━━━━━━━━━━━━━━━━━━━━━━━━━━

ABOUT THIS EPISODE

━━━━━━━━━━━━━━━━━━━━━━━━━━

Every AI agent your organisation deploys carries a values rulebook that somebody wrote. Usually a handful of researchers, at a Bay Area frontier lab. That is not a governance decision your board consciously made — it is the default your vendors chose for you.

Dr Craig A. Kaplan — PhD with Nobel laureate Herbert A. Simon, founder of Predict Wall Street, and designer of the Democratic AI architecture free at SuperIntelligence.com — spent the last five years arguing this is the biggest architecture problem in AI safety, and that the industry is solving it the wrong way.

━━━━━━━━━━━━━━━━━━━━━━━━━━

CHAPTERS

━━━━━━━━━━━━━━━━━━━━━━━━━━

00:00 Cold open — the AI that destroyed its operator

00:54 What this episode is about

02:20 Working with Herbert Simon at Carnegie Mellon

04:50 When your phone hides your emails from you

11:29 Anthropic's Constitutional AI — a benign autocracy?

16:36 Guardrails, Project Glasswing, community-level safety

27:21 The hedge fund that beat Wall Street with the crowd

34:15 Wisdom AND madness of crowds — the AI amplifier

41:57 Democratic AI — the architecture nobody is building

48:39 When your AI meets my AI — the arbitration problem

52:32 HAL 9000 is the warning, not the prediction

1:00:52 The US Air Force AI that destroyed its operator

1:06:07 The 1956 AI that fooled Bertrand Russell

1:11:35 Bounded rationality vs the AGI marketing problem

1:15:35 Craig Kaplan's predictive judgement

1:19:49 The Bottom Line — for CISOs, boards, procurement

━━━━━━━━━━━━━━━━━━━━━━━━━━

READ + WATCH

━━━━━━━━━━━━━━━━━━━━━━━━━━

Full written analysis on Substack: thecontrollayer.arkava.ai/kaplan-values-podcast

YouTube video version: youtu.be/8F9sr21ELpg

Subscribe to The Control Layer — weekly, free: link.arkava.ai/join

━━━━━━━━━━━━━━━━━━━━━━━━━━

SOURCES CITED IN THIS EPISODE

━━━━━━━━━━━━━━━━━━━━━━━━━━

- Anthropic Constitutional AI — anthropic.com

- Predict Wall Street / iQ Company published figures — iqco.com/about

- Democratic AI architecture (Kaplan) — superintelligence.com

- Herbert Simon and Allen Newell, Logic Theorist (1956) and Human Problem Solving (1972)

- Herbert Simon: Nobel Memorial Prize in Economics (1978), Turing Award (1975) — the only person in history to hold both

- Geoffrey Hinton public statements on p(doom)

- US Air Force AI simulation account (Col. Tucker Hamilton, Royal Aeronautical Society, May 2023, later clarified by USAF as a thought experiment)

- Isaac Asimov, Three Laws of Robotics (1942)

- Meta "personal superintelligence" strategy (Zuckerberg, July 2025)

━━━━━━━━━━━━━━━━━━━━━━━━━━

GUEST

━━━━━━━━━━━━━━━━━━━━━━━━━━

Dr Craig A. Kaplan

Founder, iQ Company (est. 1993)

Founder, Predict Wall Street (est. 2005)

Managing Director, SuperIntelligence.com and iQ Studios

PhD, Carnegie Mellon University — supervised by Herbert A. Simon

━━━━━━━━━━━━━━━━━━━━━━━━━━

HOST

━━━━━━━━━━━━━━━━━━━━━━━━━━

Amer Altaf

Founder & CEO, Arkava

Managing Editor, The Control Layer

arkava.ai · Trusted Intelligence, Tangible Impact

━━━━━━━━━━━━━━━━━━━━━━━━━━

ABOUT THE CONTROL LAYER

━━━━━━━━━━━━━━━━━━━━━━━━━━

The Control Layer is the publication and podcast on how AI, cybersecurity, sovereignty, technology and geopolitics are reshaping who controls the next decade. Every episode closes on a falsifiable predictive judgement from the guest — logged on our public predictions tracker. We come back to test each one publicly on the date named.

