NeuralWired’s Technology section covers the developments reshaping how the world builds, deploys, and regulates digital innovation. We report daily on the stories driving global conversation in artificial intelligence, big technology companies, startups and venture funding, cybersecurity, consumer gadgets and devices, and blockchain and cryptocurrency.
Our technology coverage goes beyond product announcements. When a major AI model launches, we explain what it can actually do and where its claims are overstated. When a startup raises a large funding round, we look at whether the business behind it can sustain that valuation. When a cybersecurity breach hits the news, we explain who is affected and what comes next, not just what happened. Each article is built from original research into primary sources, including company statements, technical documentation, regulatory filings, and verified data, and is written by our editorial team rather than generated automatically.
Readers come to this section for daily updates on the technology stories that matter globally, from shifts inside major technology companies to emerging tools changing how people work, communicate, and build. Whether you are a founder, an investor, an engineer, or simply someone trying to understand where technology is heading next, NeuralWired’s Technology coverage is built to keep you informed without wasting your time on hype.
How Unsloth Made LLM Fine-Tuning 2x Faster in 2026
ORPO and GaLore, the two research papers rewriting the fine-tuning cost equation, explained for engineers who actually have to ship this.
A year ago, fine-tuning a 7-billion-parameter model meant renting a multi-GPU cluster and budgeting a few hundred dollars before you’d trained a single epoch. In 2026, the same job runs on one RTX 4090 sitting under a desk. That shift didn’t come from a single breakthrough. It came from two 2024 research papers, ORPO and GaLore, finally getting packaged into tools like Unsloth that engineers can install with one pip command.
If you’re building AI features and fine-tuning still feels like a research project rather than a Tuesday afternoon task, this is the update that changes that math. Here’s what ORPO and GaLore actually do, what Unsloth adds on top, and where the “70% less memory” claim holds up and where it doesn’t.
Neither ORPO nor GaLore is new. ORPO came out of KAIST AI in March 2024 and was presented at EMNLP 2024. GaLore came out of a separate research group the same month and went to ICML 2024. Neither one made headlines outside the research community when it launched.
What’s new is adoption. Unsloth, the open-source fine-tuning library built by brothers Daniel Han and Michael Han, spent 2025 and 2026 turning both techniques (plus QLoRA and GRPO) into something you can run without reading either paper first. In May 2026 the company shipped Unsloth Studio, a no-code web interface sitting on top of the original code-based Unsloth Core, and it now supports more than 500 model families with GGUF and safetensors export built in.
Then, in a joint post published in May 2026, Unsloth and NVIDIA detailed a fresh round of optimizations built specifically for NVIDIA hardware: caching packed-sequence metadata for a 14.3% speed gain, double-buffered async gradient checkpointing for another 8%, and MoE routing fixes that made gpt-oss training 15% faster. Combined, the collaboration pushed total training speed up roughly 25% on top of Unsloth’s existing 2 to 5x baseline speedup, with zero reported accuracy loss. NVIDIA’s own RTX AI Garage blog, published in December 2025, independently walks through fine-tuning on RTX desktops and the DGX Spark using Unsloth, which matters because it’s a hardware vendor validating a third party’s performance claims on its own silicon, not just the vendor marking its own homework.
That’s the real 2026 story: two years of academic groundwork finally has an on-ramp a solo developer can use on a Tuesday afternoon.
What Is ORPO?
ORPO (Odds Ratio Preference Optimization) is a fine-tuning method from KAIST AI that folds preference alignment directly into the supervised fine-tuning step. It uses an odds-ratio penalty to push a model away from disfavored responses while it’s still learning the task, so there’s no separate reference model and no separate RLHF or DPO stage afterward. One training pass does both jobs.
Every alignment method before ORPO, including DPO, needed a frozen copy of the base model sitting in memory the whole time as a reference point. That reference model roughly doubles your memory footprint and adds a second training phase after SFT. ORPO’s authors, Jiwoo Hong, Noah Lee, and James Thorne, showed in their EMNLP 2024 paper that you can skip that step entirely and still land competitive results. Their Mistral-ORPO checkpoints, tuned at 7B parameters, beat several 13B-class RLHF and DPO models on AlpacaEval 2.0 and MT-Bench, at a fraction of the training cost.
What Is GaLore?
GaLore (Gradient Low-Rank Projection) keeps full-parameter training intact but periodically compresses the optimizer’s gradient states into a low-rank subspace using SVD, then decompresses before the weight update. Unlike LoRA, it never freezes the base weights. It shrinks the optimizer’s memory footprint, not the model’s learning capacity.
That distinction matters more than it sounds. LoRA saves memory by training a small adapter instead of the full model, which is fast but limits what the model can actually learn. GaLore saves memory a different way: it keeps training every parameter, but stops Adam’s momentum and variance tracking from eating your GPU alive. The original paper reports up to 65.5% lower optimizer-state memory, and an 8-bit variant pushes that to 82.5%, enough to pre-train a 7B model on a single 24GB consumer card without offloading or model parallelism.
How Unsloth Stitches It Together
Unsloth doesn’t reinvent ORPO or GaLore. It rewrites the backpropagation math by hand and compiles custom Triton kernels so that whichever method you pick runs closer to the metal, with less wasted VRAM and fewer redundant computations. That’s the whole pitch: research techniques, production kernels.
Method
What it optimizes
Trade-off
QLoRA
Adapter size (4-bit base + small adapter)
Fastest, cheapest, but limited learning capacity
GaLore
Optimizer memory, full-parameter training preserved
Still SVD overhead; convergence guarantees still being formalized
DPO
Alignment quality via reference model
Needs a second training stage and doubled memory
ORPO
Alignment folded into SFT, no reference model
Newer, less battle-tested at very large scale
GRPO (via Unsloth)
RL fine-tuning VRAM, roughly 80% lower
More complex reward-model setup
For reinforcement-learning-style fine-tuning specifically, Unsloth’s GRPO implementation claims roughly 80% lower VRAM use, which is the piece most relevant to anyone fine-tuning reasoning models this year.
The Numbers, Checked
Here’s what’s independently verifiable versus what’s self-reported. Worth knowing the difference before you quote either in a pitch deck.
Claim
Source
Status
ORPO 7B beats some 13B RLHF/DPO models on AlpacaEval 2.0 / MT-Bench
EMNLP 2024 paper
Peer-reviewed
GaLore cuts optimizer memory up to 65.5% (82.5% at 8-bit)
ICML 2024 paper
Peer-reviewed
Unsloth: 2 to 5x faster, up to 70% less VRAM, no accuracy loss
Unsloth GitHub
Vendor-reported, community and NVIDIA-corroborated
NVIDIA collab: ~25% additional training speedup
Unsloth/NVIDIA joint blog, May 2026
Vendor-reported, benchmarked with named test setups
PEFT library downloads exceeded 12M/month by Q3 2025
Industry market report
Third-party estimate, not company-audited
The vendor-reported numbers aren’t fabricated. Unsloth publishes its benchmark methodology, and NVIDIA has now run its own tests on Blackwell and RTX hardware that land in the same range. But nobody has published an adversarial, apples-to-apples third-party benchmark suite across model families that reproduces the exact “70%” figure independently. Treat it as strongly corroborated, not audited.
What the People Who Built This Actually Think
The ORPO team’s own framing, drawn from their published paper rather than a press quote, is that the odds-ratio penalty is a deliberately simple way to separate preferred from rejected output styles without the overhead of a second alignment stage. It’s since become a standard baseline cited across dozens of 2025 and 2026 preference-optimization papers.
LoRA substantially underperforms full fine-tuning on the target task at standard ranks, even though it forgets less of what the base model already knew.
Position documented by Dan Biderman, lead author, “LoRA Learns Less and Forgets Less,” Databricks Mosaic AI Research / Columbia University, TMLR 2024. arxiv.org/abs/2405.09673
That’s the most cited counterweight to the “faster and better” framing you’ll see in most 2026 fine-tuning content, and it’s the reason this article isn’t calling either technique a free lunch.
LoRA is advantageous for preserving a model’s original capabilities, while full fine-tuning remains better suited to learning substantially new tasks.
Position documented by Sebastian Raschka, PhD, independent machine learning researcher and educator. magazine.sebastianraschka.com
Raschka’s framing is the practical takeaway most teams actually need: the method you pick should follow from whether you’re teaching the model something genuinely new or just steering a capability it already has.
Where the Free Lunch Ends
Three things worth knowing before you commit a roadmap quarter to this stack.
Low-rank methods still cost accuracy on the target task
Biderman’s team found full fine-tuning uses perturbations with a rank roughly 10 to 100 times greater than typical LoRA setups. That gap is exactly where target-domain accuracy leaks out. If your task is narrow and you need every point of accuracy, don’t assume “efficient” and “as good as full fine-tuning” are the same claim.
GaLore’s convergence guarantees are still being formalized
Multiple 2025 and 2026 papers, including one called “GUM” (GaLore Unbiased with Muon) and another called MLorc, have identified bias in GaLore’s low-rank gradient projection relative to full-parameter optimization. The method works well in practice. The formal proof that it always will is still an open research problem, not a closed one.
Catastrophic forgetting hasn’t gone away
A body of 2024 through 2026 research, including work on O-LoRA and mean-field attention dynamics, confirms that these efficiency methods reduce but don’t eliminate the risk of a fine-tuned model degrading on tasks outside its training domain. Hold out an eval set that has nothing to do with your fine-tuning target and check it after every run. It’s the cheapest insurance in the entire pipeline.
