPEAKER_01: According to LexisNexis, the regulators say an agent's autonomy does not reduce the responsibilities of the organizations deploying it.
• 22:38
  SPEAKER_01: The addition draws out the implication.
• 22:41
  SPEAKER_01: The more an agent can do on its own, the more the deploying firm owns the consequences, not less.
• 22:55
  SPEAKER_03: The instinct is that if the agent decided, then somehow the decision is the agents or the model vendors.
• 23:02
  SPEAKER_03: The regulators are saying no.
• 23:04
  SPEAKER_03: Autonomy is a feature you chose to ship and you own what the feature does.
• 23:09
  SPEAKER_01: And the edition says this should reshape how product teams think about autonomy.
• 23:14
  SPEAKER_01: Every increase in what the agent can do on its own is also an increase in what the company is answerable for.
• 23:21
  SPEAKER_03: What risks did they actually name?
• 23:23
  SPEAKER_01: Three, fraud and scams, personal data used in unexpected ways, and misleading recommendations.
• 23:30
  SPEAKER_01: And then they set out the questions firms should be ready to answer: how agents act on a user's behalf, how authority is granted to an agent, how personal data is used, what commercial influences shape an agent's recommendations, and how a user obtains redress when something goes wrong.
• 23:49
  SPEAKER_03: That list is basically a product requirements document.
• 23:53
  SPEAKER_03: Every one of those is a design decision.
• 23:55
  SPEAKER_01: That is the additions point exactly.
• 23:58
  SPEAKER_01: It says each of those questions maps directly to a design decision that engineering teams are making today, often without legal review.
• 24:06
  SPEAKER_03: Often without legal review is the uncomfortable bit.
• 24:10
  SPEAKER_03: Take the question about commercial influences on recommendations.
• 24:13
  SPEAKER_03: If your shopping agent favors products that pay you a higher margin, that is a business decision somebody made, probably in a pricing meeting, and probably nobody asked compliance.
• 24:28
  SPEAKER_01: They introduced no new rules.
• 24:30
  SPEAKER_01: Instead, Result Sense reports that they say they will use their enforcement powers where appropriate, and they are working with government to identify compliance gaps.
• 24:40
  SPEAKER_01: They encourage firms to engage early and to test products through sandboxes.
• 24:45
  SPEAKER_03: Let me be the skeptic here.
• 24:47
  SPEAKER_03: No new rules sounds to some executives like nothing happened.
• 24:52
  SPEAKER_03: Why should anyone treat a joint statement with no new rules as urgent?
• 24:56
  SPEAKER_01: Because the statement is not creating obligations.
• 25:00
  SPEAKER_01: It is telling you the obligations already exist.
• 25:03
  SPEAKER_01: That is more urgent, not less.
• 25:06
  SPEAKER_01: A new law would come with an effective date and a runway.
• 25:09
  SPEAKER_01: This says the runway is gone, the rules already apply, and enforcement powers are available where appropriate.
• 25:19
  SPEAKER_03: A future law gives you time.
• 25:21
  SPEAKER_03: A statement that current law applies gives you none.
• 25:25
  SPEAKER_01: And the Competition and Markets Authority has already put the consumer law position in plain words.
• 25:31
  SPEAKER_01: Its guidance on complying with consumer law when using AI agents was first published on March 9th and updated on October 30th.
• 25:40
  SPEAKER_01: It states that if an AI agent you use does something illegal, you are responsible.
• 25:46
  SPEAKER_03: One short sentence that ends a lot of arguments.
• 25:50
  SPEAKER_01: The edition says that sentence closes off the argument that a vendor's model, rather than the deploying business, carries the blame.
• 25:59
  SPEAKER_03: Which has a direct consequence for contracts.
• 26:02
  SPEAKER_03: If the regulator says you are responsible, then your vendor contract needs to address what happens when the vendor's agent does something that makes you responsible.
• 26:10
  SPEAKER_03: Indemnities, logging, the ability to audit what the agent did, you cannot outsource the liability.
• 26:16
  SPEAKER_03: So you had better be able to reconstruct the event.
• 26:19
  SPEAKER_01: Then there is the data protection regulator, which is moving in parallel.
• 26:24
  SPEAKER_01: The ICO's call for evidence on agentic AI was published on October 8th, and it closes on November 20th.