━━━━━━━━━━━━━━━━━━━━━━━━━━

FOLLOW

━━━━━━━━━━━━━━━━━━━━━━━━━━

Substack: thecontrollayer.arkava.ai

YouTube: youtube.com/channel/UCLBj_B4T8M4LfgRAMs6VgWA

Subscribe free: link.arkava.ai/join

Most companies are certain the EU AI Act is somebody else’s problem. They are wrong — and the vendor contract they are relying on will not save them.

On 2 August 2026 the EU AI Act becomes enforceable across Europe, and a few weeks out, Brussels moved the headline deadline to 2027 and 2028. The whole market exhaled. In this episode, Amer Altaf sits down with Antonina Burlachenko, Head of Regulatory Consulting at STAR — who audits and certifies these systems for a living — to explain why that exhale is the trap.

If your company runs an AI hiring tool, scores customers, automates a decision, or has wired AI into its operations, you may already be in scope — not as the AI lab, but as a deployer, and sometimes, without ever realising it, as a provider. We get into the deployer‑versus‑provider line that catches almost everyone, the Article 25 clause that quietly turns a buyer into a manufacturer regardless of what the contract says, what is still legally binding on 2 August 2026, and why the documentation you need cannot be faked at the audit. It ends, as every episode does, with a falsifiable prediction we write down and come back to.

In this episode

Why the EU AI Act binds ordinary companies that do not think of themselves as “AI companies”

The three ways you can become a “provider” without knowing it — and why your indemnity clause does not stop it

What actually counts as “high‑risk” AI under Annex III

Why a US company with no European office can still be caught

What the moved deadline did — and did not — change, and what stays live on 2 August 2026

The evidence you have to capture from week one, because you cannot reconstruct it later

ISO 42001: real protection, or a badge for the website?

Antonina’s prediction for the first real enforcement action

Timestamps

00:00  The EU AI Act trap hiding in "we don't build AI"00:55  Why this law applies to you03:09  Who Antonina is and why she'd know05:28  The one thing that makes the room go quiet07:11  How a buyer becomes the "manufacturer" (Article 25)09:37  What actually counts as "high-risk" AI11:26  No EU office? You're still in scope13:42  Provider or deployer: where the line sits14:55  "I just bought Copilot — am I a provider?"17:22  What a deployer must do every single week19:46  The vendor contract that's worth nothing23:33  What Brussels actually changed — and what it didn't25:58  Reprieve, or a longer run-up to the same wall?27:47  What's still binding on 2 August 2026?30:05  Start now, wait — and did the EU get it right?37:01  Why you can't fake the evidence at the audit40:47  Three things to write down from week one43:50  ISO 42001: real armour or website badge?47:16  Chicago to Germany — caught anyway49:10  One company, three rulebooks51:04  What calm companies have that the panicking don't53:15  Her prediction: the first enforcement action54:42  Time machine: what she'd tell her 2024 self

Three lines worth the click

“For all three cases, the contract is not important. The responsibility lies with whoever is the provider.” — on why your vendor indemnity does not transfer the risk.

“How do you document control of that bias after the fact? I have no idea.” — on why AI compliance evidence has to be captured as you go.

“You don’t have a choice.” — on why the Act reaches you wherever you are headquartered.

About the guest

Antonina Burlachenko is Head of Regulatory Consulting at STAR, where she leads a team taking regulated products to market and building the quality, information‑security and AI‑management systems underneath them — across medical‑device regulation, the Cyber Resilience Act, GDPR and the EU AI Act. Her work spans advisory, internal audits and the due‑diligence assessments investors commission before they invest. Connect with Antonina on LinkedIn.