Our read: the 2026 story isn’t that fine-tuning got free. It’s that the cost dropped low enough that skipping the eval step is now the more expensive mistake, not the training run itself.
Should You Actually Use This?
If you’ve been leaning entirely on prompt engineering because fine-tuning felt too expensive to justify, that calculation has changed. A narrow, repeated task, think structured extraction, tone control, or domain vocabulary, is now cheap enough to test against a small fine-tuned model instead of an expensive frontier API call on every single request.
What hasn’t changed: speed and memory gains are a training-efficiency story, not a data-quality fix. A 70% memory reduction does nothing for a model trained on inconsistent labels. Decide whether you need full fine-tuning, LoRA, or ORPO-style alignment based on your task, not based on which one made the best headline this month.
FAQ
What is ORPO in LLM fine-tuning?
ORPO (Odds Ratio Preference Optimization) is a technique from KAIST researchers that combines supervised fine-tuning and preference alignment into a single training step, using an odds-ratio penalty to favor preferred responses. It removes the need for a separate reference model or alignment phase entirely.
What is GaLore and how does it save memory?
GaLore keeps full-parameter training intact while projecting the optimizer’s gradient states into a low-rank subspace through periodic SVD. That cuts optimizer-state memory by up to 65.5%, enough to train a 7B model on a single 24GB consumer GPU.
Is ORPO better than DPO?
ORPO removes the reference model DPO requires, cutting memory use and training steps. Its authors showed ORPO-tuned 7B models beating some 13B RLHF and DPO-tuned models on standard benchmarks. It’s not universally better, though. DPO remains more studied for certain alignment tasks.
Does fine-tuning with LoRA hurt model accuracy?
Research from Databricks Mosaic AI found LoRA underperforms full fine-tuning on the target task at standard ranks, though it preserves the base model’s original capabilities better. The trade-off is real: cheaper training can cost target-domain accuracy.
Can you fine-tune a 7B model on a single GPU in 2026?
Yes. Tools combining QLoRA-style quantization, GaLore-style gradient projection, and Unsloth’s optimized kernels let developers fine-tune 7B to 14B models on a single consumer GPU such as an RTX 4090, a shift from the multi-GPU clusters this required just a few years earlier.
What This Means Going Forward
ORPO and GaLore aren’t 2026 inventions. They’re 2024 research that finally has production-grade tooling wrapped around it, and that’s a more useful story than a fake breakthrough would have been. What to watch over the next 6 to 18 months: whether GUM or MLorc-style fixes to GaLore’s convergence bias make it into mainstream libraries, whether Unsloth Studio’s no-code path pulls in enough non-research users to shift the “who fine-tunes models” demographic, and whether ORPO or a successor becomes the default alignment step in Hugging Face’s TRL rather than an optional one.
For now, the practical move is simple: pick the method that matches your task, not the one with the best benchmark screenshot, and keep an eval set that has nothing to do with your fine-tuning target. That’s still the difference between a model that works in the demo and one that works in production.
Multimodal AI Enterprise Adoption Is Now the Default
By the NeuralWired Editorial Team · July 16, 2026 · 9 min read
Your next vendor RFP just changed shape. Multimodal AI enterprise adoption is no longer a checkbox feature you evaluate after picking a model, it’s the baseline architecture assumption you build the RFP around. Gartner says 80% of enterprise software will be multimodal by 2030, up from under 10% in 2024. That’s not a slow curve. That’s a rewrite of procurement criteria happening while most teams are still finishing their 2026 roadmap.
Here’s the tension nobody’s resolving cleanly: the same month frontier labs pushed multimodal models to mass-market default pricing, a peer-reviewed study in Nature Medicine found those same models reasoning incorrectly under adversarial testing, even when they landed on the right answer. Adoption and reliability are moving on different timelines. This piece is about both, because you can’t plan around one without the other.
Gartner has now published two forecasts, a year apart, that both point the same direction. In September 2024, Distinguished VP Analyst Erick Brethenoux told the Gartner IT Symposium that 40% of generative AI solutions would be multimodal by 2027, up from just 1% in 2023. By July 2025, the firm went further: 80% of enterprise software and applications will be multimodal by 2030, up from less than 10% in 2024, according to Senior Director Analyst Roberta Cozza.
Multimodal is a fundamental transformation, letting AI shift from supporting individual productivity to proactive, contextual decision intelligence across healthcare, finance, and manufacturing.
Note the small inconsistency across Gartner’s own materials: some releases cite the 2024 baseline as “less than 5%,” others say “less than 10%.” Neither figure changes the shape of the curve, but it’s worth knowing the exact baseline moves depending on which Gartner document you’re reading.
Real-world numbers back the direction, if not the pace. Two recent frontier releases landed within a day of each other on June 30, 2026: Anthropic’s Claude Sonnet 5 became the default model for every free and paid Claude user starting July 1, and Google shipped two new multimodal image models, Gemini 3.1 Flash Image and Gemini 3 Pro Image, through Google AI Studio. Neither company is treating multimodal as a premium add-on anymore. It’s the base tier.
Why enterprises are consolidating around multimodal now
Picture a claims adjuster at a mid-size insurer. Five years ago, that job meant one tool for reading the intake form, another for the damage photos, a third for the call transcript, and a spreadsheet to stitch it all together. Multimodal AI enterprise adoption promises to collapse that into one system that reads the form, looks at the photo, and listens to the call in the same pass. That’s the pitch, and it’s why McKinsey found 88% of organizations now use AI in at least one business function, with generative AI use jumping to 72% from just 33% in 2024.
But adoption and scale are different claims. The same McKinsey survey found nearly two-thirds of organizations haven’t started scaling AI across the enterprise. Most of what gets counted as “multimodal adoption” in market surveys is still pilots, not production.
According to Distinguished VP Analyst Erick Brethenoux, the case for native multimodal architecture is structural: real-world data was never single-format to begin with, and stitching together separate vision, audio, and text models introduces latency and accuracy problems that a unified model avoids.
The Nature Medicine problem: benchmarks lie
Here’s the part the vendor decks leave out. A peer-reviewed study published in Nature Medicine in June 2026, “Evaluating the robustness and readiness of large frontier models in health AI applications,” stress-tested frontier multimodal models, including GPT-5, Claude 3.5, and Gemini 2.5 Pro, on multimodal medical reasoning tasks. Researchers used adversarial perturbations, removing key details from an image or swapping which modality carried the critical information, and found the models frequently reached the correct answer for the wrong reasons. That means faulty reasoning, inappropriate shortcuts, and outright hallucinations were hiding behind passing benchmark scores.
Why this matters for your rollout: A model that scores well on a public multimodal benchmark isn’t the same as a model that reasons reliably when the input is messy, adversarial, or simply real. The Nature Medicine authors concluded that popular health benchmarks don’t reliably measure multimodal robustness at all.
The finding echoes a related pattern documented in Communications Medicine: across 300 doctor-designed clinical vignettes, leading LLMs repeated or built on a single planted fake lab value or diagnosis in up to 83% of cases before any mitigation prompt was applied. Explicit “verify before answering” instructions roughly halved the error rate. They didn’t eliminate it.
One caveat worth flagging for readers who follow this closely: by the time a peer-reviewed paper like this clears review, the exact models it tested are often a generation behind whatever just shipped. That’s a structural limitation of academic AI evaluation, not evidence the newest models are automatically safer. Treat it as a reason for more testing, not less.
The contrarian read: Gary Marcus and the ROI gap
Not everyone is buying the adoption-curve optimism, and it’s worth hearing the strongest version of that case. NYU professor emeritus and longtime AI reliability critic Gary Marcus has argued for months that generative and multimodal systems remain fundamentally unreliable regardless of which lab built them, and that reported enterprise ROI hasn’t come close to matching the capital poured into these systems.
The industry keeps converging on models with essentially the same class of reasoning flaws, no matter how much scale you throw at them, and the spending-to-revenue gap tells its own story.
Marcus has specifically pointed to the Nature Medicine findings as proof that frontier multimodal models “are not ready” for high-stakes reasoning, and he’s not alone in reading McKinsey’s own numbers as a warning sign rather than a victory lap. A companion 2025 McKinsey survey found more than 80% of respondents weren’t yet seeing measurable EBIT impact from generative AI. Adoption curve and value capture are two separate stories, and they get conflated constantly.
Our read: the skeptics aren’t wrong that governance is lagging. McKinsey’s 2026 AI Trust Maturity Survey put the average Responsible-AI maturity score at just 2.3 out of a possible higher band, up only slightly from 2.0 in 2025, with roughly a third of organizations scoring 3 or above on strategy and agentic-AI governance. Capability is outrunning oversight, and that gap is exactly where the Nature Medicine failures live.
What this means for your stack
If you’re the one signing off on the next platform migration, three things follow directly from the research above:
Assume multimodal ingestion by default. Document, image, audio, and video inputs should be evaluation criteria from day one of any vendor RFP, not a phase-two add-on.
Match the use case to the confidence level. Practitioner reporting from July 2026 converges on the same lesson: multimodal pays off in high-friction, measurable workflows like support tickets with screenshots or full-coverage compliance QA, not in low-stakes novelty pilots.
Fund governance at the same pace as capability. If your Responsible-AI maturity score would land near McKinsey’s 2.3 average, that’s your signal to slow autonomous, unsupervised deployment in regulated domains until review processes catch up. NeuralWired’s own reporting on AI code review adoption found a similar pattern: capability scaling faster than the human oversight built to catch its mistakes.
