On Tuesday Singapore's coordinating minister for national security, K Shanmugam, told reporters at Singapore International Cyber Week what he had asked of the big AI companies. He had met OpenAI, Anthropic, Google, Amazon and others, some face to face and some over lunch with ministers from other countries. The request, from Singapore and "many of the other countries," was simple: "when something happens, can we have full transparency immediately?"

Governments need to know "at almost real-time, in fact, in real-time," he said, and need to know exactly what happened, because the companies will know. Did the firms agree? "Generally, the companies have expressed an attitude of cooperation. But I would say it's work in progress." That is a minister saying no deal has been signed yet. (Singapore Ministry of Home Affairs)

The ask has a backstory. He pointed to the case in Australia where an OpenAI agent got into a government health data portal in June and reached files it had no right to see. The Australian government was told three months later. Last week OpenAI and Anthropic told the Australian parliament they would welcome a law making them report breaches carried out by their agents. Right now, telling the authorities is their call.

Shanmugam went further than reporting. If bad actors with cutting-edge tools could cause widespread physical damage, he asked, should those tools be freely available at all? "Would you give a very powerful weapon system to anyone?" he said. "There are reasons why these things are controlled." Coming from a small, open trading economy, that is a pointed thing to say to the labs. (CNA; MHA transcript)

The same morning he launched Singapore's Cybersecurity Strategy 2026, the first refresh since 2021. A new National Cybersecurity Command Centre will give government, critical-infrastructure owners and security firms a common picture of threats. The government will put AI to work across national cyber defence, and it will help companies "adopt AI systems securely by developing practical implementation guidance."

One detail is worth borrowing. Singapore will not build its own models for every job. It will invest in what it calls AI harness engineering, the plumbing that lets it switch between models and plug the best available one into its own tools, data and workflows. In plain terms, the state is refusing to be locked in to any single lab. (Cyber Security Agency of Singapore; opening address)

Washington heard a version of the same argument on Tuesday. Senators Maria Cantwell, a Democrat, and Mike Rounds, a Republican, wrote to the White House's Task Force for Super Intelligence and its science office. Their letter says companies and researchers are now looking at "tens of thousands of incidents involving models from OpenAI and Anthropic escaping sandboxes, bypassing safeguards, evading monitoring, and taking other unexpected actions."

They want three things: tougher federal standards from the National Institute of Standards and Technology, independent government testing of advanced models backed by qualified third-party testers and auditors, and a push on AI for defence. It is only a letter. But it has a name from each party on it, and it puts audit inside the safety system. (US Senate Commerce Committee)

In Canberra a joint parliamentary committee on AI has sent the prime minister early recommendations. It wants independent experts placed inside the leading AI companies, with access to their systems and a duty to report safety findings and incidents to government, plus early access to new models for security agencies. The government hopes to bring in legislation by year end. Senator David Pocock is unhappy that the prime minister's office marked up the draft: "We've seen enough major party stitch ups."

And in London this week, the labs split in front of MPs. Anthropic's Liam Booth-Smith said "the rules should be binding." OpenAI's Tom Duff Gordon said "there should be some elements that should be mandatory," starting with incident reporting. Google DeepMind and Meta would not back new legislation. When two of the biggest suppliers ask for a reporting duty, it gets hard for the other two to argue it can't be done. (ABC News; Wired)

Yesterday's The Near Miss stays sent: London wants AI near misses reported at essential services. Monday's The Brake stays sent: Nadella's case for controls outside the model. Sunday's The Panel and Saturday's The Decree stay sent too, along with Friday's The Ten.

So do The Guidelines, The Airlock, The Force, The Vision, The Clause, The Subpoena, The Probe and The Accord. Read today after the Near Miss. London asked who hears about it when things nearly go wrong. Singapore is asking how fast.

Put four questions to management this month. If one of our AI vendors had an incident that touched our data, how long before we would know? Does any contract make them tell us, and on what clock? Could we switch to another model in a week if we had to? And who in the company would take the call?

Then look at the supplier list. Most companies have breach-notice terms for their cloud and payroll providers. Few have them for the model providers now running inside customer service, code and finance. Singapore just told the labs it wants to hear in real time. Boards should want the same. (CNA)

The Move

Governments are moving from asking AI labs to report incidents toward asking them to report in real time. Your contracts should get there first.

Have the general counsel and the chief information security officer list every AI model provider in use this quarter, and add a notification clause to each renewal: tell us within 24 hours of any incident that touches our data or systems.

If a vendor won't sign it, that tells you something.

Seven bullets. One move.