Read, watch, and go deeper

Read the companion essay: The EU AI Act Already Applies to You — the full written analysis, with sources → [link]

Watch on YouTube: [video link]

Listen: [Apple Podcasts] · [Spotify]

Sources: EU AI Act, Article 25 · Annex III high‑risk uses · Gibson Dunn — the Digital Omnibus deferral (May 2026) · European Commission — AI regulatory framework · ISO/IEC 42001

The Control Layer publishes weekly — decision‑grade analysis on AI, cybersecurity, and technology sovereignty, written for the board paper, not the timeline.

Every episode ends with a prediction we write down and call in writing. Subscribe free, and you will be here when we find out whether Antonina was right.

[Subscribe free]

The Control Layer is written and hosted by Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

#EUAIAct #AIgovernance #AIcompliance #ISO42001

Automating the Work, or the Workers?

Vanta shipped a suite of AI agents it calls "24/7 GRC engineers" — evidence collection, risk analysis, vendor assessments, remediation guidance, all handled by machines. So what's left for the humans?

Amer Altaf talks to Khush Kashyap, Senior Director of GRC at Vanta, about what agentic compliance actually means for practitioners — what it costs, what it changes, and whether the profession is being augmented or quietly automated out of existence.

Khush runs Vanta's own GRC programme on the platform daily, making her both the builder and the first customer.

In this episode:

• What "agent" actually means at Vanta — beyond the industry buzzword

• Whether this works for a 200-person firm with one security lead

• The honest answer on pricing

• Day one walkthrough: from spreadsheets to agentic compliance in a week

• Who's accountable when the agent gets it wrong on approval number 41

• "Don't trust the agents — trust the agency you build"

• UK GDPR vs EU GDPR: does the system know the difference?

• Data sovereignty, the CLOUD Act, and what UK CISOs are asking

• Will compliance teams shrink? The nuanced answer

• What skills GRC teams are hiring for now

Chapters:

00:00 What Vanta actually built — and what "agent" really means

07:44 Does this work for a 200-person firm?

17:03 Day one — from spreadsheets to agentic compliance

22:31 When you're clicking approve on autopilot

32:51 UK GDPR, data sovereignty, and the CLOUD Act

42:08 Automating the work or automating the workers?

53:39 The time machine question

Guest: Khush Kashyap — Senior Director of Governance, Risk and Compliance, Vanta

Host: Amer Altaf — Managing Editor, The Control Layer and CEO, Arkava

Subscribe to The Control Layer: https://thecontrollayer.arkava.ai

On 22 April 2026, the House Foreign Affairs Committee advanced by a substantial bipartisan margin a bill that gives the Netherlands 150 days to match American export controls on semiconductor equipment — or lose access to the American intellectual property inside every lithography machine ASML has ever built.

This is the third instalment of the Four Chokepoints series — a 50-minute solo episode on the Multilateral Alignment of Technology Controls on Hardware Act, the ASML monopoly that sits at its centre, and the structural shift in how Washington treats its allies that the bill formalises.

The argument has two halves. The first is structural: the allied exemption — the diplomatic consensus that allowed European technology companies to trade with relative autonomy inside a multilateral framework — is formally dead. The second is political: the instrument Washington has chosen to kill it reveals something uncomfortable about the stated justification for the entire technology embargo.

The episode walks through:

— What the MATCH Act actually says, who introduced it, and why the bipartisan, bicameral co-sponsorship matters more than the headline.

— The silence from the Semiconductor Industry Association, SEMI, Lam Research, and Applied Materials that is the most important data point in the entire debate.

— The honest acknowledgement of the security argument: China is building a state-subsidised semiconductor industry with explicit military applications, and the dual-use risk concern is not paranoia.

— Why the MATCH Act is nevertheless not primarily a security instrument but a commercial protection instrument dressed in security language.

— ASML's 100 per cent monopoly on EUV lithography, the €32.7 billion 2025 revenue, and the Cymer light source acquisition that gave Washington the legal hook.