There’s precedent for how this plays out badly. Gartner has separately warned that more than 40% of agentic AI projects will be abandoned by 2027 over cost, unclear value, or inadequate risk controls, and NeuralWired’s reporting on AI agent deployment failures found roughly 70% of agent projects never reach production. Multimodal rollouts are highly likely to follow the same adoption-curve-versus-production-reality gap.
Frequently asked questions
What is multimodal AI in enterprise environments?
Multimodal AI refers to systems that process and reason across more than one data type, text, images, audio, video, and structured data, within a single unified model rather than separate tools per format. Gartner projects 80% of enterprise software will be multimodal by 2030, up from under 10% in 2024.
Why are enterprises investing in multimodal AI in 2026?
Enterprises are consolidating fragmented single-modality tools into unified platforms to cut integration overhead, reduce latency, and enable workflows like reviewing contracts, call recordings, and dashboards together. McKinsey reports 88% of organizations now use AI in at least one business function.
Is multimodal AI reliable enough for high-stakes decisions?
Not yet, based on peer-reviewed evidence. A June 2026 Nature Medicine study stress-tested frontier multimodal models on medical reasoning and found faulty logic, inappropriate shortcuts, and hallucinations under adversarial testing, meaning benchmark scores alone don’t prove real-world robustness.
What’s the difference between multimodal AI and agentic AI?
Multimodal AI is about perception: processing text, images, audio, and video together. Agentic AI is about action: autonomously executing multi-step tasks. Gartner projects agentic AI capability will reach 40% of enterprise applications by the end of 2026, typically built on multimodal foundations.
How much of enterprise AI adoption is still just piloting, not production?
A significant majority. McKinsey found that while 88% of organizations use AI somewhere in the business, nearly two-thirds haven’t begun scaling AI programs across the enterprise, meaning most “adoption” headlines still describe isolated pilots rather than production systems.
What to watch next
The honest version of this story has two halves that both hold up under scrutiny. Gartner’s forecasts describe real, well-documented product availability: multimodal is becoming the default architecture, not a premium tier. The Nature Medicine findings describe something different and equally real: benchmark performance and production-grade reliability are not the same claim, and right now the evidence for the second one is thinner than the marketing around the first.
Over the next 6 to 18 months, watch three things. First, whether McKinsey’s Responsible-AI maturity scores climb faster than the 2.0-to-2.3 pace they’ve shown so far, since that gap is what’s actually gating safe deployment. Second, whether the next generation of academic evaluation catches up to model release cycles, so reliability claims stop lagging capability claims by a full peer-review cycle. Third, whether the 40%+ agentic-AI-project abandonment rate Gartner is forecasting for 2027 repeats itself in multimodal rollouts specifically, or whether the sector learns from the agentic AI stumble first.
None of that means wait. It means build for the workflows where multimodal already earns its cost, and keep governance funded at the same pace as capability.
AI Agent Governance 2026: Why ‘One Size’ Rules Fail | NeuralWiredEnterprise AI / Governance
AI Agent Governance 2026: Why ‘One Size’ Rules Fail
Your AI agent can already read your database, draft an email, and push a config change. The question nobody in the room can answer is who signed off on that, and whether anyone would even notice if it went wrong. That gap has a name now: AI agent governance, and Gartner just told the industry it’s building the wrong kind.
On May 26, 2026, Gartner published research warning that enterprises applying identical governance rules to every AI agent, regardless of what that agent can actually do, are setting themselves up to fail. The firm’s prediction is blunt: by 2027, 40% of enterprises will demote or decommission autonomous AI agents after governance gaps surface the hard way, in production, after something breaks.
If you’re a CTO, CISO, or VP of Engineering deciding what your agent fleet is allowed to touch next quarter, this is the framework everyone else is now quoting. Here’s what it actually says, what the data shows is already happening, and what changes on your calendar because of a deadline that isn’t hypothetical: August 2, 2026.
Most organizations still treat AI agent governance as a light switch: locked down or fully trusted, nothing in between. Shiva Varma, Senior Director Analyst at Gartner and the author of the May 26 research, says that’s exactly the root cause of the failures his team is now tracking.
“Agents operate at different autonomy levels and across different trust boundaries.”
Shiva Varma, Senior Director Analyst, Gartner Gartner Newsroom, May 26, 2026
Apply heavy controls to a document-summarizing agent and you get a bottleneck: delivery slows, and engineers start building unsanctioned workarounds instead of waiting for approval. That’s shadow AI, and it’s a governance failure in its own right. Flip it around and under-restrict a powerful, autonomous agent, and you’ve expanded your attack surface without expanding your ability to see it.
CIO Dive’s follow-up interview with Varma put it more plainly still: a lot of companies simply don’t have agent-specific governance at all, they have one blanket policy stretched over everything.
Gartner’s four autonomy tiers, explained
Gartner’s fix isn’t more governance across the board. It’s proportional governance, matched to what each agent can actually do. The framework splits agents into four tiers by autonomy level, and pairs each with the controls that tier actually needs, not more, not less.
Tier
What the agent does
Governance required
Observe
Read-only access, outputs visible only to the requesting user. Document summarization, retrieval, code explanation.
The third tier is where Varma’s warning gets sharpest. Human-in-the-loop approval only works as a control if it stays meaningful, and under time pressure, approval fatigue quietly turns a real check into a rubber stamp. And the fourth tier carries its own physics problem: once an agent acts on its own, it operates at a speed no human reviewer can keep pace with in real time. That’s why circuit breakers and rollback mechanisms aren’t optional at that level, they’re the only brake left.
Gartner adds one more distinction worth sitting with: autonomy and access scope are two separate dials, not one. An agent can be low-autonomy but high-scope (it touches a lot of systems, but a human approves every move), or high-autonomy but narrow-scope. Risk climbs with either dial, independently.
The data: this is already causing incidents
None of this is theoretical. The numbers from three separate 2026 surveys point the same direction: deployment is outrunning oversight, and it’s already producing damage.
The gap, in four numbers:
88.4% of organizations had at least one AI-agent-related security breach in the past 12 months, per AvePoint’s State of AI 2026 report (750 IT leaders surveyed).
~52% average monitoring coverage across deployed agents, meaning roughly 48% run with no meaningful oversight, per Gravitee’s State of AI Agent Security report (750 senior technology leaders, April 2026).
7.2% of organizations have a single named person formally accountable for agent behavior. The rest call it unclear, informally shared, or simply undiscussed. (Gravitee, same survey.)
62% of organizations now name security and risk, not technical limits, as the top barrier to scaling agentic AI, according to Stanford’s 2026 AI Index, cited by Speakeasy.
Put those together and you get a picture that should worry anyone signing off on an agent rollout: agent fleets roughly doubled in size since December 2025, while monitoring coverage barely moved. The fleet is growing faster than anyone’s ability to watch it.
Anushree Verma, another Senior Director Analyst at Gartner, offers a useful counterweight here. Much of what gets called “agentic AI” in 2026 is still early and experimental, and treating it as more mature than it is can blind teams to what real production deployment actually costs. That matters: some of the governance panic is running ahead of how much genuinely autonomous work is happening yet. But it doesn’t erase the incident numbers above, and it doesn’t change who’s accountable when the agents that are live go wrong.
The August 2026 deadline you can’t negotiate
If your agents touch EU users in employment, credit, insurance, or critical infrastructure decisions, there’s a date on the calendar that matters more than any vendor roadmap. The EU AI Act’s high-risk system obligations reach full enforcement around August 2, 2026, requiring documented human oversight, record-keeping, and audit logging for those systems.
The penalties aren’t symbolic. Fines scale up to €35 million or 7% of global annual revenue, and they apply regardless of where the company is headquartered, as long as outputs reach EU users. Headquarters in Austin doesn’t buy you an exemption if your hiring agent screens applicants in Berlin.
Kiteworks’ 2026 forecast puts a sharper edge on why this matters right now: 63% of organizations can’t currently enforce purpose limitations on their AI agents, and 60% can’t terminate a misbehaving one. An agent you cannot stop is, by definition, an agent without governance. That’s not a compliance nuance, that’s the whole ballgame.
What mature governance actually looks like
The cloud vendors spent Q2 2026 building governance into the product, not bolting it on after. Microsoft made its Agent 365 SDK generally available at Build 2026, pairing it with an Execution Container SDK and Purview data-loss-prevention for agent prompts. Google built its Gemini Enterprise Agent Platform around an Agent Identity and Agent Registry system, giving every agent a cryptographic identity separate from any human user. AWS took the lighter path, leaning on Bedrock AgentCore to get agents into production fast while still offering identity and tool management.
The case study everyone in this space keeps citing is Uber’s internal build: an LLM gateway handling PII redaction and audit logging across every model call, an MCP gateway governing every agent-to-tool connection across more than 10,000 internal services, and an agent identity system with cryptographically attested lineage on every action taken.
Worth saying plainly: that took Uber years and a dedicated platform engineering team whose only job was AI infrastructure. Most companies reading this don’t have that team, and they don’t have that runway either. Uber is proof the model works, not a template you can copy over a weekend.
The skeptic’s case
A fair amount of the loudest governance-urgency content in 2026 comes from companies that sell governance software. The underlying statistics are usually real and independently sourced, but the framing tends to land in the same place: buy the platform. Worth reading the data and discounting the pitch separately.
