Reading time ~3 mins

National authorities began enforcing the EU AI Act's staff-literacy duty on 2 August, and the EU has deleted the standard they enforce against. A finance software firm put document-writing agents into production, with a named human signing off every output. BCG's first global AI index places Amsterdam fifth of 61 cities and weights governance above use-case volume. A critical flaw in an open-source AI workflow tool let a hidden instruction run attacker code.

Top signal

National authorities began enforcing the AI Act's staff-literacy duty on 2 August, with no EU-set standard to meet. Authority

The European Commission updated its published questions and answers on AI literacy on 27 July 2026. It confirmed that Article 4 of the EU's AI Act still obliges both suppliers and users of AI systems to take measures supporting AI literacy among staff. National market-surveillance authorities, the bodies each member state designates to police product compliance, began supervising and enforcing that duty on 2 August 2026. The Commission also confirmed that the EU's simplification package removed the prescribed "sufficient" level from Article 4. A separate duty under Article 26 survives unchanged: staff who use and oversee high-risk AI systems must be sufficiently trained for human oversight.

The change is supervisory rather than textual. Removing the prescribed level did not lower the duty; it moved the question of what counts as adequate from Brussels to the authority that opens the file. For a Dutch bank, the literacy standard on the record is now whichever one it set and can evidence. The Netherlands has not yet confirmed which authority would receive such an enquiry. Article 4 carries no fine of its own. But almost every bank also deploys high-risk systems, so a literacy enquiry runs straight into the sanctioned training duty under Article 26.

European Commission

Innovation

A finance software firm put agents into production that draft editable slide decks and spreadsheets. Vendor

OpenAI reported on 10 August that Model ML, a finance technology company, has expanded its use of an OpenAI model in production agents. The agents turn finance briefs and source documents into editable PowerPoint and Excel files. In the customer's own evaluation, the model completed every slide-deck test case and used 36% fewer tokens per spreadsheet than a rival model, tokens being the units AI providers bill by. Both the deployment account and the benchmark come from the model vendor and its customer, with no independent verification and no published method. What survives the model turnover is the output contract: an editable artifact, traceable sources, and a named reviewer signing off assumptions, which is the shape a regulated finance function can actually audit.

OpenAI

Research

Amsterdam ranks fifth in a new global AI index that weights governance and skills above use-case volume. Institute

Boston Consulting Group published its first Intelligent Cities Index, comparing 61 cities across 39 countries on 35 indicators grouped into five domains. Amsterdam placed fifth overall, alongside London, Dubai, New York City and Washington. The scoring gives a quarter of the weight each to outcomes, adoption and enablers such as data, infrastructure, talent and funding, 15% to ways of working and 10% to strategy. BCG reports that 37 of the 61 cities balance physical infrastructure with skills and governance, and that no city performs well on the softer factors alone. BCG built the index for cities rather than companies, but the weighting is borrowable: a high maturity score is arithmetically unreachable by counting deployed use cases alone.

Boston Consulting Group: Intelligent Cities Index 2026 (publication date unverified) (carried forward from 2026-08-07)

On the radar

• A critical flaw in Flowise, an open-source tool for building AI chat workflows, let a hidden instruction inside an uploaded file run attacker-supplied code with the software's own privileges; version 3.1.3 fixes it. National Vulnerability Database