• 26:32
  SPEAKER_01: The ICO says the evidence will inform its guidance and a statutory code of practice on AI and automated decision making.
• 26:41
  SPEAKER_03: So this is not just commentary.
• 26:43
  SPEAKER_03: Whatever comes out of that consultation becomes something organizations will be expected to follow.
• 26:48
  SPEAKER_01: And the ICO's positions are already pointed.
• 26:51
  SPEAKER_01: Organizations that influence an agent's purposes or means may be controllers, even if developers say otherwise, and human involvement must be meaningful to count.
• 27:02
  SPEAKER_03: That second point is going to catch a lot of people.
• 27:04
  SPEAKER_03: I can already picture the design pattern it is aimed at.
• 27:12
  SPEAKER_01: The edition says it almost exactly that way.
• 27:15
  SPEAKER_01: A rubber stamp approval screen will not turn an automated decision into a human one.
• 27:21
  SPEAKER_03: And that ties right back to GDPX.
• 27:24
  SPEAKER_03: If agents are mostly not reliable on expert work, then the human in the loop has to actually check.
• 27:31
  SPEAKER_03: If the human is a rubber stamp, you have the risk of the automated decision and none of the protection.
• 27:36
  SPEAKER_01: Let me challenge you on the controller point, though.
• 27:39
  SPEAKER_01: A lot of companies buy an agent platform and configure it.
• 27:43
  SPEAKER_01: They would say the developer controls the model, so the developer is the controller.
• 27:49
  SPEAKER_03: And the ICO is telling them that is not necessarily how it works.
• 27:53
  SPEAKER_03: If you set the agent's purpose, if you decide what it is for and how it uses data, you may be a controller regardless of what the developer's terms say.
• 28:02
  SPEAKER_03: I think the safe assumption is the one the addition gives.
• 28:05
  SPEAKER_03: If you shape the purpose, assume you are the controller.
• 28:08
  SPEAKER_01: Now why does this matter beyond Britain?
• 28:11
  SPEAKER_01: The edition says the importance of the statement lies in its method.
• 28:16
  SPEAKER_01: Rather than waiting for agent-specific legislation, four regulators covering competition, consumer protection, financial services, data protection, and communications have agreed that the existing rulebook reaches agents now.
• 28:32
  SPEAKER_03: And that is portable.
• 28:33
  SPEAKER_03: Any regulator anywhere can make the same move without passing a single new law.
• 28:38
  SPEAKER_01: The addition says exactly that.
• 28:40
  SPEAKER_01: The approach is easy for other jurisdictions to copy, and it means the compliance obligation exists today, rather than at some future effective date.
• 28:50
  SPEAKER_01: And for product leaders, the practical consequence is that compliance review belongs at the design stage of an agent rather than after launch, because the questions these regulators are asking can only be answered by how the agent was built in the first place.
• 29:05
  SPEAKER_03: That is the line I would hand to every product organization.
• 29:09
  SPEAKER_03: You cannot answer how authority is granted to your agent after the fact.
• 29:14
  SPEAKER_03: Either you designed a way to grant and limit authority or you did not.
• 29:19
  SPEAKER_01: The strategic takeaway is addressed to general counsel, chief compliance officers, and chief product officers.
• 29:26
  SPEAKER_01: Do not wait for an AI agent law.
• 29:28
  SPEAKER_01: Map every customer-facing agent against the regulator's questions now, disclosure that an agent is acting, how authority is granted, how data is used, what commercial incentives shape recommendations, and how a customer gets redress.
• 29:43
  SPEAKER_01: If your organization shapes an agent's purpose, assume you are the controller.
• 29:48
  SPEAKER_01: And consider responding to the ICO before November 20th, because the evidence will shape a statutory code you will have to follow.
• 29:56
  SPEAKER_03: I would add that responding to a consultation is one of the cheapest forms of influence a company has.
• 30:02
  SPEAKER_03: You get to tell the regulator how your systems actually work before they write the code you will be held to.
• 30:08
  SPEAKER_01: And if your organization operates in Britain and has customer-facing agents, there are only a few weeks between today and November 20th.
• 30:17
  SPEAKER_01: Which means somebody needs to own that response this week, not next month.
• 30:22
  SPEAKER_01: One more point on the regulators, because I think the invitation to engage early is easy to skip past.
• 30:29
  SPEAKER_01: They encourage firms to test products through sandboxes.