There’s a sharper irony buried in Gartner’s own research. The firm’s 2026 Hype Cycle for Agentic AI places governance and security tooling on the curve as an early, still-maturing category, not a solved one. Enterprises are being told to urgently adopt governance platforms in a product category Gartner itself flags as immature. That’s not a reason to skip governance. It’s a reason to be honest that the tools for doing it well are still catching up to the sales pitch.
A more pointed critique comes from outside the analyst world entirely. A recent opinion piece put the capability gap bluntly: in practice, today’s AI agents behave less like autonomous employees and more like “junior staffers who work quickly, confidently and often incorrectly.” That’s commentary, not analyst research, but it’s a useful check on any narrative that assumes agents are already reliable enough that governance is the only thing standing between them and full autonomy.
What to do this quarter
You don’t need a platform purchase to make progress before your next planning cycle. Three moves cost nothing but time.
Tier your existing agents. Sort every live agent into Observe, Advise, Act-with-approval, or Act-autonomously. Most teams have never done this classification exercise, and it surfaces mismatches immediately.
Name an owner. Only 7.2% of organizations have done this. It costs nothing and it’s the single most concrete accountability fix available right now.
Check your kill switch. If you can’t answer, in one sentence, how you’d stop a specific agent from acting in the next five minutes, that’s your highest-priority gap, ahead of any new deployment.
Our read: the enterprises that get hurt in 2027 won’t be the ones that moved slowly on agents. They’ll be the ones that scaled fast without ever doing the tiering exercise above, then discovered their most powerful agent had the governance of their least powerful one.
Frequently asked questions
What is AI agent governance?
AI agent governance is the set of policies, ownership structures, and enforcement controls that determine what AI agents are allowed to do, on whose authority, and under what regulatory constraints, covering identity, permissions, monitoring, and accountability for systems acting on a company’s behalf.
Why does AI agent governance matter in 2026?
Gartner found 62% of organizations now cite security and risk, not technical limits, as their top barrier to scaling agentic AI. AvePoint reports 88.4% had at least one agent-related security incident in the past year, and roughly 48% of deployed agents run without adequate monitoring.
What happens if a company doesn’t govern its AI agents?
Gartner predicts 40% of enterprises will demote or decommission autonomous AI agents by 2027 after governance gaps surface through real incidents. Ungoverned agents also create direct EU AI Act exposure, with fines reaching €35 million or 7% of global revenue for high-risk systems.
What are Gartner’s four AI agent autonomy levels?
Observe (read-only, lightweight controls), Advise (drafts a human reviews and executes), Act with Approval (agent acts only after human sign-off on each action), and Act Autonomously (independent execution within guardrails, monitored through exception review, rollback, and circuit breakers).
When does the EU AI Act apply to AI agents?
High-risk obligations under the EU AI Act, covering agents used in employment, credit, insurance, and critical infrastructure, reach full enforcement around August 2, 2026, requiring documented human oversight, audit logging, and conformity assessments regardless of where the company is headquartered.
Who is responsible for AI agent behavior inside a company?
Currently, almost no one, formally. Only 7.2% of organizations report having a single named individual with accountability for agent behavior, according to Gravitee’s April 2026 survey of 750 senior technology leaders. Most describe accountability as unclear or undiscussed.
Where this goes next
Here’s what you now know that you didn’t ten minutes ago: governance isn’t a checkbox you add after deployment, it’s a dial you set per agent, based on what that agent can actually touch and how fast it can act. Uniform rules break in both directions, over-restricting the harmless agents and under-restricting the dangerous ones.
Watch three things over the next 6 to 18 months. First, whether Gartner’s 40%-decommission prediction starts showing up as real earnings-call language from enterprises walking back agent rollouts. Second, whether the governance platform market (projected past $1 billion by 2030) actually matures fast enough to catch up with the Hype Cycle placement it currently sits at. Third, how EU regulators enforce the August 2026 deadline in the first few months, since the first fine or the first quiet non-enforcement will set the tone for everyone watching from outside the bloc.
None of this requires a platform purchase to start. Tiering your agents and naming an owner are free, and they’re the two moves most companies still haven’t made.
Want this kind of breakdown in your inbox? Subscribe to The Neural Loop at neuralwired.com/newsletter for the enterprise AI stories that matter, before they hit everyone else’s feed.
Cybersecurity Board Oversight Is Still Broken, Gartner Data Shows
In June 2026, Gartner analyst Sam Olyaei stood in front of a room of security executives at the Security & Risk Management Summit and compared boardroom cybersecurity oversight to renewing car insurance: a checklist item nobody enjoys, filed away and forgotten until something breaks. Ten years ago, that comparison would have been unremarkable. In 2026, it’s a problem, because the data now shows boards are paying attention. They just aren’t acting on what they hear.
That’s the uncomfortable core of this year’s cybersecurity board oversight story. Ninety three percent of board members now agree cyber risk threatens shareholder value. Ninety eight percent expect the threat to grow within two years. And yet only 29% of directors describe the cybersecurity updates they receive from their CISO as “very effective.” Something is breaking down between recognition and response, and the gap is costing companies real money, real fines, and in at least one case this year, a CEO’s job.
Start with the number that shows up in nearly every cybersecurity pitch deck: $10.5 trillion. That figure comes from Cybersecurity Ventures, which projected global cybercrime damages would hit $10.5 trillion by 2025. It first appeared in the firm’s 2016 “Hackerpocalypse” report and has been recycled in thousands of vendor blogs and conference keynotes since, usually presented as a live 2026 statistic. It isn’t. It’s a 2025 projection, and the firm behind it has quietly revised its own math.
Founder Steve Morgan has started publicly correcting the record. Other outlets, he says, kept applying his firm’s older 15% annual growth rate to produce headline-grabbing but unsustainable numbers, like claims of $23 trillion by 2027. Cybersecurity Ventures now projects a much slower climb, expecting cybercrime costs to plateau at roughly 2.5% annual growth through 2031, reaching $12.2 trillion rather than the runaway trajectory bloggers have assumed.
Why this matters for your board deck: If you’re still citing “$10.5 trillion in 2026,” you’re citing a 2025 figure with a growth assumption its own author has walked back. The honest framing is $10.5 trillion in 2025, climbing toward $10.8 to $12 trillion in 2026 depending on which tracker you trust, since no government body audits a global cybercrime total the way GDP gets measured.
That distinction matters because it sets the tone for everything downstream. Cybersecurity board oversight built on an inflated, unaudited headline number invites the exact dismissal Olyaei described: another scary statistic, filed and forgotten.
What a Breach Actually Costs in 2025 and 2026
The more useful number for board decks comes from IBM’s Cost of a Data Breach Report 2025, built with the Ponemon Institute from 600 breached organizations surveyed between March 2024 and February 2025. The global average breach cost fell to $4.44 million, down 9% year over year, the first decline in five years. IBM credits AI-accelerated detection and containment for the drop.
The U.S. number moved the opposite direction. American companies paid a record $10.22 million per breach on average, up 9%, driven by regulatory penalties and slower detection timelines. Read those two numbers side by side and a pattern emerges: AI is helping companies find and contain breaches faster almost everywhere, but in the U.S., the cost of getting caught by regulators is rising faster than the cost of the breach itself. That’s a board conversation about legal exposure and disclosure strategy, not just a security operations metric.
The Boardroom Paradox: 93% Concern, 15% Influence
Here’s where cybersecurity board oversight gets genuinely strange. At Gartner’s 2026 Security & Risk Management Summit, analysts presented survey data showing 93% of board members agree cyber risk threatens shareholder value, and 98% expect that threat to grow within two years. Nobody in the room needed convincing that cybersecurity matters.
“How many of you get excited when your annual car insurance premiums come up for renewal? That is how the board has viewed cybersecurity. It’s a regulatory thing. It’s a checklist. It’s an attestation.”
The disconnect shows up hardest in a separate 2026 CISO-Board Engagement Report from IANS Research, Artico Search, and The CAP Group, which surveyed board directors alongside 663 CISOs. Just 15% of CISOs say they help shape company strategy. Ninety five percent brief their boards regularly, more than triple the rate from a decade ago, when only about a quarter of CISOs presented directly to the board at all. But frequency isn’t the same as effectiveness. Only 29% of directors call the reporting they get “very effective,” while 53% land on “somewhat effective,” a polite way of saying it’s not landing.
“Many of the reports that I review are actually structured around cybersecurity, not around the business.”
Worth asking here: is the “boards ignore cybersecurity” narrative actually outdated? The access data says yes. Board attention has never been higher. What hasn’t caught up is the format that attention comes in. CISOs are still walking in with patch counts and mean-time-to-detect charts when the room wants to know what a breach does to next quarter’s earnings.
How Companies Are Routing Around SEC Disclosure Rules
Since December 18, 2023, SEC Item 1.05 has required public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, alongside annual 10-K disclosures of how the board oversees cyber risk. Two and a half years in, the filing data tells its own story about board-level risk appetite.
Disclosure track
Filings since Dec 2023
What it signals
Item 1.05 (mandatory, material)
29 issuers
Company determined the incident was material and disclosed accordingly
Item 8.01 (voluntary, non-material)
50 issuers
Company disclosed without a formal materiality finding
Data from the Debevoise Data Blog’s tracker, cross-checked against SEC EDGAR, shows more companies are choosing the voluntary path than the mandatory one, and most Item 8.01 filings never graduate into a materiality determination at all. Read charitably, that reflects genuine uncertainty about where the materiality line sits. Read less charitably, it looks like boards and general counsel finding a way to disclose just enough to look responsive without triggering the harder four-day mandatory clock. Either way, it’s the SEC filing record making the same point the Gartner survey data makes: boards know the rules exist, and they’re managing around the edges of them rather than building a system that makes the question moot.
