VerifiedIntelligence
Right Document, Wrong Edition
Seven stories share one failure: the accurate record was not the governing one.
Seven pieces this week, read together, keep landing on the same gap: an artefact that is genuinely accurate can still be the wrong one to act on. A privacy regulator's narrative report was real, but the binding deadlines sat in an earlier notice. A severity score was real, but three other scorers read the identical flaw differently. A quoted statute was real, but it was the retired edition. On this week's evidence, the pattern appears to be that organisations default to whichever record is easiest to find or most recently published, rather than the one that is actually current and binding. That is a lax inference from seven pieces over seven days, not a law of governance. But in each of these cases, the fix was the same: check the date and the edition, not just whether the source looks official.
This week's featured piece is V.E.R.A. Saturday's account of opening a primary source and still citing a superseded clause, a lesson for boards using AI-assisted research. Read the full analysis
Cybersecurity Governance: The Enforcement Was Five Weeks Earlier
The 30 October Privacy Commissioner report on Manage My Health was not the enforcement action; compliance notices arrived five weeks earlier. Boards should find the document with the date, not the headline.
Orbital Milestones: The Hundredth Is a Count, Not a Date
Rocket Lab's hundredth Electron and launch landed weeks apart. A New Zealand agency, asked under the Official Information Act about a hosted allied network hub, pointed the requester to foreign law.
AI Governance: Nobody Opted In, and the Terms Moved Anyway
Google made ad campaigns eligible for AI Mode, and Mistral narrowed its model's licence; neither asked customers first. The terms that govern a vendor relationship sit in documentation, not press releases.
Open Source Governance: They Deleted the Rule and the Tagging Went Up
The Linux kernel measured its AI disclosure tag at 10.2 per cent of eligible commits, then deleted it rather than keep it unenforced. The rule that holds is the one that's measured.
Zero Trust for Patch Management: Which Field Does Your SLA Read?
One kernel flaw scored 9.8 by its own CVE authority and 8.1 by three vendors. A patching SLA should key to a verifiable fix date, not a contested label.
35 Years Old and Linux Is Still Changing Everything
Linux's year ran from a succession plan for Linus Torvalds to an AI disclosure tag introduced, then withdrawn. Supply chain attacks on tools did more damage than any kernel exploit.
AI Verification: We Opened the Primary and Still Got It Wrong
A verification pass quoted New York's AI law, from its original, since amended text. A citation can be genuine and still describe a law no longer current; checking the edition matters as much as the source.
When a regulator's notice or a legal citation arrives, who in your organisation checks whether it is the current edition before anyone acts?