• 30:33
  SPEAKER_01: That is the regulator offering to look at your agent before it reaches customers, rather than after a complaint.
• 30:40
  SPEAKER_03: And I would take that offer seriously.
• 30:43
  SPEAKER_03: The usual instinct is to keep regulators at a distance until you have to talk to them.
• 30:47
  SPEAKER_03: But with agents, where the regulators are openly saying they are still working with government to find the gaps, being early gives you a chance to shape the answer instead of receiving it.
• 30:58
  SPEAKER_03: The risk of engaging is that they see your design.
• 31:01
  SPEAKER_03: The risk of not engaging is that they see it later through an enforcement lens.
• 31:06
  SPEAKER_01: Let me go back to the three risks for a moment, because I think the first one, fraud and scams, is the one product teams underestimate.
• 31:14
  SPEAKER_01: If an agent can act on a customer's behalf, then anyone who can impersonate that customer or trick the agent inherits that power.
• 31:22
  SPEAKER_03: Which is why the question about how authority is granted is so important.
• 31:26
  SPEAKER_03: An agent that can spend money, change an account, or share data needs limits that a human can understand and revoke.
• 31:34
  SPEAKER_03: Think of it the way you would think about delegating signing authority inside a company.
• 31:38
  SPEAKER_03: You set a ceiling, you set a scope, and you can take it back.
• 31:42
  SPEAKER_03: If your agent has no equivalent of that, the regulator's question has no good answer.
• 31:48
  SPEAKER_01: Agreed.
• 31:49
  SPEAKER_01: Now our fourth story moves from the people deploying agents to the people attacking with them.
• 31:54
  SPEAKER_03: The National Cybersecurity Center.
• 31:57
  SPEAKER_03: Set it up for me.
• 31:58
  SPEAKER_01: Britain's National Cybersecurity Center published its annual review 2026 today, Tuesday, November 3rd.
• 32:05
  SPEAKER_01: And the edition says it put a date on a threat that security leaders have discussed in the abstract for years.
• 32:12
  SPEAKER_01: The NCSC assesses that AI-powered malware is highly likely to be used in a ransomware attack on Britain's critical national infrastructure by 2028.
• 32:23
  SPEAKER_03: Highly likely with a year attached.
• 32:30
  SPEAKER_01: It is not.
• 33:59
  SPEAKER_03: Reassuring because we're not facing some science fiction autonomous attacker.
• 34:04
  SPEAKER_03: Alarming because the familiar attacks we already struggle with are getting faster and cheaper.
• 34:10
  SPEAKER_01: That is exactly how the edition puts it.
• 34:13
  SPEAKER_01: The near-term danger is not a fully autonomous attacker.
• 34:16
  SPEAKER_01: It is familiar attacks executed faster, cheaper, and at greater volume.
• 34:22
  SPEAKER_03: And volume is what breaks security teams.
• 34:24
  SPEAKER_03: A team can handle a sophisticated attack now and then.
• 34:27
  SPEAKER_03: What it cannot handle is many times the ordinary attacks with the same headcount.
• 34:32
  SPEAKER_01: The sharpest operational warning concerns vulnerabilities.
• 34:36
  SPEAKER_01: The NCSC warns that AI-assisted vulnerability discovery and exploit development pose a significant threat, putting defenders in a race to shorten the time it takes to deploy patches.
• 34:59
  SPEAKER_01: And the addition stresses the danger is not theoretical.
• 35:02
  SPEAKER_01: AP reported that in October, AI-assisted discovery of two critical flaws in PHP prompted urgent security updates.
• 35:11
  SPEAKER_03: And a flaw in a widely used language is the kind of thing that ends up in places you did not know about.
• 35:16
  SPEAKER_01: The physical stakes are already visible, too.
• 35:18
  SPEAKER_01: AP reported that the UK and EU member states attributed a December 2025 attack on Poland's energy grid to Russia's FSB.
• 35:27
  SPEAKER_03: Which connects back to ADNOC in an uncomfortable way.
• 35:31
  SPEAKER_03: Energy companies are wiring agents into their most important decisions at the same time that energy infrastructure is a demonstrated target.
• 35:39
  SPEAKER_01: That is a sharp connection, and notably the ADNOC deal does include cyber defense work.
• 35:44
  SPEAKER_01: Now, the NCSC adds two organizational warnings.