Coupang: What Governance Failure Actually Looks Like
If you want the concrete version of “IT line item” thinking gone wrong, look at Coupang, South Korea’s largest e-commerce platform. A former employee left the company in late 2024 without having their cryptographic signing keys revoked. Between June and November 2025, that person used those still-active keys to access roughly 33.7 million customer accounts. Nobody noticed for nearly five months.
Coupang disclosed the breach publicly on December 1, 2025. Co-CEO Park Dae-jun resigned nine days later. South Korea’s Personal Information Protection Commission fined the company 624.68 billion won, about $456 million, on June 11, 2026, a record penalty that regulators explicitly attributed to “a management problem” rather than a sophisticated attack. Roughly 1.2% of the company’s 2025 revenue, in a single fine, for something as basic as offboarding.
That’s the piece easy to miss in trillion-dollar headline coverage: the failure that cost Coupang its CEO and nine figures wasn’t a novel AI-powered attack. It was an access-control checklist item nobody closed out. No amount of board-level financial-risk framing fixes that if the operational basics underneath aren’t handled, which is the honest limitation of every governance-reform pitch, including this one.
The Fix Gartner Is Pushing: Talk Balance Sheets, Not Firewalls
Gartner’s practical answer to the reporting-effectiveness gap is a reframing exercise: present cybersecurity to the board the way a CFO presents financial statements, not the way a SOC analyst presents an incident log. Translate detection and response capability into something closer to a balance sheet. Translate risk exposure into something closer to a cash-flow statement. The goal is a deck a board member without a security background can act on in the room, not one they nod through and forget.
It’s a low-cost fix by enterprise standards, and it’s the one lever CISOs actually control. They can’t single-handedly close the SEC filing gap or force a plateau in cybercrime cost growth. They can change what’s on the slide. Our read: the CISOs who adopt this framing first will be the ones who show up on the 15% “shapes strategy” side of the IANS data instead of the 85% who don’t.
The WEF Global Cybersecurity Outlook 2026, produced with Accenture from responses across 804 executives in 92 countries, adds another wrinkle worth watching: only 16% of organizations running industrial or operational technology environments report OT security issues to their boards at all, and just 20% maintain a dedicated OT security team. If IT risk reporting is inconsistent, OT risk reporting is close to absent, and that’s a blind spot that scales badly for any manufacturer or utility reading this.
What to watch over the next 6 to 18 months
Whether the 29-versus-50 SEC filing gap narrows or widens as enforcement scrutiny increases, following the SEC’s 2024 actions against four companies over materiality gamesmanship.
Whether more CISOs adopt Gartner’s financial-statement reporting model, and whether the 15% “shapes strategy” figure moves in next year’s IANS survey.
Whether OT security reporting to boards rises off its current 16% baseline as regulatory pressure from frameworks like the EU Cyber Resilience Act pushes industrial risk into the same disclosure conversation as IT risk.
Regulatory pressure is already compounding the problem for companies running both IT and connected-device fleets. NeuralWired covered the compliance mechanics in our EU Cyber Resilience Act IoT deadline explainer, and the parallel between the Coupang fine and the fines detailed in our GDPR AI compliance fines roundup is hard to miss: regulators on both sides of the Pacific are converging on the same message, boards own this risk now, penalties included. For a real-world example of how fast an AI-enabled failure becomes a board problem, our writeup of the Arup deepfake fraud case is worth a read alongside this one.
FAQ
Do boards think cybersecurity is a business risk?
Yes. Gartner data presented at its 2026 Security & Risk Management Summit found 93% of board members agree cyber risk threatens shareholder value, but most CISO reporting is still structured around technical metrics rather than business outcomes, which is where the disconnect starts.
How much does cybercrime cost the world in 2026?
Cybersecurity Ventures projected global cybercrime damages would reach $10.5 trillion by 2025, with costs plateauing toward $12.2 trillion by 2031 at roughly 2.5% annual growth, down from the 15% pace assumed in earlier forecasts. Treat it as a directional estimate, not an audited total.
What is the average cost of a data breach in 2025?
IBM’s 2025 Cost of a Data Breach Report found the global average breach cost fell to $4.44 million, a 9% decline credited to AI-accelerated detection, while the U.S. average rose to a record $10.22 million, driven by regulatory penalties and slower detection.
Do SEC rules require companies to disclose cyberattacks?
Yes. Since December 18, 2023, SEC Item 1.05 requires public companies to disclose material cybersecurity incidents on Form 8-K within four business days of a materiality determination, plus annual board-oversight disclosures on Form 10-K.
The Takeaway
Cybersecurity board oversight in 2026 isn’t failing because boards don’t care. The Gartner and IANS data both show the opposite: attention is at an all-time high, and 95% of CISOs now brief their boards regularly, up from roughly a quarter a decade ago. What’s failing is the translation layer, the gap between “93% agree this threatens shareholder value” and “only 15% of CISOs shape strategy.” Coupang shows what happens when that gap meets a basic operational lapse: a $456 million fine and a resigned CEO, for an unrevoked set of keys.
The fix on the table right now, reporting cybersecurity in the language of business risk instead of technical metrics, is neither expensive nor complicated. It’s just not yet standard practice. Watch the next round of SEC filings, the next IANS board-engagement survey, and whether OT security reporting starts climbing off its current 16% floor. Those three numbers will tell you whether 2026 was the year the gap started closing, or just the year it got measured more precisely.
Want the next governance and enterprise-risk story before it hits your feed? Subscribe to The Neural Loop at neuralwired.com/newsletter.
EU AI Act’s Real August 2 Deadline: What Actually ChangesRegulation / EU Tech Policy
The EU AI Act’s Real August 2 Deadline: What Actually Changes
By The Neural Loop Desk · Published July 15, 2026 · 9 min read
Headline options considered:
1. EU AI Act’s Real August 2 Deadline: What Changes
2. ★ The EU AI Act’s Real August 2 Deadline: What Actually Changes
3. EU AI Act August 2026: The Deadline That Actually Bites
If your compliance team has been bracing for “AI Act Armageddon” on August 2, 2026, stand down, but not all the way down. The European Commission just moved the goalposts, and almost nobody outside a handful of Brussels law firms has fully caught up.
The EU AI Act was supposed to hit full enforcement this August, dragging employment screening tools, credit scoring models, and biometric systems into binding compliance overnight. That is not what’s happening. A late-stage amendment called the Digital Omnibus on AI rewrote the timeline in June, and it pushed the hardest part of the law back sixteen months. Meanwhile, a narrower but genuinely consequential set of rules is still landing exactly on schedule.
This piece untangles which is which, because getting it backward either causes needless panic or dangerous complacency, and both are currently happening in boardrooms across the US, UK, and EU.
Three things are real, live, and unaffected by the recent rewrite. Nothing about them moved.
1. GPAI enforcement powers turn on
General-purpose AI providers, think GPT-class models, Claude, Gemini, Llama, and Mistral, have technically been under obligation since August 2025. What changes August 2, 2026 is that the Commission gains the actual authority to investigate, demand documentation, and fine providers who fall short. The ceiling here is up to €15 million or 3% of global annual turnover, whichever is higher, under Article 101, not the €35 million figure you’ll see misquoted everywhere.
2. Article 50 transparency rules land
Any chatbot, emotion-recognition feature, or deepfake generator serving EU users needs clear disclosure language live by this date. This part of the law was never touched by the Omnibus negotiations.
3. National regulators get full teeth
Market surveillance authority transfers to competent authorities in all 27 member states, giving national regulators the power to investigate, order product withdrawals, and levy fines for whatever remains in force.
What Just Got Pushed to December 2027
Here’s the part most existing coverage still gets wrong. The Digital Omnibus on AI cleared its final legislative hurdle on June 29, 2026, when the Council of the EU gave it final adoption. Parliament had already passed it 423 to 57 two weeks earlier. The legislative process is done. Formal publication was expected before August 2, meaning the new timeline governs in practice even in the narrow window before it’s technically in force.
The headline change: Annex III “high-risk” systems, recruitment tools, credit scoring engines, education platforms, biometric identification, now have until December 2, 2027 to comply. That’s roughly sixteen months of breathing room that didn’t exist six weeks ago.
The two-track calendar every compliance team needs:
Track one, due now: GPAI vendor risk review and Article 50 chatbot/deepfake disclosure audits. Track two, due later but not that much later: Annex III conformity assessments, which realistically take 12 to 18 months to complete, meaning December 2027 is closer than the extension makes it feel.
A few other dates worth pinning to your calendar:
August 2, 2028: High-risk AI embedded in already-regulated products, medical devices, machinery, toys, gets its own extended deadline.
December 2, 2026: Watermarking compliance for AI-generated content already on the market before August, a four-month grace period, down from the six months originally floated.
December 2, 2026: A new prohibition takes effect banning AI tools built to generate non-consensual intimate imagery or CSAM, closing a gap the original text never addressed.
August 2, 2027: Member states must have national AI regulatory sandboxes operational.
The Fines, Sorted by Tier
The fine structure hasn’t changed, but which tier applies to what has been the single biggest source of confusion this year. Here’s the full picture in one place.