— The Foreign Direct Product Rule and how it converts a Dutch company's American supplier dependencies into the most powerful instrument of American economic statecraft currently in use.

— The death of the Wassenaar Arrangement consensus model — and the structural reason Brussels has said nothing.

— A specific recommendation for the quarterly board paper: the named, quantified, irreducible single-vendor dependency with no current mitigation.

— A falsifiable predictive judgement about the European Commission's response, due by April 2027, with the four signals that will tell you whether the prediction is on track.

— The closing seven-word argument that holds the whole thesis.

This is Part 3 of a five-part series. Part 4 — on the CLOUD Act and the data jurisdiction — follows next week.

The companion written analysis, fully sourced with 23 endnotes, is published at thecontrollayer.arkava.ai/p/four-chokepoints-the-equipment-chokehold.

The Control Layer is the publication where Amer Altaf — Founder & CEO of Arkava, the UK and European sovereign AI agentic automation business, and a techUK contributor on technology sovereignty policy — tracks the convergence of cybersecurity, AI, and the geopolitics of the technology stack. One piece a week, free, written for the board paper.

Subscribe at thecontrollayer.arkava.ai.

You cannot procure sovereignty on imported metal. That's the argument at the centre of this episode — Part 2 of the Four Chokepoints series.

Aluminium smelters in the Gulf are offline. Helium tankers from Qatar are caught in the Hormuz disruption. And the entirety of European semiconductor policy — the €43 billion Chips Act — is sitting on a material foundation it hasn't costed.

In this solo episode, Amer Altaf traces the supply chain underneath the supply chain. He explains why an aluminium pot line cannot be cold-started (the cells are destroyed, not paused), why every helium atom in commercial use was mined rather than manufactured, and why the loss of three million tonnes of Gulf aluminium capacity and 25 per cent of global helium supply is a sovereignty story rather than a commodity story.

The episode walks through the EU Chips Act's three structural gaps, the UK Critical Minerals Strategy's order-of-magnitude funding shortfall, and an honest five-point metal floor strategy that would cost between €40 and €60 billion over a decade for the European bloc. It extends Ed Conway's Material World thesis to argue that digital sovereignty is a subset of material sovereignty — and it's the material layer Western policy has most systematically under-priced.

The episode closes with a prediction: within 18 months, a major European fab will publicly disclose a helium allocation constraint delaying capacity expansion — and three amendments to the quarterly board paper introduced in Part 1.

Read the full written analysis: thecontrollayer.arkava.ai

Subscribe for Part 3: The Equipment Chokehold.

Four Chokepoints: The Fortnight That Made European Technology Sovereignty Unavoidable

Solo episode — Part 1 of the Four Chokepoints series

---

On the morning of 8 April, four supply chains began to fail at once. Not in the same country. Not in the same industry. Not even on the same continent.

The headlines called it an oil shock. It isn't. In this episode, I trace the line from the Strait of Hormuz to the server rack in your data centre — through the aluminium smelters, the helium tankers, the Dutch lithography plant, and the Franco-British communiqué that said something no European government has said out loud since 1945.

My argument: the post-war bargain between Europe and America has not strained. It has inverted. And the board papers being written this month still treat it as an oil shock.

If you prefer to read the full written analysis

— with all twelve endnotes and the complete image brief

— [that essay is here](https://thecontrollayer.arkava.ai/p/four-chokepoints-the-inversion).

This episode covers the same ground but restructures it entirely for audio: different pacing, extended analogies, and three concrete lines I think should be rewritten in your next Audit and Risk Committee paper.

---

What this episode covers

The four failures — what actually happened in the fortnight to 12 April 2026: three million tonnes of Gulf aluminium capacity offline, helium tanker disruptions threatening semiconductor fabs, the MATCH Act's 150-day ultimatum to ASML, and the first Franco-British military operation outside the American framework since the post-war settlement.

The inversion — why Helen Thompson's thesis about the contingent Atlantic settlement is no longer history but operational reality, and why Adam Tooze's structural polycrisis framework is the correct lens for the events of this fortnight.

Three lines for the board paper — the vendor concentration matrix, the supply chain map, and the political risk register: what's wrong with each and what they should say instead.

The eighteen-month prediction — procurement-driven re-sovereigntisation in UK and EU public-sector contracts, with explicit falsifiability conditions I'll track quarterly on The Control Layer.

Yesterday, Anthropic announced Project Glasswing — a cybersecurity coalition built around Claude Mythos Preview, a frontier AI model so proficient at finding and exploiting software vulnerabilities that it cannot safely be released to the public.

In just weeks of testing, Mythos Preview has autonomously identified thousands of zero-day vulnerabilities in every major operating system and every major web browser — including a 27-year-old flaw in OpenBSD, a 16-year-old bug in FFmpeg that automated testing missed five million times, and a chained Linux kernel exploit that escalates to full machine control.

The 12 launch partners — AWS, Apple, Microsoft, Google, Cisco, CrowdStrike, Palo Alto Networks, Broadcom, NVIDIA, JPMorganChase, the Linux Foundation, and Anthropic — will use the model exclusively for defensive security work. Anthropic is committing $100 million in usage credits and $4 million to open-source security organisations.

In this solo episode, I break down what Mythos Preview can actually do, why the defensive case is strong, and why the dual-use problem — the same model that finds vulnerabilities can exploit them — cannot be engineered away.

Then I ask the question almost no one else covering this story is asking: why are all 12 launch partners US-headquartered? What does it mean when the most powerful defensive cybersecurity tool ever created is exclusively in the hands of American companies, subject to US government engagement, with no mention of the UK's NCSC, the EU's ENISA, or any non-US government body?

What I cover:

- Claude Mythos Preview's capabilities — and why this is a step change, not an incremental improvement

- The defensive case: $100M in credits, open-source funding, and a coalition that touches most of the world's software infrastructure

- The dual-use tension: Mythos develops working exploits autonomously, without human steering

- The sovereignty question: all 12 partners are US-headquartered, and the implications for UK and European defenders are significant

- Five things to watch over the coming months — from the 90-day report to the UK's Cyber Security and Resilience Bill

This episode is for:

- CISOs and security leaders assessing what AI-augmented threats mean for their organisations

- CTOs and engineers building on infrastructure maintained by Glasswing partners

- Policymakers writing cybersecurity legislation in a world that just changed

- Anyone who believes the geography of AI capability is a strategic question, not a technical footnote

Read the full analysis: thecontrollayer.arkava.ai

The Control Layer is hosted by Amer Altaf, founder and CEO of Arkava, and publishes weekly.

Sponsored by Arkava — Trusted Intelligence, Tangible Impact.

https://arkava.ai

When an AI agent shops on your behalf, pays on your behalf, and negotiates on your behalf — who’s actually in charge? And when something goes wrong, who carries the liability?

In the debut episode of The Control Layer, Amer Altaf sits down with Andrew Dunbar, Chief Information Security Officer at Shopify, to unpack the security architecture behind agentic commerce — a world where autonomous AI agents act as buyers, and traditional checkout flows no longer apply.

Andrew reveals how Shopify is building the Universal Commerce Protocol (UCP), a framework designed to let AI agents transact securely across any merchant without screen-scraping or fragile browser automation. The conversation covers how cryptographic credential chains prevent compromised agents from completing unauthorised transactions, why the four-persona model (buyer, business, platform, credential provider) changes the trust equation entirely, and what happens when 875 million buyers start operating through autonomous intermediaries.

They also discuss why the CISO’s role is shifting from gatekeeper to architect, how bug bounty programmes stress-test agentic infrastructure before it ships, and what sovereign AI strategy means for businesses operating across borders.

Whether you’re a security leader, a founder building on AI, or simply someone who wants to understand the system that’s about to handle your money — this is where it starts.