A hand is laid flat on the surface of a wooden classroom desk covered in children's scribbles and etchings, as a hand belonging to another person paints a blue ink mark on the index finger of the other hand. 

A voter puts his hand on a classroom desk as a polling officer applies indelible ink mark on his index finger at a polling station in a school in Kerala, India on April 26, 2024. (AP Photo/Manish Swarup)

A Misguided Tech Solution is Putting India's Electoral Integrity at Risk

What Counts as Scientific Research? The EU’s Digital Omnibus Could Set the Definition

A collage of images of hands with index fingers in pointing position and squiggly lines.

AI Transparency Starts With the Audience

Illustration from a screenshot of Meta founder and CEO Mark Zuckerberg’s July 14, 2026, deposition.

Illustration from a screenshot of Meta founder and CEO Mark Zuckerberg’s July 14, 2026, 

Eight Years On, Cambridge Analytica Scandal Catches Up With Meta in Santa Fe

Shattered black glass with some pixelated white and colored lights shining through.

Photo of a broken laptop screen, by Leon Brocard on 

Artificial or ‘Super Intelligent’? The Broken Metaphors of AI

Sam Altman (seated on top right end), CEO of OpenAI, arrives to speak at a UN Security Council meeting on Artificial Intelligence during the 81st United Nations General Assembly, United Nations Headquarters, NY, September 23, 2026. (Photo by Anthony Behar/Sipa USA)(Sipa via AP Images)

What Non-Western Governments Said About AI at the UN

A massive ship loaded with several dozen yellow trucks is docked by a port. A cement truck is lifted above the ground by a loading crane. The name of the ship is Chinafrie Happiness. This is written with white letters on the side of the ship. 

Chinese engineering vehicles are loaded onto a China-Africa liner at Yantai Port in Shandong Province for export to Africa on April 27, 2026. (Photo by Costfoto/NurPhoto via AP)

How China-Africa Relations Are Shaping the Geopolitics of AI

The US Capitol is seen Friday, Sept. 25, 2026, in Washington. (AP Photo/Mariam Zuhaib)

Google Ad Tech Remedies Show Need for Legislation

Prime Minister Anthony Albanese speaks to the media at Parliament House on September 8, 2026 in Canberra, Australia. The Albanese government is preparing new digital duty of care laws that would require digital platforms to take greater responsibility for preventing and addressing online harms. (Photo by Hilary Wardhaugh/Getty Images)

Australia Wants an Off Switch for 'The Algorithm.' That's the Wrong Fix

CEO of OpenAI Sam Altman speaks during a United Nations Security Council meeting on artificial intelligence and international security under “Maintenance of International Peace and Security” on September 23, 2026 in New York City. Tech industry leaders including the CEOs of OpenAI, Anthropic and Hugging Face briefed ambassadors on the risks of artificial intelligence. (Photo by Alexi J. Rosenfeld/Getty Images)

At the UN and in Washington, Leaders Clash on Approach to AI

People walk past posters encouraging participation in the 2020 Census, Wednesday, April 1, 2020, in Seattle's Capitol Hill neighborhood. (AP Photo/Ted S. Warren)

The 'Jenga Politics' Threatening the US Census

Activists dressed as queer versions of Gandalf, the character from Lord of the Rings, protest with a robotic pet Peter Thiel outside the headquarters of German publishing giant Axel Springer on September 24, 2026 in Berlin, Germany. Thiel, a Lord of the Rings enthusiast as well as an entrepreneur and investor who co-founded PayPal and Palantir, received an aware from Axel Springer. (Photo by Sean Gallup/Getty Images)

Gil Durán Maps the Rise of the 'Nerd Reich'

Maddie Freeman stands with her back turned to the side, in front of a billboard advertising her social media detox movement, with a deep blue sky in the background. The text on the billboard says "Get off your phone. Join our Free Tech Detox Movement. NoSoNovember.org". 

Maddie Freeman stands in front of a billboard advertising her social media detox movement, “No Social Media November”, in Denver, Colorado in 2005 (Photo credit: Maddie Freeman)

Meta’s Settlement Deal Won’t Give Me Back the Years I Lost to Social Media

Lord Tom Watson, former Labour deputy leader, speaks to the media on Wednesday January 22, 2025. (Press Association via AP Images)

Palantir's New Senior VP Swaps Lords Pass for Labour Leverage

Illustrative photo captured during the plenary session of October 2025 in Strasbourg, France.