• 35:47
  SPEAKER_01: First, it is almost certain a widening digital divide will emerge between organizations that can adopt AI for defense and those that cannot.
• 35:55
  SPEAKER_01: Second, the use of shadow AI will highly likely leave organizations open to exploitation.
• 36:01
  SPEAKER_03: Shadow AI is the one I would focus on internally.
• 36:05
  SPEAKER_03: Employees using tools nobody approved, pasting things into services nobody vetted.
• 36:10
  SPEAKER_03: You cannot defend what you do not know exists.
• 36:29
  SPEAKER_01: So the picture is not a wave of new attack types, it is old doors being found and opened faster.
• 36:36
  SPEAKER_03: And that is actually good news for a board if they choose to hear it.
• 36:40
  SPEAKER_03: Known weaknesses are fixable.
• 36:42
  SPEAKER_03: You know what patching is, you know what an asset inventory is.
• 36:45
  SPEAKER_03: Nobody needs a new discipline here.
• 36:47
  SPEAKER_03: What they need is to fund and measure the disciplines they already have at the speed the attackers are now working.
• 36:54
  SPEAKER_03: That is less glamorous than buying a new platform, but it is where the risk actually sits.
• 36:59
  SPEAKER_01: Let me test the digital divide point with you.
• 37:02
  SPEAKER_01: Isn't there a risk that this becomes an excuse to buy more security AI products, whether or not they help?
• 37:09
  SPEAKER_03: There is absolutely that risk, and I think the addition guards against it, because the strategic takeaway is about measuring outcomes, patch speed and coverage, not about buying tools.
• 37:21
  SPEAKER_03: Defensive AI that does not shorten your time to patch is just another dashboard.
• 37:26
  SPEAKER_01: Then there is the human voice in the review.
• 37:28
  SPEAKER_01: Dr.
• 37:29
  SPEAKER_01: Richard Horn, chief executive of the NCSC, was blunt about where responsibility sits.
• 37:35
  SPEAKER_01: He said, and I'm quoting the addition here, for decades we have collectively got away with doing tech on the cheap.
• 37:43
  SPEAKER_03: That is a remarkable thing for the head of a national cyber agency to say out loud.
• 37:47
  SPEAKER_01: And in his foreword, Horn writes that AI makes cyber attacks easier, faster, and cheaper.
• 37:54
  SPEAKER_01: That AI did not create these weaknesses, but revealed them.
• 37:57
  SPEAKER_01: And that the tools and frameworks needed to protect against AI-powered attacks already exist.
• 38:07
  SPEAKER_03: I think that is the most important sentence in the story.
• 38:10
  SPEAKER_03: The problem is the backlog of technical debt that organizations have been carrying, and AI simply makes that debt more expensive to carry.
• 38:19
  SPEAKER_01: The government is also putting money behind this.
• 38:21
  SPEAKER_01: It is funding the first phase of a national cyber shield with 60 million pounds, and a national exposure and real-time vulnerability center with 70 million pounds.
• 38:31
  SPEAKER_01: And Security Minister Dan Jarvis said the government is using AI to help stay ahead of those who seek to do harm.
• 38:39
  SPEAKER_03: So the message for boards beyond Britain?
• 38:42
  SPEAKER_01: The edition says the deadline is no longer hypothetical.
• 38:45
  SPEAKER_01: A national intelligence agency has named a two-year horizon, and its own data shows that most of the damage still flows through known weaknesses.
• 38:54
  SPEAKER_01: AI raises the speed at which those weaknesses are found and exploited, which makes patch velocity and asset visibility board-level metrics rather than IT housekeeping.
• 39:05
  SPEAKER_03: Board level metrics rather than IT housekeeping?
• 39:09
  SPEAKER_03: I would push that further.
• 39:11
  SPEAKER_03: If your board receives a cyber report that is a list of tools purchased and training completed, it is getting the wrong report.
• 39:20
  SPEAKER_03: It should be getting how long it takes you to patch a critical flaw and what share of your internet-facing systems you can actually see.
• 39:28
  SPEAKER_01: The strategic takeaway is addressed to CISOs, chief risk officers, and boards of critical infrastructure operators.
• 39:35
  SPEAKER_01: Plan against a 2028 horizon for AI-assisted ransomware and measure what AI accelerates.
• 39:41
  SPEAKER_01: Time from disclosure to patch, coverage of internet-facing assets, and the inventory of AI tools employees use without approval.