Violation Type
Maximum Fine
Status
Prohibited practices (Article 5)
€35M or 7% of global turnover
Enforceable since February 2, 2025
GPAI provider violations (Article 101)
€15M or 3% of global turnover
Enforcement powers activate August 2, 2026
High-risk system violations
€15M or 3% of global turnover
Applies once obligations kick in, December 2, 2027
False information to authorities
€7.5M or 1% of global turnover
Already applicable
One quirk worth flagging for SME founders: for small and mid-size companies, the fine is capped at the lower of the euro figure or the percentage, inverting the rule that applies to large firms.
Why Everyone Keeps Citing the Wrong Fine
Search “EU AI Act fines August 2026” right now and you’ll find a wall of articles pairing the €35 million/7% figure with the August deadline. That pairing is wrong for most companies. The €35 million ceiling belongs to Article 5 prohibited practices, which have been enforceable since February 2025, not to whatever activates this August.
“Most organizations are aware the AI Act exists, but very few understand what it actually requires of them. The regulation goes well beyond policy statements. It requires organizations to classify every AI system they operate, document how those systems were built and tested, and maintain ongoing human oversight.”
Robert Gelo, Senior Consultant, Vision Compliance, April 2026 (source)
Gelo’s firm found that 78% of organizations had taken no meaningful steps toward compliance as of April 2026, based on assessments across eight industries. Treat that as directional rather than a scientific poll, it’s a self-selected advisory client base, not a random sample, but the underlying signal lines up with everything else in this piece: confusion about scope, not indifference, is the main driver.
Is This Regulatory Whiplash a Problem?
Rewriting a flagship regulation weeks before its own deadline is not a routine legislative event. It’s the first substantive amendment to the AI Act since it was originally adopted, and it raises a real question about how much businesses should trust any EU tech-regulation date as final.
Academic critics have been pointed about what this pattern reveals. Nicoletta Rangone, who directs the Jean Monnet Centre of Excellence on Sustainable AI for Regulation at LUMSA University, argues that European regulation has increasingly functioned as a stand-in for industrial investment rather than a complement to it, a dynamic she says risks the EU’s long-term technical independence as non-European standards get baked into systems used across the bloc, as detailed in her March 2026 analysis in The Regulatory Review.
Enforcement capacity is the other underexamined limiter. Even the parts of the Act activating this August depend on a European AI Office that critics say is thin on the ground.
“Concerning that hiring is taking so long. There needs to be more staff to carry out these tasks and meet the deadlines under the law.”
Risto Uuk, Head of EU Policy and Research, Future of Life Institute (source)
A Pour Demain review, cited in that same Lawfare report, called for scaling the AI Office’s GPAI-focused staff to at least 160 people by 2030. Recruitment has reportedly been slow, partly because rigid EU civil-service pay scales don’t compete well against private-sector offers for the kind of frontier-model evaluators the job requires. A regulator with real fine ceilings but a thin bench of technical staff is likely to enforce unevenly in its first year, that gap between legal authority and practical capacity is arguably the more interesting story here than the deadline itself.
Industry voices, unsurprisingly, read the whole picture differently.
“The EU set out with strong ambition in the area of consumer protection, but some of these regulatory tools are not helping. You need to lead with innovation; you can’t lead with regulation.”
Fredrik Ekudden, cited via Ericsson context, Fortune, April 2026 (source)
Our read: both things can be true. The compliance burden is genuinely heavier for small firms than large ones, the Commission’s own impact study puts the base cost at up to €240,000 for a one-employee business versus €401,000 for a hundred-employee business, a wildly uneven per-head cost. And the enforcement gap is real. Neither fact makes the August 2 deadline meaningless. It just means the August 2 deadline is a different, narrower thing than the one most headlines describe.
What Compliance Teams Should Do This Quarter
Audit your GPAI vendor exposure. Know which foundation models sit underneath your product, and whether that provider signed the GPAI Code of Practice. Twenty-six organizations have, including Amazon, Google, Microsoft, OpenAI, and Anthropic. Meta has not.
Ship Article 50 disclosure language now. Any consumer-facing chatbot, synthetic-media tool, or biometric categorization feature needs visible AI-interaction disclosure live by August 2, full stop.
Don’t shelve your Annex III work, just re-sequence it. December 2027 sounds distant until you back-plan from a conformity assessment that takes over a year to complete.
Check if you now qualify for SMC relief. The Omnibus extended SME-style protections to small mid-cap companies, a real, actionable change for any organization in the 50 to 250 employee range that assumed it didn’t qualify.
Build a basic AI system inventory if you don’t have one. Research from the Cloud Security Alliance found that over half of organizations lack even this foundational prerequisite for risk classification.
Frequently Asked Questions
Is the EU AI Act fully enforceable on August 2, 2026?
Not entirely. GPAI enforcement powers, Article 50 transparency rules, and full national market-surveillance authority take effect on this date, but most Annex III high-risk obligations, covering employment, credit scoring, and biometrics, were postponed to December 2, 2027 under the Digital Omnibus on AI.
What are the fines under the EU AI Act?
Up to €35 million or 7% of global turnover for prohibited practices, enforceable since February 2025. Up to €15 million or 3% for high-risk system and GPAI provider violations. Up to €7.5 million or 1% for supplying false information to regulators. SMEs are fined at the lower figure, not the higher.
What is the Digital Omnibus on AI?
A package of amendments proposed by the European Commission in November 2025 and formally adopted by Parliament and Council in June 2026. It delays high-risk system deadlines by roughly sixteen months, adds a prohibition on AI-generated non-consensual intimate imagery, and extends SME-style relief to small mid-cap firms.
Does the EU AI Act apply to US companies?
Yes. Its reach works like GDPR’s, it applies to any provider or deployer whose AI system output reaches people in the EU, regardless of where the company is headquartered.
When do high-risk AI rules actually apply?
December 2, 2027 for stand-alone high-risk systems like recruitment and credit tools, and August 2, 2028 for high-risk AI embedded in already-regulated products such as medical devices.
Where This Goes Next
Here’s what changes in how you should be thinking about this law after reading this piece: August 2, 2026 is real, but it’s the GPAI-and-transparency chapter, not the high-risk chapter most companies have been dreading. That one now lands December 2, 2027, and the clock for building an actual conformity program should probably start now regardless.
Watch three things over the next six to eighteen months. First, whether the AI Office actually uses its new GPAI enforcement powers aggressively in year one, or whether thin staffing slows it down as critics predict. Second, whether the Commission’s final high-risk classification guidelines, expected by the end of 2026, tighten or loosen the Annex III scope further. Third, whether other EU digital rules on a similar multi-year runway, the DSA and Data Act among them, start seeing the same kind of late rewrite that just happened here.
164,000 Tech Layoffs in 2026: Is AI Really the Reason?
Over 164,000 tech workers lost their jobs in 2026, and companies keep pointing to AI. On July 13, more than 200 economists and AI researchers, including 16 Nobel laureates, signed a joint statement warning that the disruption is real and accelerating. But the layoff data tells a messier story than either the executives or the alarmists want to admit.
If you’re a CTO, an engineering manager, or a mid-career software professional watching your feed fill up with layoff announcements, you already know the headlines aren’t giving you the full picture. Some of these cuts are genuinely about AI eating tasks that used to require a headcount line. A lot of them aren’t, and the companies making them know it.
The July 13 letter that changed the conversation
Two days before this article published, something unusual happened. Stanford’s Digital Economy Lab, coordinated by economist Erik Brynjolfsson, released a statement titled “We Must Act Now,” and it wasn’t signed by the usual chorus of AI doomers. It was signed by the people building the technology.
Anthropic co-founder Jack Clark signed it. So did Google DeepMind Chief Scientist Jeff Dean and OpenAI CFO Sarah Friar, according to reporting from phys.org. That’s a rare moment: the companies with the most to gain from downplaying AI’s labor impact instead put their names on a warning about it.
The more telling signature belongs to MIT’s Daron Acemoglu, alongside co-laureate Simon Johnson. Both won the 2024 Nobel Memorial Prize in Economic Sciences, and both have spent years pushing back against inflated AI displacement claims. Acemoglu told the New York Times, in comments summarized by Gadget Review, that if AI does to white collar services what robots did to manufacturing, only faster, the results would be seriously disruptive and costly for people’s livelihoods.
That’s a genuine shift in expert consensus. It’s not proof that 2026’s layoffs are AI driven. It’s evidence that the smartest skeptics in the room are less certain than they used to be.
The real 2026 tech layoffs, reconciled
Here’s where most coverage of this story goes wrong: it picks one tracker, quotes one number, and moves on. Different trackers measure different things, and the gap between them matters.
Tracker
2026 figure (through mid-July)
What it measures
Challenger, Gray & Christmas
139,156 tech cuts (of 443,604 total across all industries)
Employer announcements, all U.S. industries, official outplacement data
TrueUp
166,820 to 168,000+
Aggregated public tech-company reports
Layoffs.fyi / SkillSyncer
185,894 across 267 events
Crowd and media-sourced tech layoff events
The “over 164,000” figure sits inside this range and is defensible, but it belongs to the TrueUp and Layoffs.fyi style of tracking, not to any single government statistic. No federal agency publishes a “tech layoffs” category. That distinction matters if you’re citing this number in a board meeting.
The one number worth trusting without caveats: Challenger, Gray & Christmas reports tech sector cuts rose 83% year over year, from 76,214 in the first half of 2025 to 139,156 in the first half of 2026. That’s the acceleration, and it’s the part of the story that isn’t in dispute.
AI itself, as a cited reason, has now topped Challenger’s tracked causes for four consecutive months: March, April, May, and June 2026. Year to date, AI has been cited in 101,743 job cut announcements across every industry, about 23% of all 2026 cuts. Since Challenger started tracking AI as a discrete reason in 2023, the cumulative total sits at 173,568 announcements.