“Behind the scenes - European Parliament in Strasbourg” by 

Europe’s Digital Sovereignty Agenda Must Include Digital Public Infrastructure

Thousands of people dressed in green and yellow rally on a street holding Brazilian flags and a giant balloon shaped like Donald Trump holding a smaller balloon shaped like President Lula wearing a prison uniform. 

Supporters of presidential candidate Flavio Bolsonaro with a President Trump inflatable, holding a doll of President Lula in a prison unifom, during an Independence Day rally in Sao Paulo, Brazil, Monday, Sept. 7, 2026. (AP Photo/Andre Penner)

Brazil’s Presidential Candidates Give Digital Sovereignty Many Meanings

China's President Xi Jinping and President Donald Trump are looking towards the sky, wearing matching suits and ties, as Trump points his finger in the air. Military brass band members are seen in the foreground. 

President Donald Trump and China's President Xi Jinping watch a flyover during a military review in the Rose Garden of the White House, Thursday, Sept. 24, 2026, in Washington. (AP Photo/Jacquelyn Martin)

US Leadership on Open-Weight Models is Key to Global AI Safety 

Immigration and Customs Enforcement (ICE) agents face off with protesters during a shift change outside of Delaney Hall Immigration Detention Center on June 7, 2026 in Newark, New Jersey. (Photo by Adam Gray/Getty Images)

Black Migrants Bear Brunt of ICE's Facial Recognition Push

A group of teenagers hold their cellphones in a circle, Yorkshire, United Kingdom. (Edwin Remsberg / VWPics via AP Images)

Where Does the KIDS Act Fit in the EU’s Digital Rulebook?

European Commissioner for Tech Sovereignty, Security and Democracy Henna Virkkunen. (AP Photo/Marius Burgelman)

Europe’s Digital Sovereignty Has a Funding Gap

Sam Wallace is Head of Corporate Governance, Risk, and Responsible Practice at Partnership on AI (PAI), which published the disclosure recommendations discussed in this article. Dunstan Allison-Hope is an independent consultant, and PAI is among his clients.

Earlier this month, Anthropic published its latest 

, outlining real-world threats the company disrupted and the trends these cases reveal. These threats spanned topics including surveillance (such as a domestic surveillance system monitoring roughly 25 million SIM cards in Mali), cybersecurity and electronic warfare (such as developing software for electronic warfare and suppression of air defenses in China), and conventional weapons (such as developing guidance, navigation, and control software in Yemen).

Anthropic publishes Threat Intelligence Reports to help governments, cybersecurity teams, and peer AI developers identify and disrupt similar threats. The reports also inform evidence-based AI policy by grounding discussions in real-world cases and are part of Anthropic’s approach to corporate accountability.

Amid all the discussion about existential risk, reports like this remind us of the real near-term impacts and how they may evolve. As AI moves into more industries — from healthcare and education to infrastructure and aerospace — it creates new risks and opportunities. The concrete case studies offer far more specificity than “AI-will-kill-us-all” and show how addressing near-term risks also helps prepare for the long term.

Thus, while fascinating in their own right, these Threat Intelligence Reports underscore the need for a more strategic approach to AI-related disclosure, reporting, and transparency. What information about AI should companies publish, for whom, and what decisions might these reports inform? How can we move toward greater consistency and comparability of disclosure across the AI industry and over time, while remaining nimble amid AI's changing dynamics and impacts?

We have both spent decades addressing similar questions in sustainability/ESG reporting, where we have sought to enhance the quality of disclosures companies make on topics such as climate change, human rights, and community impacts. Based on this experience, we believe three key factors should shape a more strategic approach to reporting by AI companies.

Companies should publish reports so that report readers can make informed decisions. However, a challenge in reporting is that multiple audiences need different information to make different decisions.

For example, investors need information about risks and opportunities for a company’s financial position so that they can allocate capital and manage portfolios. Governments need information about the impacts of a company or technology on society and the economy so that they can make good policies and enforce regulation effectively. Civil society organizations need information about a company's impacts on people so they can advocate for human rights protection, social justice, and community well-being. AI researchers need information to inform AI safety and security strategies.

Not all of these needs will be satisfied in a single report; in AI, some readers are interested in the AI model, some in the overall AI system, and some in the corporation.

Two: Focus on material information that helps someone make a decision

A core principle of financial and sustainability reporting standards is that all material information must be disclosed. In formal reporting, information is considered material if its omission, misstatement, or obscuring could reasonably be expected to influence the decisions of the report's primary users.