• 39:50
  SPEAKER_01: Fund defensive AI deliberately so your organization lands on the right side of the digital divide, the NCSC describes.
• 39:58
  SPEAKER_01: And the closing line: the frameworks exist, the gap is execution.
• 40:03
  SPEAKER_03: The gap is execution.
• 40:05
  SPEAKER_03: That could be the subtitle of the entire edition.
• 40:08
  SPEAKER_01: It could.
• 40:09
  SPEAKER_01: And that is a good moment to step back and connect the four stories, because the edition's bottom line does exactly that.
• 40:16
  SPEAKER_01: Go ahead.
• 40:17
  SPEAKER_01: Read me the bottom line.
• 40:18
  SPEAKER_01: The edition says that read together, the four stories describe one shift.
• 40:24
  SPEAKER_01: AI is moving from tools people use to agents that act.
• 40:28
  SPEAKER_01: And every institution that touches that shift is adjusting at once.
• 40:32
  SPEAKER_01: AdNOC is pointing agents at the decisions that shape its capital plan.
• 40:36
  SPEAKER_01: Semi-analysis is measuring how often those agents actually succeed at expert work.
• 40:42
  SPEAKER_01: British regulators are telling deployers that the law follows the agent.
• 40:47
  SPEAKER_01: And the NCSC is warning that attackers are using the same acceleration against the infrastructure everyone depends on.
• 40:54
  SPEAKER_03: The law follows the agent.
• 40:57
  SPEAKER_03: That is a phrase I expect to hear repeated.
• 40:59
  SPEAKER_01: And then the common thread, which is accountability.
• 41:02
  SPEAKER_01: The edition says the 12% GDPX ceiling explains why adnoc keeps human experts in charge of consequential decisions, why the ICO insists human involvement must be meaningful, and why the competition markets authority says the business that deploys an agent is responsible for what it does.
• 41:41
  SPEAKER_01: Is that too pessimistic?
• 41:50
  SPEAKER_03: They are going ahead, and I think that is the right call, but they are going ahead with the accountability built in.
• 41:56
  SPEAKER_03: That is the difference.
• 41:58
  SPEAKER_03: Moving fast is not the opposite of accountability.
• 42:01
  SPEAKER_03: Moving fast without it is how you end up as next year's case study.
• 42:06
  SPEAKER_01: And the addition actually makes that argument about speed.
• 42:09
  SPEAKER_01: It says the organizations that move fastest will not be the ones with the most agents.
• 42:15
  SPEAKER_01: They will be the ones that can show for every agent what it is allowed to do, who answers for it, and how quickly they can patch audit or stop it.
• 42:24
  SPEAKER_03: Aaron Powell What it is allowed to do, who answers for it, and how quickly you can stop it.
• 42:28
  SPEAKER_03: If you cannot answer those three for an agent, you do not have an operating model.
• 42:32
  SPEAKER_03: You have a pilot that escaped.
• 42:34
  SPEAKER_01: A pilot that escaped.
• 42:36
  SPEAKER_01: I may borrow that.
• 42:37
  SPEAKER_03: It is yours.
• 42:38
  SPEAKER_03: And it connects to the opening theme.
• 42:40
  SPEAKER_03: The gap between a pilot and an operating model is exactly those answers.
• 42:45
  SPEAKER_01: I think there is one more thread worth naming, which is that each story shows a different institution doing its own part of the accountability work.
• 42:54
  SPEAKER_01: Adnock writes human oversight into the contract, semi-analysis supplies the measurement, the regulators assign the responsibility, and the NCSC sets the deadline.
• 43:05
  SPEAKER_01: None of them can do the whole job alone.
• 43:07
  SPEAKER_03: And the company in the middle has to stitch all four together.
• 43:10
  SPEAKER_03: Your strategy team reads the adnoc story, your evaluation team reads GDPX, your lawyers read the regulators, and your security team reads the NCSC.
• 43:20
  SPEAKER_03: The risk is that each team reads only its own story.
• 43:24
  SPEAKER_03: The value of reading the edition as one piece is seeing that these are the same agent, the same decision, and the same accountability, viewed from four sides.
• 43:33
  SPEAKER_01: The edition's practical agenda for executives is short and urgent.
• 43:38
  SPEAKER_01: Pick bounded, high-value decisions for agents.