“Tech remains the epicenter of this year’s cuts. AI is the dominant force as companies are restructuring around it, automating roles, and reallocating budgets toward new capabilities.”
Andy Challenger, Chief Revenue Officer, Challenger, Gray & Christmas
Which companies cut the most, and what they actually said
The named cuts tell a more specific story than the aggregate numbers, especially once you read past the headline into the earnings call transcripts and filings.
Oracle: 21,000 jobs cut over the trailing 12 months, about 13% of its workforce, taking headcount from 162,000 to 141,000. Oracle’s own FY2026 filing states that AI adoption “has resulted, and may continue to result, in reductions to our workforce,” making it one of the only companies to put that claim in a legal filing rather than a press quote.
Amazon: roughly 30,000 corporate jobs cut across two rounds (14,000 in October 2025, 16,000 in January 2026). CEO Andy Jassy told staff in a company memo posted to Amazon’s own newsroom that the company would “need fewer people doing some of the jobs that are being done today” as generative AI efficiency gains take hold.
Meta: about 8,000 layoffs in Q2 2026, even as Q1 revenue hit $56.3 billion, up 33% year over year, and 2026 capex guidance climbed to $115 to $145 billion. Mark Zuckerberg admitted the company “miscalculated” the pace of its AI driven productivity gains.
Microsoft: 4,800 jobs cut starting July 2026, concentrated in Xbox, which lost 3,200 roles, about 20% of that division. Chief People Officer Amy Coleman stated directly that “the roles eliminated today are not being replaced by AI.”
Cisco: about 4,000 jobs, 5% of staff, cut in Q4 2026 despite record quarterly revenue of $15.8 billion.
Notice the pattern. Oracle and Amazon explicitly connect the cuts to AI in official documents. Microsoft explicitly says the opposite, in an official document. That contradiction, sitting inside the same news cycle, is the whole story in miniature.
The “AI washing” problem nobody in the C-suite wants to name
OpenAI CEO Sam Altman has publicly used a specific term for what’s happening: AI washing, meaning companies blame AI for layoffs whether or not AI is actually the cause. When the person running the company that makes ChatGPT says this out loud, it’s worth taking seriously.
Deutsche Bank called this in January 2026, months before the wave crested, predicting that “AI redundancy washing” would define the year. Oxford Economics went further that same month, concluding that firms “don’t appear to be replacing workers with AI on a significant scale.” And the Yale Budget Lab, examining the labor market 33 months after ChatGPT’s release, found no measurable link between AI exposure and changes in employment or unemployment.
“The headline is, ‘It’s because of AI,’ but if you read what they actually say, they say, ‘We expect that AI will cover this work.’ Hadn’t done it. They’re just hoping.”
Peter Cappelli, Professor of Management, The Wharton School
Marc Andreessen made a related point to podcaster Harry Stebbings, arguing that most companies “all have the silver bullet excuse: ah, it’s AI,” when the real driver is correcting pandemic era overhiring that left large tech firms staffed 25% to 75% beyond what they needed. Block’s Jack Dorsey is the clearest example in the wild. He initially attributed roughly half of Block’s workforce cuts to AI enabling “a new way of working,” then, under public pressure, acknowledged the company had simply overhired during the pandemic.
Our read: treat every company’s stated reason for a layoff as a claim, not a fact. When the explanation is AI, ask what the company gains from that framing versus admitting a hiring or strategy error. Sometimes the answer is both are true at once.
Why companies are cutting jobs while spending more than ever
Here’s the tension that most coverage skips entirely. Amazon, Microsoft, Alphabet, and Meta have collectively guided 2026 capital expenditure to an estimated $700 billion, nearly double their combined 2025 actual spend, at the same time they’re cutting headcount. This isn’t companies in distress trimming costs to survive. Meta’s revenue is up 33%. Microsoft’s fiscal Q3 revenue hit $82.9 billion, up 18%, with operating income up 20%.
What’s actually happening looks more like capital reallocation. Budget is moving from people to infrastructure, specifically data centers, chips, and model training, and the layoffs function partly as a financing mechanism for that infrastructure buildout rather than a direct cost saving necessity. A Harvard Business Review survey of late 2025 executives found that most AI cited cuts were made on AI’s expected potential, not its demonstrated performance. Companies are laying people off for what they hope AI will do next year, not for what it’s already doing today.
Zoom out to the national labor market and the apocalyptic framing gets harder to sustain. The May 2026 JOLTS report from the Bureau of Labor Statistics showed a 1.1% layoff and discharge rate, with 7.6 million job openings and 5.2 million hires nationally. That’s ordinary churn, not collapse.
June 2026 nonfarm payrolls grew by 57,000, and unemployment held at 4.2%. Professional and business services, the category displacement alarmists flagged first as vulnerable, actually added 36,000 jobs that month and 172,000 since October 2025.
None of this means AI’s labor impact is fake. MIT’s Iceberg Index simulation found that 11.7% of the U.S. labor market, equal to about $1.2 trillion in wages, is already technically replaceable by current AI capability, concentrated in finance, healthcare, and professional services. That’s a capability estimate, not an observed job loss number, and Goldman Sachs has since walked back its own much cited “300 million jobs exposed” projection to a narrower 2.5% near term displacement estimate. The gap between what AI can technically do and what companies are actually doing with it remains wide.
What this means if you work in tech right now
If you’re hiring, expect the freeze on entry level and junior roles to continue. Multiple 2025 and 2026 sources point to new grad hiring drops of 30% to 50% at major tech employers, even as mid-career “AI orchestrator” roles, people who direct and validate AI output rather than compete with it, stay in demand.
If you’re an individual contributor, Challenger’s data shows AI cited cuts concentrated in software engineering, customer support, and QA, the roles built around codifiable, repeatable tasks. The realistic move isn’t panic. It’s upskilling toward judgment, orchestration, and strategic framing, the parts of the job current models still can’t reliably do on their own.
Also worth watching: a 2026 Oliver Wyman CEO survey found 43% of leaders now plan to reduce junior and entry level roles, up from 17% a year earlier. That’s the most concrete, close to source data point on where the entry level squeeze is actually heading.
And a 99% figure from Mercer’s 2026 Global Talent Trends survey of 12,000 executives should give every planner pause: that’s the share who expect AI to cause at least some headcount reduction within two years. Intent, in other words, is nearly universal, even where realized cuts aren’t yet AI driven.
Frequently asked questions
How many tech jobs have been cut in 2026?
Estimates vary by tracker. Challenger, Gray & Christmas counted 139,156 tech sector cuts through June 2026. TrueUp and Layoffs.fyi style aggregators put the tech specific total between 164,000 and 186,000 workers as of mid-July 2026, depending on methodology.
Is AI really causing tech layoffs?
Partly. AI has led all cited layoff reasons for four straight months in Challenger’s tracking, but economists including Wharton’s Peter Cappelli and MIT’s Paul Osterman argue many “AI layoffs” are really pandemic era overhiring corrections using AI as convenient cover.
Which tech companies had the biggest layoffs in 2026?
Oracle (21,000, about 13% of staff), Amazon (roughly 30,000 across two rounds), Meta (about 8,000), and Microsoft (4,800, concentrated in Xbox) are the largest confirmed 2026 cuts among major tech firms.
What is “AI washing” in layoffs?
A term popularized by OpenAI CEO Sam Altman for companies that publicly blame AI for job cuts actually driven by other factors, like overhiring correction or cost pressure, because it plays better publicly than admitting a management error.
The bottom line
2026’s layoff numbers are real, and they’re accelerating faster than they did in 2025. AI is a real and growing factor in a meaningful minority of those cuts. But “AI did this” as a blanket explanation is being used to launder decisions that predate or have nothing to do with actual AI driven task automation: overhiring correction, margin pressure, capex reallocation, investor pressure. Both things are true at once, and the honest read requires holding them together instead of picking a side.
Over the next 6 to 18 months, watch three things. First, whether Challenger’s AI attribution streak extends past four months or breaks, which will tell you if this is a trend or a moment. Second, whether the $700 billion capex wave from Amazon, Microsoft, Alphabet, and Meta actually produces measurable productivity gains, the kind that would validate the layoffs retroactively, similar to the gap NeuralWired identified in its reporting on AI agent deployment failure rates. Third, whether policy responses like California’s new AI workforce tracker turn into anything with teeth, or stay symbolic.
One pattern worth flagging for anyone tracking corporate AI claims broadly: it echoes what NeuralWired found reporting on companies whose AI bets have publicly failed, where the gap between AI’s stated role and its demonstrated results kept showing up as the real story underneath the announcement.
Want the next update on this story, and the rest of NeuralWired’s Big Tech coverage, before it hits your feed? Subscribe to The Neural Loop.
Figures current as of July 14, 2026. Layoff trackers update daily; totals may shift in the days following publication.
By NeuralWired Staff · July 14, 2026 · 11 min read
A pull request lands. An AI agent wrote it, tested it, and merged it. Nobody on the team opened the diff. Six months ago that sentence described a fringe workflow. Today, according to internal data Cursor shared with Business Insider, it describes a rising share of production code shipping across real engineering teams, and AI code review is disappearing faster than most CTOs have had time to build policy around.
This isn’t a hypothetical. It’s happening at companies running GitHub Copilot, Cursor, and a growing field of autonomous coding agents, and the evidence on whether that’s a problem is genuinely split. Some of it is reassuring. Some of it should worry you. This piece lays out both sides, with the receipts.
Start with the trend everyone’s arguing about. Martin Monperrus, a professor at KTH Royal Institute of Technology, published a position paper in June arguing that coding agents have crossed a capability threshold where traditional human code review is no longer a necessary step in a software quality pipeline. It’s worth being precise about what that paper is: an argument, not an audit of production systems. But it’s landed at exactly the moment the data starts backing it up.
GitHub’s own telemetry shows Copilot’s agentic code review, which shifted architecture in March 2026 to actually gather repo context instead of just scanning a diff, has now handled more than 60 million reviews, over one in every five reviews on the platform. Seventy-one percent surface actionable feedback. That’s not a novelty feature anymore. That’s infrastructure.
Then there’s the number that should complicate your assumptions. Microsoft’s .NET team ran GitHub’s autonomous coding agent against the dotnet/runtime repository for ten straight months, from May 2025 through March 2026. It opened 878 pull requests. 535 merged. And of those merged PRs, only 0.6% were later reverted, a lower revert rate than the 0.8% baseline for human-written PRs on the exact same repo. If you’re building the case that agent-written code is inherently riskier, that data point makes it harder than it should be.
Meanwhile the workload math isn’t adding up the way vendors promise. A Digital Applied developer survey from April found engineers now spend 11.4 hours a week reviewing AI-generated code, versus 9.8 hours writing new code themselves. Review, not writing, has become the bigger time sink. And per LangChain’s late-2025 survey of 1,340 practitioners, 57.3% of organizations already have agents running in production, up from 51% a year earlier, with quality cited by 32% as the top blocker to scaling further.
The honest read: “Review is disappearing” is true in the sense that the checkpoint is vanishing at the margins for routine changes. It is not true in the sense of a wholesale industry shift to zero oversight. What’s actually happening looks more like review getting redistributed, sometimes to another AI, sometimes to nobody, and rarely with a documented policy behind the decision.
Where it actually breaks
Here’s the part the optimists skip. CodeRabbit analyzed 470 open-source pull requests and found AI co-authored code carries a 2.74 times higher rate of security vulnerabilities than human-written code, along with 1.7 times more issues flagged as major. Veracode’s testing puts it even more bluntly: 45% of AI-generated code samples introduce at least one known OWASP vulnerability class.
Georgia Tech’s Vibe Security Radar initiative has been tracking this in real time, and the trendline is steep. AI-code-caused CVEs went from 6 in January 2026 to 35 by March, nearly a six-fold jump in two months.
Google’s DORA team gave this phenomenon a name in its 2026 report: the “verification tax.” It’s the second-largest measured effect of AI adoption on delivery, right behind the productivity gain at the individual level, and it describes exactly what that Digital Applied survey found: the time saved writing code is getting eaten by the time spent verifying it.
Revert rate and vulnerability rate are measuring two different things, and conflating them is the single most common mistake in coverage of this topic. Code can ship, work, and never get reverted, while still shipping with a security flaw that simply hasn’t been exploited yet. Microsoft’s revert-rate win doesn’t cancel out CodeRabbit’s vulnerability-rate finding. They can both be true at once.
Data point
Source
What it measures
0.6% revert rate (agent PRs) vs. 0.8% (human PRs)
Microsoft .NET team, 10-month study
Does the code hold up in production
2.74x more security vulnerabilities
CodeRabbit, 470 PR analysis
Is the code secure
45% introduce an OWASP vulnerability class
Veracode
Is the code secure
11.4 hrs/week reviewing vs. 9.8 hrs/week writing
Digital Applied developer survey
Net productivity impact
The $60 billion wrinkle: SpaceX now owns Cursor
Here’s the fact most coverage of this story hasn’t caught up to yet. On June 16, 2026, SpaceX agreed to acquire Anysphere, the company behind Cursor, in an all-stock deal worth $60 billion, the largest acquisition of a venture-backed startup on record. The deal is expected to close in the third quarter of 2026, four days after SpaceX’s own roughly $75 billion IPO.
Cursor is the company at the center of this entire story. It’s the source of the internal data Business Insider used to report that human review is fading. It acquired code-review startup Graphite in December 2025. And its revenue trajectory is wild by any standard: annual recurring revenue grew from around $100 million in early 2025 to roughly $4 billion by June 2026, even as its market share of corporate AI-coding spend slipped from about 41% to 26% over the same window, according to Ramp’s spend data.
Now it’s a subsidiary of a rocket and satellite company. That’s not a footnote. If you’re an engineering leader standardized on Cursor, you now have a governance question that didn’t exist a month ago: does a company built to launch spacecraft have the same incentives around code-review product investment, data handling, and long-term support that a software-native parent would? Ask your vendor rep directly. Get the answer about contractual continuity in writing before your renewal.
What the people building this stuff are saying
The strongest voice on the “this is fine, actually” side is Monperrus himself, who argues the current hybrid model, agents write, humans review, is the weak link.
“The hybrid workflow neither provides meaningful assurance nor scales with AI-assisted throughput.”
Martin Monperrus, Professor, KTH Royal Institute of Technology, arXiv:2606.13175
But the sharpest pushback comes from people who build agent tooling for a living, not outside critics. Mario Zechner and Armin Ronacher, the engineers behind the Pi coding harness in the OpenClaw agent system, told the Wall Street Journal in May that the infrastructure underneath this shift is already showing strain.
“You have infrastructure that’s falling apart, and you have software that’s now very, very buggy compared to before. We can play this game for a couple more months, or maybe even years, but eventually it will catch up to us.”
Mario Zechner, Engineer, Pi coding harness / OpenClaw, via Wall Street Journal
David Mytton, founder and CEO of developer security firm Arcjet, put it more bluntly in a January LinkedIn post covered by The New Stack, warning of what he called coming “big explosions” as vibe-coded applications hit production at scale.
Even Michael Truell, Anysphere’s CEO and the leader of the company most associated with this trend, draws a line. He distinguishes “vibe coding,” accepting AI output without examining it, which he considers fine for prototypes, from responsible agentic engineering at scale, warning that full disengagement from the code builds a shaky foundation. It’s a useful reminder that this isn’t simply vendors versus skeptics. Even the vendor is on record urging caution.
On the practitioner side, General Motors software development manager Suvarna Rane described Copilot’s code review as freeing her team to focus on more complex work as AI-driven code volume increased, a data point that fits the “augmentation, not replacement” camp inside large enterprises.
What engineering leaders should do this quarter
Budget for review, not against it. The 11.4-versus-9.8-hour split means AI adoption is not currently a net time saver once verification is counted. Plan headcount and sprint capacity accordingly.
Separate the model that writes from the model that grades. Cursor’s BugBot defaults to reviewing code with the same model family, Composer 2.5, that generated it, a “grading your own homework” setup CodeRabbit has flagged directly. Use an independent reviewer, human or model, on anything that ships to production.
Track defect-escape rate separately from revert rate. They measure different failure modes. A low revert rate tells you almost nothing about whether you’re accumulating security debt.
Get your Cursor contract terms in writing before Q3. The SpaceX acquisition closes soon. Confirm data handling, roadmap commitments, and pricing protection now, not after.
Distinguish “bad code shipped” from “agent given too much access.” The most severe documented agent-related incident to date, the GTG-1002 espionage campaign, in which hijacked coding agents reportedly executed 80 to 90% of an operation against roughly 30 targets, was an authorization failure, not a code-quality failure. They require different fixes.
Frequently asked questions
Is AI-generated code safe to deploy without review?
Evidence is mixed. Microsoft’s .NET team saw AI-agent pull requests revert less often than human-written ones over a ten-month study, but CodeRabbit found AI co-authored code carries roughly 2.7 times more security vulnerabilities than human-written code. Safety depends on what you’re measuring.
Who owns Cursor now?
SpaceX agreed to acquire Anysphere, the company behind the Cursor AI code editor, for $60 billion in an all-stock deal announced June 16, 2026. The acquisition is expected to close in the third quarter of 2026.
Does GitHub Copilot replace human code review?
No. Copilot’s code review now handles more than one in five reviews on GitHub, but its comments don’t count as a required approval and can’t block a merge alone. It supplements human sign-off rather than replacing it.
What is the DORA verification tax?
It’s Google DORA’s 2026 term for the time developers now spend checking AI-generated code that looks correct but still needs verification, a cost the same report found only partly offset by time saved on writing.
What percentage of code is AI-generated in 2026?
Estimates vary by methodology and company, but multiple 2026 reports put AI-generated code at roughly 25 to 30% of new production code at large tech companies, with some AI-forward teams reporting notably higher shares.
Where this goes next
What you now know that you probably didn’t ten minutes ago: “AI code review is disappearing” is a real, measurable trend at the margins, not a wholesale industry shift, and the evidence for whether that’s dangerous depends entirely on whether you’re measuring revert rates or vulnerability rates. Those are different questions with different answers.
Watch three things over the next six to eighteen months. First, whether DORA’s verification tax keeps climbing as review-light workflows scale, or whether tooling closes that gap. Second, how Cursor’s product roadmap changes under a SpaceX-owned Anysphere, particularly anything touching code-review features. Third, whether more incidents like GTG-1002 surface, which would shift this conversation from a code-quality debate to an access-control one almost overnight.
Our read: the teams that come out ahead here won’t be the ones that eliminate review fastest. They’ll be the ones that figure out, deliberately, which 20% of changes still need a human’s eyes, and build that into their pipeline instead of discovering it after an incident.
Want the next development in this story before your competitors do?