The challenge for companies is that what the report user considers material varies depending on the decisions they are trying to make and the reader's expertise.

For example, an AI system's performance against various benchmarks may be useful information to AI researchers or customers, but it's unlikely to mean much to investors or policymakers.

Companies often report on programs and practices they have in place. This can be useful, but more high-level information is more likely to be material. What are the real risks, and where do they concentrate in a company's operations and value chain? What is a company’s overall strategy, and how does it compare to its competitors? Who is ultimately responsible for risk management in the company’s management and board, and how is accountability structured?

Much of our work focuses on investors, and there’s a common assumption that investors only care about financial returns. Whether that's true or not, a company’s ability to navigate the AI age depends on a complex set of relationships with customers, governments, society, and natural resources.

 is one example of how risks from public opinion and regulation can quickly snowball into major threats to the AI business. We can only expect more of this as AI revolutionizes additional industries and, inevitably, impacts stakeholders beyond businesses. We all deserve better information from companies about how they are navigating these complex issues.

Three: Apply high standards of information quality

Formal reporting differs from other forms of communication because it should adhere to principles of information quality, such as consistency, comparability, and timeliness. Formal reporting on a regular schedule differs from publishing a blog post or long-form essay every so often, and AI companies should adopt several well-developed reporting principles when shaping their disclosure strategies. For example:

 Use of standardized topics and disclosure formats so readers can track performance over time and benchmark against other companies.

Use of uniform methodologies, reporting boundaries, and categories of information year over year.

 Disclosures should be made on a regular, predictable schedule so information is available when decisions are made.

Information should be organized, clear, and accessible to its intended audience.

Data and qualitative statements should be precise, rigorously calculated, and free from material error or misleading approximations.

Transparency is often promoted as a core principle in responsible AI, but in practice its meaning and implications vary significantly by context. For example, transparency with individual users about their use of an AI application differs greatly from transparency with enterprise deployers about the risks of an AI system, and different again from corporate-level SEC (Securities and Exchange Commission) filings.

Earlier this year, Partnership on AI published draft 

 to help companies identify material information about the impacts, risks, and opportunities associated with AI to include in their financial, sustainability, and other public reports. These draft Disclosure Recommendations 

 and point to a broader question about what information is actually useful to the people making AI-related decisions.

Corporate disclosure is only one part of that question. System cards, regulator-required reports, and incident reports serve different purposes and audiences. A system card may help a technical audience understand model capabilities and limitations, while an incident report may help regulators, companies or researchers understand what went wrong and how to prevent recurrence. Treating all of these forms of disclosure simply as “transparency” can obscure these important differences.

The goal is not only greater transparency in the abstract, but more useful information for specific decisions. We have mapped these different forms of reporting according to their purpose, intended audience, and usefulness to that audience. As AI companies and their stakeholders rush into an agenda of increased transparency, we encourage a more strategic approach.

Most of the attention on the European Union's 

 has gone to what it does to privacy, and to the 

 from more than 130 civil society organizations and unions that it is the largest rollback of digital rights the Union has attempted. Less noticed is a short passage that would, for the first time, write a definition of "scientific research" into the General Data Protection Regulation (GDPR).

That passage's impact extends well beyond data protection. No EU instrument currently defines research in its operative provisions. Copyright law relies on the idea repeatedly, in the 

 for text and data mining and in the treatment of research organizations, without defining it, and the Commission is now 

 on a harmonized copyright exception for research that will need a definition to rest on. So will the forthcoming 

. A definition agreed in the GDPR could become an important reference point for EU legislation.

 in November 2025, in the shape of a new Article 4(38) GDPR:

“any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’”

 between the Industry, Research and Energy (ITRE) and Civil Liberties, Justice and Home Affairs (LIBE) Committees, with Members of the European Parliament (MEPs) 

 (Socialists and Democrats, Estonia) as rapporteurs. Their June 2026 

 left the Commission's definition largely in place.

: MEP Salla's follows the OECD template for research and development (R&D), while MEP Kaljurand's drops the commercial-interest sentence and confines research to autonomous, public-interest work. The argument is now in the 

, tabled in large numbers, that the committees have to work through.

For the researchers, universities and libraries that Knowledge Rights 21 (

) represents, the definition will help determine which activity carries the freedoms the GDPR attaches to research, and which does not.