• 43:41
  SPEAKER_01: Test them with the rigor of a benchmark rather than a demo.
• 43:45
  SPEAKER_01: Design disclosure and redress before launch, and treat patch speed as a board metric.
• 43:51
  SPEAKER_01: Its last line is that the window between capability and consequence is closing on every front at once.
• 43:58
  SPEAKER_03: So let's make it concrete.
• 43:59
  SPEAKER_03: What should people do this week?
• 44:01
  SPEAKER_01: Four actions, each tied to a story and to a team you already have.
• 44:06
  SPEAKER_01: First, from the ad knock story for your strategy or digital office.
• 44:10
  SPEAKER_01: Before you approve any agent platform purchase, write down the single decision it will accelerate, the data it must connect, and the executive who signs off on its output.
• 44:21
  SPEAKER_01: And write down how you will measure the promised time savings, because they are hypotheses until you measure them.
• 44:27
  SPEAKER_03: Second, from GDPX, for whoever runs your AI evaluation or procurement.
• 44:33
  SPEAKER_03: Add three things to your vendor evaluations.
• 44:36
  SPEAKER_03: Multiple attempts per task instead of one, pass or fail grading on anything high stakes, especially in finance, and planted conflicts, instructions that contradict something already agreed, to see whether the agent escalates or silently complies.
• 44:51
  SPEAKER_03: And ask every vendor which tasks its safety classifiers refuse.
• 44:56
  SPEAKER_01: Third, from the British regulators for legal, compliance, and product together.
• 45:01
  SPEAKER_01: List every customer-facing agent and map it against the regulator's questions.
• 45:06
  SPEAKER_01: Disclosure that an agent is acting, how authority is granted, how data is used, what commercial incentives shape its recommendations, and how a customer gets redress.
• 45:17
  SPEAKER_01: Look hard at any approval screen that might be a rubber stamp.
• 45:20
  SPEAKER_01: And if you operate in Britain, decide this week whether you will respond to the ICO before November 20th.
• 45:26
  SPEAKER_03: Fourth, from the NCSC for the security team and the board's risk committee.
• 45:31
  SPEAKER_03: Put three numbers on the next board report.
• 45:33
  SPEAKER_03: Time from disclosure to patch for critical flaws, coverage of internet-facing assets, and an inventory of AI tools employees use without approval.
• 45:43
  SPEAKER_03: If you cannot produce those numbers, that is the finding.
• 45:52
  SPEAKER_01: And what should we watch?
• 45:53
  SPEAKER_01: The edition names several next tests.
• 45:56
  SPEAKER_01: The first date on the calendar is November 20th, when the ICO call for evidence closes, and that evidence feeds a statutory code of practice on AI and automated decision making.
• 46:07
  SPEAKER_01: Second, the British regulators say they are working with government to identify compliance gaps, so watch for what those gaps turn out to be, and watch whether other jurisdictions copy the method of applying existing law to agents.
• 46:20
  SPEAKER_03: Third, ADOC.
• 46:22
  SPEAKER_03: The value of the deal and the rollout timeline were not disclosed.
• 46:26
  SPEAKER_03: The real test is whether a measured result ever replaces the hours instead of months ambition.
• 46:32
  SPEAKER_03: Fourth, the NCSC's 2028 horizon, and whether organizations actually shorten their patch times before then.
• 46:39
  SPEAKER_03: And I would add the benchmark itself.
• 46:41
  SPEAKER_03: GDPX is a ceiling on today's models, and it will be worth watching how the leaderboard and the refused tasks change.
• 46:49
  SPEAKER_00: That is the edition.
• 46:50
  SPEAKER_00: Four stories, one shift, and one thread running through all of it, which is accountability.
• 46:56
  SPEAKER_03: Agents that act need people who answer for them.
• 46:59
  SPEAKER_03: That is the whole briefing in one line.
• 47:02
  SPEAKER_01: That's the DX Today Executive Briefing for Tuesday, November 3rd, 2026.
• 47:06
  SPEAKER_01: We will be back on Friday with the next edition of the DX Today newsletter.
• 47:10
  SPEAKER_01: I'm Elena.
• 47:11
  SPEAKER_03: And I'm Marcus.
• 47:12
  SPEAKER_03: Thanks for listening to the DX Today Executive Briefing.
• 47:15
  SPEAKER_03: And we'll see you Friday.