US ban on chinese AI and EU compliance fears spur governance caution.
US bans chinese AI tool DeepSeek.
In a landmark move, the US Department of Homeland Security (DHS) made public an order on 20 October banning Chinese AI startup DeepSeek’s software from all federal civilian agency systems ([1]). The order, issued under supply-chain security powers, requires agencies to immediately remove and cease procurement of any DeepSeek products, including third-party tools built on DeepSeek’s models ([2]). The DHS cited concerns that the company’s AI could transmit sensitive government data back to China and might harbor hidden security vulnerabilities ([3]) ([4]). Chinese officials criticised the ban as a politicisation of technology issues, but US authorities signalled they will aggressively police national security risks in AI supply chains.
This first-of-its-kind ban heightens the onus on organisations to vet the origin and security of AI systems in their technology inventory. Businesses, especially those in regulated sectors or working with governments, should assess whether any AI tools they use might fall under similar scrutiny. Including third-party services built on restricted AI models means governance processes must track not only the tools a company builds internally but also what external AI services and components teams are adopting. This development reinforces the importance of maintaining an up-to-date inventory of AI assets and their dependencies, so that any high-risk tools, or those suddenly caught by new rules, can be swiftly identified and managed.
AI exposes 21‑year‑old web flaw.
A separate incident this week demonstrated how powerful AI systems are reshaping the cybersecurity landscape. On 21 October, multiple government and public services websites across Europe were abruptly taken offline after a critical vulnerability was discovered in PHP, a programming language that runs the majority of websites ([1]). The bug had existed unnoticed in PHP’s code for over two decades and was only uncovered through AI-driven code analysis ([2]). Once news of the flaw broke, hackers reportedly used AI tools to reverse-engineer and exploit it, prompting urgent warnings from security agencies. Governments from the Netherlands to Finland pulled down sites as a precaution while PHP’s volunteer developers raced to release patches ([3]).
The ‘PHP2Shell’ episode is a vivid example of how AI can simultaneously help identify hidden technical risks and accelerate new threats. It highlights the need for companies to bake security into AI governance: maintaining detailed knowledge of critical software and AI components in use, and ensuring they can be quickly patched or isolated during an incident. It also underscores the importance of cross-functional oversight, including cybersecurity teams in AI governance, so that advanced tools introduced by developers do not inadvertently increase exposure. As one technology CEO observed this week, AI is enabling a "race to exploit" software flaws at unprecedented speed ([4]). Effective AI risk management means being prepared to respond just as fast.
Strict EU rules raise compliance concerns.
Meanwhile, an Amazon Web Services (AWS) executive warned that Europe’s approach to AI regulation could be undermining its own innovation ecosystem. Tanuja Randery, AWS’s Managing Director for EMEA, told a Reuters forum on 21 October that many European AI startups are struggling with “tighter regulations, energy constraints and broader concerns about data privacy” and might move their operations abroad ([1]). She noted an internal AWS survey found nearly four in ten European startups would consider relocating to scale their business, a figure that rises to over 50% among the fastest-growing AI firms ([2]). According to Randery, some companies estimate they spend “as much as 40 cents to every euro on regulatory compliance instead of technology”, resources that could otherwise fuel product development ([3]).
Randery’s remarks, directed at both industry and policymakers, reflect a fear that the EU’s forthcoming Artificial Intelligence Act, widely regarded as the world’s most stringent AI law, may inadvertently drive talent and capital elsewhere. Despite more than half of European businesses now using AI, only about one in five have a clear AI strategy, a governance model or transformation processes in place, she said ([4]). This suggests that even as EU regulators press forward with broad compliance obligations, many firms have yet to establish their own internal frameworks for managing AI risk and value. For business leaders, the message is a reminder to calibrate AI governance measures to the level of risk: ensure compliance with new laws and best practices, but avoid over-engineering controls to the point where they hinder innovation and growth.