Some MEPs would delete the definition outright on the grounds that this forms a basis for lighter obligations under GDPR, and so lower data protection. The concern is legitimate. However, removing the definition leaves regulators and courts to draw the boundary case by case, which is the uncertainty researchers already face. A clear statutory definition could provide greater legal certainty than leaving the boundary to case-by-case interpretation.

2. Does building and testing AI count as research?

The Commission’s proposed definition says nothing about artificial intelligence (AI). Several amendments would change that by introducing explicit confirmation that developing, training, testing and validating AI systems can be scientific research where the general conditions are met.

Others (from far-left and far-right parties) actively state that the development, training or optimization of AI should be excluded.

None of this sits easily with what the Commission is saying elsewhere. When Executive Vice President Henna Virkkunen 

 the AI Continent Action Plan in April 2025, her first argument was talent: Europe, she said, has an "unparalleled pool" of it, and 30 percent more AI researchers than the United States. Commissioner Ekaterina Zaharieva has spent the same period 

 for science to choose Europe, with a Choose Europe for Science package now approaching 

The Commission is recruiting AI researchers to Europe and counting them as a strategic asset. That creates a potential tension between the Commission’s AI-in-science policy and a GDPR definition that could exclude core AI development, training or testing from “scientific research”.

3. Research, or research and development?

The deepest split is over how far downstream the definition reaches. The Commission's text expressly includes activity that supports innovation, such as technological development and demonstration, and says research does not stop being research because it also serves a commercial interest. One group of amendments keeps that breadth: some actively confirm that privately funded research is covered, add a reference to competitiveness, or clarify that work inside a company, or feeding later commercial use, is still research.

 that research should be defined "by its purpose, methodology and contribution to knowledge, not by whether it is carried out by academia, public bodies or companies".

Others pull the other way, from the Greens through to ESN, removing the reference to innovation to keep the definition focused on core research.

. European copyright law already separates commercial from non-commercial research in a way that Europe's main competitors (US, China, Japan, Singapore) do not, and that separation makes collaboration between universities and companies harder than it needs to be. A GDPR definition that keeps commercial-facing research inside the boundary, as the Commission's does, is the sounder starting point.

4. Method, and the problem of legislating intention

A separate group of amendments would write in tests for what type of research qualifies. Amendments from the S&D and the Greens would require research to be methodical and systematic; while two EPP amendments would make it "creative and systematic", documented and traceable, and point to the OECD's 

, the standard reference for defining R&D.

There are also calls to obligate publishing, following peer review, with a view to ensuring that the results can subsequently be checked. Much of this tracks the 

 of the EU's two data-protection authorities, which asked for a systematic method, independent conduct and verifiable results. A linked set of proposals would judge research by intent, asking whether it is "genuinely intended" to produce such results.

Worth noting is what nobody disputes: the Commission's text already requires research to follow the ethical standards of its field, with amendments from various MEPs adding respect for participants' autonomy and consent. Those are the safeguards that protect people. The risk lies in tests that a regulator, or a rights holder, can use to second-guess whether a project is "genuine" enough: the kind of open-ended judgment that chills researchers and hands a lever to anyone with an interest in restricting access to their work. Objective, method-based criteria are workable. Subjective tests of intention are not.

A final theme, running through amendments from the S&D, Renew and the Greens group, is that research should be conducted autonomously and free from undue pressure.

A recital from the Renew group would permit commercial and private interests while asking that processing be kept "functionally separated from commercial monetization, tracking, or profiling.” Independence is a real principle of good research and worth stating.

Drawn too tightly, though, a functional-separation test could catch the ordinary public-private research that EU funding policy actively encourages. Such language should protect researchers from interference, not turn collaboration itself into a mark against the research claim.

A workable definition is not hard to describe. It covers research that supports innovation and enables research centers to partner easily with start-ups, scale-ups and industry in general. It is explicit that developing and testing AI can count as research. It rests on objective, method-based criteria rather than judgments about a researcher's intent. And it treats independence as a protection for researchers rather than a disqualification of their partners.

That is close to what the Commission proposed: inclusion of development and innovation, an open definition of methods, a focus on overall goals, and adherence to ethical standards.

The reason to get it right is that the GDPR is not where this definition will stop. Once adopted, it could become a reference point the next time the EU legislates on research, on data, or on copyright, because no other instrument offers such a definition. The two committees are not only deciding how the data-protection rules treat science. They are writing down, for the rest of the body of EU law to borrow, what Europe means by research.

For now, the Omnibus is under negotiation in both the European Parliament and the Council (Member States), with the ambition of finalizing the dossier by the end of the year. Nonetheless, on a dossier with many potential political sticking points, sufficient consensus may still take longer to find.

Illustration from a screenshot of Meta founder and CEO Mark Zuckerberg’s July 14, 2026, deposition in New Mexico v Facebook.

On Friday, a jury in Santa Fe, New Mexico, 

 that Meta, formerly Facebook, misled the public in statements about the Cambridge Analytica data privacy scandal and its policies on hate speech, violence and misinformation. Jurors found 26 of 29 public claims by Facebook and its executives willfully deceptive, including nine concerning its response to the Cambridge Analytica scandal.

 were deposed ahead of the trial, and the state played the videos of the depositions for jurors during the trial, which 

. State attorney Randi McGinn questioned Zuckerberg largely about content moderation, including the company’s "cross-check" list that gave high-profile users such as politicians and celebrities special review. She queried Sandberg on the company's messaging on privacy, the app developer investigation it promised after the Cambridge Analytica scandal, and its handling of hate speech and misinformation.

The jury relied on two figures to count violations, according to the 

. It assigned 2.1 million violations to each of 11 statements that appeared in major news outlets and 1,386,648 to each of 15 statements made through company channels, including its newsroom, executives' Facebook posts, earnings calls and a developer conference, for a total of 43,899,720. The Santa Fe New Mexican 

 that the larger figure roughly equals New Mexico's population and the smaller one reflects an estimate of the state's Facebook users in 2020.

Unlike the jury in the state's child safety case against Meta, which 

 at the $5,000 maximum per violation, this jury decided only liability and the count. State District Judge Francis Mathew will determine how much Meta pays, Source New Mexico 

. In the earlier case, District Judge Bryan Biedscheid's Aug. 6 

 kept the jury's $375 million penalty for 75,000 violations and ordered Meta to pay an additional $567 million into a fund to address harms to the state's youth.

"We disagree with the verdict and will continue to defend ourselves against efforts to distort our record," Meta spokesperson Alex Burgos said in an 

. "Meta's platforms are forums for free expression. We have a First Amendment right to manage those platforms in a way we believe best serves the interests of our community. This means prioritizing free speech, protecting our users' information and giving them control over their data."

The verdict may leave a bad taste in the mouths of other state attorneys general, most of whom 

 Meta from future Cambridge Analytica claims for about $459 million, a provision tucked into the company's $17 billion child safety settlement in August. New Mexico wasn't part of that deal.

"Florida Attorney General James Uthmeier 

 the other AGs of settling for peanuts," said Daphne Keller, director of platform regulation at the Stanford Program in Law, Science & Technology. "New Mexico's stunning jury ruling suggests he may be right."

The visualization below shows each question the jury answered alongside the statement at issue, who made it, the jury's findings and the violations assigned. Readers can filter by topic, speaker or finding, or search the statements.

 debate how to regulate and slow the development of frontier AI, countries across the rest of the world are approaching the question differently.

United Nations General Assembly High-Level Week

 last week, governments called for a greater role in shaping AI rules, expanding access to AI capacity and ensuring that efforts to make AI safer do not deepen existing technological divides. Pakistan, for example, backed calls to pace frontier AI while warning that “pacing must not become a new form of gatekeeping.”

Here is how governments outside the Western AI powers and China approached AI governance during UNGA.

The memorial is seen on the 25th anniversary of the September 11, 2001, terrorist attacks, Friday, Sept. 11, 2026, in New York. (AP Photo/Angelina Katsanis)

Expert Views on Privacy and Civil Liberties 25 Years After September 11

New York City Schools Chancellor Kamar Samuels and Mayor Zohran Mamdani hold a press conference at the Brooklyn STEAM Center on September 2, 2026 in New York. Photo by: NDZ/STAR MAX/IPx

America’s Two Largest School Districts Impose AI Moratoriums

A large number of people take part in a gathering of boats and motorbikes in support of the people of Ceuta on 30 August 2026 in Ceuta (Spain). (Europa Press via AP)

A large number of people took part in a gathering of boats and motorbikes in support of the people of Ceuta on 30 August 2026 in Ceuta (Spain). (Europa Press via AP)

How Disinformation Fueled the Latest Ceuta Mass Crossing

Tech Policy Press - Technology and Democracy

Tech Policy Press is tracking laws and regulations, along with government investigations and litigation, that will shape the rules and accountability for tech companies.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe