You sit before your laptop, alone in your bedroom, staring at a webcam. The screen displays a question about how you would handle a difficult customer. You have two minutes to respond. As you speak, an algorithm analyses every micro-expression on your face, the cadence of your voice, the words you choose, and even the pauses between your sentences. Somewhere in a data centre, machine learning models are calculating your “employability score.” They are determining whether your vibes are right.

Welcome to the new frontier of recruitment, where “good vibes” have been quantified, algorithmatised, and sold back to employers as objective science.

An estimated 99 per cent of Fortune 500 companies now use some form of automation in their hiring process. The World Economic Forum reported in March 2025 that roughly 88 per cent of companies use AI for initial candidate screening. And an October 2024 survey of business leaders found that approximately seven in ten companies allow AI tools to reject candidates without any human oversight. The promise is efficiency, objectivity, and the elimination of human bias. The reality is proving far more complicated.

The Machinery Behind the Vibe Check

The technical architecture of AI-powered hiring tools reads like science fiction adapted for the human resources department. These systems deploy a constellation of technologies: facial expression analysis, voice tone detection, linguistic pattern recognition, and neuroscience-based games, all working in concert to produce a single output, a score that purports to capture something ineffable about a candidate's personality and potential.

HireVue, one of the most prominent vendors in this space, built its reputation on video interview technology that went far beyond simply recording candidates' responses. According to the Washington Post, the company's system used candidates' computer or cellphone cameras to analyse their facial movements, word choice, and speaking voice before ranking them against other applicants based on an automatically generated “employability” score. The company had been used by over 100 employers to evaluate more than a million job candidates.

The granularity of this analysis was remarkable. HireVue examined what they called “Facial Action Units,” which could make up 29 per cent of a person's interview score. According to HireVue's own documentation, 10 to 30 per cent of a candidate's score was based on facial expressions, with the remainder calculated from language use. The AI claimed to determine everything from how excited someone seemed about work tasks to how they might behave around angry customers, all derived from facial movements and voice patterns.

Pymetrics, another major player in the space (now acquired by Harver), took a different approach, using neuroscience-based games to assess candidates. Founded by Harvard and MIT-trained neuroscientist Frida Polli, the company developed 12 neuroscience mini-games that take less than half an hour to measure 90 cognitive, social, and emotional traits. “The whole idea behind Pymetrics is that instead of using a resume, you are looking at people's cognitive, social, and emotional aptitudes,” Polli has stated. “It's also much more future-facing and potential-oriented, rather than backwards-facing and only talking about your past experiences.”

The appeal to employers is obvious. Traditional hiring is expensive, time-consuming, and riddled with inconsistency. A single corporate job posting can attract hundreds or thousands of applications. Human recruiters are limited by time, attention, and their own unconscious biases. AI systems promise to process vast numbers of candidates quickly while applying consistent criteria. When Unilever adopted an AI-powered recruitment funnel partnering with Pymetrics for its Future Leaders programme, the company processed 250,000 applicants in months. Time-to-hire was reportedly reduced by 90 per cent, from four months to four weeks, saving the company over one million pounds in recruitment costs.

The Scientific Foundation Begins to Crack

Yet the scientific claims underlying these systems have come under withering scrutiny. The most damaging revelation came from HireVue's own research, which showed that facial analysis contributed only 0.25 per cent to actual job performance prediction. Candidates were being scored heavily on factors that had virtually no correlation with their ability to do the job.

AI researchers have been considerably less diplomatic. Some have described the technology as “digital snake oil,” an unfounded blend of superficial measurements and arbitrary number-crunching unrooted in scientific fact. They argued that analysing a human being this way could penalise non-native speakers, visibly nervous interviewees, or anyone else who did not fit the model for look and speech.

Sandra Wachter, Professor of Data Ethics at the Oxford Internet Institute, has been particularly scathing. She has stated that emotion AI has “at its best no proven basis in science and at its worst is absolute pseudoscience.” Her assessment reflects a growing consensus among researchers that the technology reproduces historical forms of pseudoscience based on the concept of quantifiable and unequally distributed emotional capacity.

Lisa Feldman Barrett, Professor of Psychology at Northeastern University and a leading expert on emotion, has highlighted the fundamental problem with these systems. “The topic of facial expressions of emotion, whether they're universal, whether you can look at someone's face and read emotion in their face, is a topic of great contention that scientists have been debating for at least 100 years,” she has observed. The science is nowhere near settled enough to stake someone's livelihood on it.

The criticism extends beyond facial analysis to emotion recognition more broadly. Research published in 2024 found that emotion recognition technologies discriminate on the basis of race, gender, and disability. In one study by Lauren Rhue, emotion AI consistently interpreted Black subjects as having more negative emotions than white subjects, even when facial expressions were identical. Another study found that an emotion recognition system read Black faces as angrier than white faces, even when both were smiling to the same degree.

These are not theoretical concerns. They have real consequences for real people. In a US study published in 2024, workers expressed concern that emotion recognition systems would harm their wellbeing and impact work performance. They were fearful that inaccuracies could create false impressions about them.

Training Data and the Reproduction of Bias

The deeper problem with AI hiring tools lies not in their algorithms per se, but in what those algorithms learn from. Machine learning systems are only as good as the data they are trained on. And when that data reflects decades of hiring decisions made by humans with their own biases, the algorithm does not eliminate bias; it codifies it.

The most notorious example remains Amazon's experimental recruiting engine, first reported by Reuters in 2018. The company had been building computer programmes since 2014 to review job applicants' resumes with the aim of mechanising the search for top talent. The tool used artificial intelligence to give job candidates scores ranging from one to five stars.

The problem was the training data. The AI tool was trained on ten years' worth of resumes the company had received. Because the technology sector is male-dominated, the majority of those resumes came from men. The result was that the system was unintentionally trained to prefer male candidates over female candidates.

The discrimination was not subtle. The system reportedly penalised resumes containing the word “women's” or the names of certain all-women's colleges. Meanwhile, it favoured words such as “executed” and “captured,” which are apparently deployed more often in the resumes of male engineers. Amazon edited the programmes to make them neutral to these particular terms, but that was no guarantee the machines would not devise other ways of sorting candidates that could prove discriminatory. The company ultimately disbanded the team because executives lost hope for the project.

The Amazon case illustrates a fundamental tension in AI hiring. These systems are typically trained on data from “top performers” at a company. If a company's existing workforce lacks diversity, particularly at senior levels, then the algorithm will learn to select candidates who resemble that homogeneous group. As Meredith Whittaker, co-founder of the AI Now Institute, has observed, “Firms that are using such software may not have diverse workforces to begin with, and often have decreasing diversity at the top.”

Whittaker has documented how this pattern repeats across the AI industry. “There are an increasing pile of examples where we see that these systems embed biased and discriminatory logics,” she has stated. “In almost every case, these biases are effectively replicating histories of discrimination, so against women, against Black people, against trans people.”

The AI Now Institute's 2019 report “Discriminating Systems” documented how workforce discrimination in AI labs, dominated by a narrow demographic, causally propagates biases into deployed systems. The problem is not that AI is inherently biased. The problem is that AI amplifies and automates the biases embedded in historical data and in the teams that build these systems.

Cultural Fit Becomes Algorithmic Conformity

Perhaps nowhere is the potential for algorithmic discrimination more acute than in the assessment of “cultural fit.” This concept, long a staple of hiring discourse, has always carried discriminatory risks. AI systems that claim to measure cultural fit take those risks and amplify them.

Katherine Klein, Professor of Management at Wharton, has characterised cultural fit as “an incredibly vague term, and it's a vague term often based on gut instinct.” According to diversity researchers, the vague use of “fit” is one of the top contributors to homogenous hiring.

The problem is that hiring managers often conflate cultural fit with personal similarity. Instead of looking for people who share the company's values, they look for people who share their own background and interests. As one expert noted, “What you're going to get is a copy of your existing employees,” and “in many instances, it is a form of discrimination.”

In a 2012 paper for the American Sociological Review, Lauren A. Rivera investigated this dynamic through 120 interviews with professionals involved in hiring at US investment banks, law firms, and management consulting firms. She found that the most common thing employers looked for at the job interview stage was “similarity” in hobbies, experiences, and self-presentation styles. When interviewers said they “clicked” or “had chemistry” with a candidate, they often meant that they shared a similar background.

When AI systems are trained to identify “cultural fit,” they risk encoding these same preferences in algorithmic form. The system learns from historical data about who was hired and promoted. If past hiring reflected homogeneity, the algorithm will perpetuate that homogeneity, now with the veneer of scientific objectivity. “Good vibes” becomes a proxy for candidates who mirror the demographics and mannerisms of those already in power.

Professor Wachter's research at Oxford has explored how AI creates what she calls “artificial immutability,” using features like opacity, vagueness, instability, involuntariness, and invisibility to make discriminatory groupings seem natural and inevitable. Candidates in online interviews may be assessed by facial recognition software that tracks facial expressions, eye movement, respiration, or sweat. The criteria for evaluation are hidden from candidates, who have no way to know why they were rejected or how to improve.

The Disability and Neurodiversity Gap

The limitations of AI hiring tools become especially stark when applied to candidates with disabilities or neurodiverse traits. These systems are typically trained on data from neurotypical, able-bodied candidates. Anyone who communicates differently, whether due to deafness, autism, or other conditions, is at immediate disadvantage.

This issue came into sharp focus in March 2025, when the American Civil Liberties Union, Public Justice, and ACLU of Colorado filed a complaint with the Colorado Civil Rights Division and the Equal Employment Opportunity Commission against Intuit and HireVue. The complaint was filed on behalf of an Indigenous and Deaf woman who was denied a promotion allegedly due to discrimination based on her disability and race.

The complainant, identified as D.K., communicates using American Sign Language and English with a deaf accent. Despite receiving positive supervisor feedback and bonuses every year since 2019, she was rejected for a seasonal manager position after completing a HireVue video interview. According to the complaint, the HireVue platform did not provide consistent subtitles for all audio content.

When D.K. requested human-generated captioning, Intuit allegedly denied this accommodation, telling her that HireVue's software included subtitling capabilities. When she began the interview, no subtitling option was available, forcing her to rely on Google Chrome's automated captioning, which is sometimes incomplete and inaccurate. She was rejected for the promotion and allegedly received AI-generated feedback recommending that she “practice active listening,” a suggestion that the ACLU argues demonstrates how her hearing disability disadvantaged her in the process.

Research has consistently shown that such AI systems perform worse when evaluating non-white and deaf or hard of hearing speakers. The complaint alleges that HireVue's hiring assessment platform discriminated against deaf and non-white individuals, violating the Colorado Anti-Discrimination Act, the Americans with Disabilities Act, and Title VII of the Civil Rights Act.

HireVue CEO Jeremy Friedman has stated that the complaint “is entirely without merit” and that Intuit did not use a HireVue AI-based assessment in this instance. Intuit has similarly stated that “the allegations in the complaint are entirely without merit.” The case remains ongoing.

The legal implications extend beyond this single case. As one legal expert noted, “employers can still be held responsible for AI-related discrimination, even if the tool was developed and implemented by a third-party vendor.”

The Regulatory Landscape Takes Shape

Regulators around the world are beginning to grapple with the implications of AI in hiring. The most comprehensive framework to date is the European Union's AI Act, which entered into force on 1 August 2024. Under this regulation, AI systems used for recruitment and selection are explicitly categorised as “high-risk” due to their potential impact on individuals' access to employment and their future careers.

The EU AI Act covers AI systems intended to be used for the recruitment or selection of individuals, including to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. Usage of AI for deciding on promotions, termination of work-related contractual relationships, allocation of tasks, and monitoring or evaluation of the performance and behaviour of workers is also classified as high-risk.

That classification is settled law. Its consequences are not yet in force. The obligations that attach to high-risk systems, covering risk management, data quality, transparency, human oversight, record-keeping, registration and incident reporting, were due to bind providers and deployers from 2 August 2026. They will not. Under the EU's Digital AI Omnibus, provisionally agreed between the Council and Parliament on 7 May 2026 and subsequently finalised, the compliance deadline for stand-alone Annex III systems, the category containing recruitment, selection, promotion and termination, was deferred to 2 December 2027. For AI embedded in regulated products under Annex I, the deadline moved to 2 August 2028. The stated rationale was that industry needed additional time to prepare for compliance and that the harmonised technical standards on which compliance depends were not yet ready. Whatever the merits of that argument, the practical effect is that the world's most comprehensive AI hiring regime will not constrain a single hiring decision until the closing weeks of 2027.

One part of the Act did not slip. The prohibition in Article 5(1)(f) on inferring emotions from biometric data in the workplace took effect on 2 February 2025 and remains in force. The European Commission's review of the Act in November 2025 specifically declined to soften the list of prohibited practices, and the omnibus delay did not touch it. The asymmetry is worth sitting with. The broad, technical, engineering-heavy obligations on high-risk systems, the risk assessments and documentation and audit trails, slipped by sixteen months. The outright ban on the single most pseudoscientific practice in the sector held. Reading emotions off a candidate's face is unlawful in the European workplace today; building a high-risk hiring algorithm without a risk management system is not, at least not yet. The most indefensible practice is the one that stayed banned, and it arguably stayed banned because it was indefensible. There was no serious industry case to be made for a technology whose scientific foundations Wachter has described as absent.

The regulation has extraterritorial reach, meaning US employers can be covered even without a physical EU presence if AI outputs are intended to be used in the EU. Penalties are tiered, and the tiering matters. Engaging in a prohibited practice, which includes workplace emotion recognition, can attract fines of up to 35 million euros or 7 per cent of global annual turnover, whichever is higher. Breaches of the obligations governing high-risk systems carry a lower ceiling of 15 million euros or 3 per cent. That the harsher of the two tiers is the one already operative is the clearest signal Brussels has sent about which practice it considers beyond redemption.

In the United States, regulation has proceeded in a more patchwork fashion. New York City's Local Law 144, which took effect in January 2023 with enforcement beginning in July 2023, requires organisations using automated employment decision tools to undergo annual bias audits from independent third-party auditors. The audit must assess the tools' disparate impact on employment decisions for candidates based on protected categories such as sex, ethnicity, and race.

The law also imposes transparency requirements. Organisations must make the date of the most recent bias audit, a summary of results, and distribution date of the tool publicly available on their websites. Employers must notify candidates at least ten business days before using such a tool.

However, enforcement has proven challenging. A recent state comptroller audit found that while the New York City Department of Consumer and Worker Protection surveyed websites and bias audits of 32 companies and identified only a single issue of non-compliance, the comptroller's office identified at least 17 instances of potential non-compliance. DCWP officials acknowledged that identifying non-compliance is difficult because if an employer does not take the required steps, it is hard to identify that they are violating the law.

Illinois has been particularly active in regulating AI in employment. The state's Artificial Intelligence Video Interview Act governs employers' use of AI analysis in video interviews, requiring various notices, consents, and data management practices. In August 2024, Governor J.B. Pritzker signed HB 3773, amending the Illinois Human Rights Act to expressly regulate AI for employment decisions. That law took effect on 1 January 2026 and now binds employers in the state. It prohibits the use of AI in ways that discriminate against employees on the basis of protected characteristics, even where the discrimination is unintentional; it bars the use of zip codes as proxies for protected classes; and it requires employers to give notice when AI is used in employment decisions.

The obligations arrived without a map, however. The Illinois Department of Human Rights temporarily withdrew its proposed rules on the use of artificial intelligence in employment, leaving the statutory duties fully in force while the precise contours of compliant notice remain undefined pending further rulemaking. Employers are bound by requirements whose detailed shape has not been settled. This is a familiar pattern in the field, where the duty to be accountable consistently outruns any specification of what accountability actually looks like.

The Illinois Biometric Information Privacy Act adds another layer of exposure. Employers using AI facial recognition in conjunction with video interviews, such as to analyse facial expressions, speech patterns, and other non-verbal cues, could face liability under both the video interview act and the biometric privacy law.

The Legal Reckoning Begins

The courtroom is becoming a new battleground over AI hiring discrimination. The EPIC complaint against HireVue filed with the Federal Trade Commission in November 2019 charged that the company falsely denied using facial recognition and failed to comply with baseline standards for AI decision-making. While HireVue subsequently removed facial analysis from its assessments, the complaint highlighted the opacity surrounding these systems.

In July 2024, CVS privately settled a proposed class action lawsuit filed by a job applicant who claimed the company broke Massachusetts law by requiring prospective employees to undergo what legally amounted to a lie detector test. The lawsuit alleged that applicants were required to take HireVue video interviews using Affectiva's AI technology to track facial expressions and assign an “employability score.”

The most consequential of these cases is Mobley v. Workday, which alleges discrimination against Black, older and disabled applicants arising from Workday's algorithmic screening practices. It has proceeded in California as a nationwide collective action under the Age Discrimination in Employment Act, covering applicants who applied for positions through Workday's platform on or after 24 September 2020 and who were aged forty or over at the time. The court authorised notice to that collective, and the window for applicants to opt in closed on 7 March 2026. A ruling handed down on 6 March 2026 rejected Workday's contention that the ADEA does not reach job applicants at all, an argument that, had it succeeded, would have removed algorithmic screening at the application stage from the statute's reach entirely.

Then came a decision that ought to trouble anyone who believes bias audits are a sufficient answer. On 29 May 2026, the court denied the plaintiffs' motion to compel production of Workday's own bias-testing data, the internal evidence of whether its tools produced disparate outcomes. The material was held to be protected by attorney-client privilege. Workday's lawyers had curated the data used in the testing, and the results had been used in the provision of legal advice rather than for a business purpose. The court also rejected the argument that Workday had waived that privilege by publicly acknowledging outside litigation that it conducted bias testing at all. The case remains in discovery, with no trial date set.

The ACLU has also filed a complaint with the FTC against Aon over AI personality tests.

Ifeoma Ajunwa, Professor of Law at the University of North Carolina and founding director of the AI Decision-Making Research Program, has documented the legal challenges these cases present. “The law requires that you prove either intent to discriminate or show a pattern of discrimination,” she has explained. “Automated hiring platforms actually make it much harder to do either of those. And a lot of times, the algorithms that are part of the hiring system are considered proprietary, meaning that they're a trade secret. So you may not actually be able to be privy to exactly how the algorithms were programmed and also to exactly what attributes were considered.”

The Workday privilege ruling is that warning made concrete, and then some. Ajunwa's concern was that trade secrecy would place the algorithm itself beyond a plaintiff's reach. What the May 2026 decision established is that evidence of the algorithm's effects can be placed beyond reach too, by the straightforward expedient of routing the testing through counsel. A company can test its systems for discrimination, learn the answer, tell the world that it tests, and still keep the findings from the very people whose claims those findings might substantiate. The audit becomes a compliance artefact rather than an accountability mechanism. This is the accountability gap in its purest form: not an absence of scrutiny, but scrutiny sealed by privilege, conducted for the benefit of the party being scrutinised.

In testimony before Congress, Ajunwa argued that government measures are urgently needed to regulate automated hiring systems that often discriminate against women, military veterans, formerly incarcerated people, people with disabilities, and others. She has argued for independent audits and compulsory data retention, contending that an employer's failure to audit its automated hiring platforms for disparate impact should serve as prima facie evidence of discriminatory intent under Title VII.

Ajunwa's paper “Automated Video Interviewing as the New Phrenology” draws an explicit parallel between these technologies and discredited pseudoscientific practices of the past. The comparison is not rhetorical flourish. It reflects a genuine concern that we are watching history repeat itself, now with the authority of silicon rather than callipers.

The Promise of Debiased AI

Despite the mounting criticism, proponents of AI hiring tools argue that the technology, properly designed, could actually reduce discrimination rather than perpetuate it. Frida Polli, who co-founded Pymetrics and went on to serve as Chief Data Science Officer at Harver following the 2022 acquisition, has been a vocal advocate for this position. She has since moved on to other work, holding a position as a Visiting Innovation Scholar at MIT's Schwarzman College of Computing and founding Alethia AI in 2023.

“We are fundamentally biased, and we can't help it,” Polli has stated. “I personally think that if we really want to change diversity in the workforce, we are never going to get there with humans.” She argues that algorithms are more trainable than humans: “It's hard to remove bias from algorithms, but it is possible. It is not possible to remove bias from humans.”

Pymetrics designed its assessments to be “completely free of gender and ethnic bias,” arguing that measuring cognitive skills like memory through actual tests is gender-blind. The company audits its algorithms with a formula made publicly available on GitHub. Polli was instrumental in passing New York City's bias audit law, the first such regulation in the nation.

The Unilever case study is often cited as evidence that AI hiring can promote diversity when properly implemented. The company reported that the use of AI in sourcing led to an increase in talent diversity by 16 per cent. It employed what it called “the most diverse ethnic and gender employee class so far.” The company attributed this success to using bias-free data sets in training AI systems and maintaining human supervision in the use of the systems.

Yet even success stories come with caveats. With smaller companies, top performers may be very similar in how they think and work. Training models to identify candidates based on how they match with top performers could potentially exclude innovative thinkers. The very diversity that makes teams effective might be screened out by systems optimised for conformity.

Research by University of Washington found significant racial, gender, and intersectional bias in how state-of-the-art large language models ranked resumes. A large-scale randomised experiment found that leading AI models systematically favour female candidates while disadvantaging Black male applicants, even when qualifications are identical. The bias is complex and intersectional, making simple fixes inadequate.

Professor Wachter's work has shown that the majority of popular bias tests and tools, 13 out of 20 examined, do not live up to the standards of EU non-discrimination law. In response, she developed a bias test called Conditional Demographic Disparity that meets EU and UK standards. Amazon and IBM have implemented it in their cloud services. In 2024, this test was used to uncover systemic bias in education in the Netherlands, leading to a formal apology from the Dutch Minister for Education.

What Candidates Face

For job seekers, the rise of AI hiring tools creates an opaque and often bewildering landscape. You may never know that an algorithm rejected you, let alone why. The criteria for success are hidden. The appeals process is non-existent.

HireVue does not give candidates access to their assessment scores or the training data, factors, logic, or techniques used to generate each algorithmic assessment. You receive a rejection, or you do not. The system has spoken.

A survey found that only 12.9 per cent of Australian adults support face-based emotion recognition technologies in the workplace. Respondents viewed facial analysis as invasive, unethical, and highly prone to error and bias.

The power asymmetry is profound. Job seekers, particularly those early in their careers or from marginalised backgrounds, have little leverage to question or challenge these systems. They must perform for the algorithm, adapting their self-presentation to what they guess the machine wants to see, without knowing what that actually is.

Some candidates are fighting back. Research published in 2024 documented how smart candidates are learning to detect AI interview bias and protect themselves from algorithmic discrimination. But this places an additional burden on job seekers, requiring them to become experts in a technology that should be serving them fairly.

Rethinking What We Measure

The fundamental question underlying this entire debate is what we are actually trying to measure when we hire someone. Traditional interviews, for all their flaws, at least have face validity. You talk to a person. You assess whether you can work with them. The criteria may be subjective, but they are human.

AI hiring tools promise to replace this subjectivity with objectivity. But objectivity requires valid measures. And the measures these systems use (facial expressions, vocal tone, word choice, neuroscience game performance) have not been validated as predictors of job performance. HireVue's own research showed facial analysis contributed only 0.25 per cent to job performance prediction. What, exactly, are we measuring?

The answer may be nothing more than conformity. Systems trained on historical data learn to identify candidates who look, sound, and behave like people who were hired in the past. In a homogeneous workplace, that means selecting for homogeneity. In a discriminatory system, that means perpetuating discrimination.

Joy Buolamwini, founder of the Algorithmic Justice League and co-author of the landmark Gender Shades study, has documented how commercial AI systems fail to recognise people equally. Her research with Timnit Gebru found that the error rate for light-skinned men was 0.8 per cent, compared to 34.7 per cent for darker-skinned women. IBM ended its facial recognition programme partly in response to this research.

Buolamwini's experience was personal before it was academic. While working on a facial-recognition-based art project at the MIT Media Lab, she discovered that commercial AI systems could not consistently detect her face due to her darker skin. “A white mask was a closer fit to what the system had learned was a face than my actual human face,” she has observed. Fortune magazine named her “the conscience of the AI revolution.”

Gebru, who co-founded Black in AI and later the Distributed Artificial Intelligence Research Institute, has spent years documenting how AI systems replicate discrimination. Named one of Time's most influential people of 2022, she has argued that facial recognition is too dangerous to be used for law enforcement and security purposes at present. The same concerns apply to employment.

The Regulatory Winds Are Shifting

It is tempting to read the past two years as a one-way ratchet, with the era of unaccountable AI hiring drawing steadily to a close. The evidence no longer supports that reading. The trajectory is contested rather than inevitable, and during 2026 it moved in both directions at once.

Consider Colorado. SB 24-205, signed in 2024, was the most ambitious state AI statute in the United States: a duty of care imposed on developers and deployers of high-risk systems to protect consumers from algorithmic discrimination, with employment squarely within scope. It never took effect. In roughly six weeks in the spring of 2026, the entire edifice came down. A federal court stayed its enforcement. The US Department of Justice joined a constitutional challenge to it. The state attorney general announced he would not enforce it pending rulemaking. Then the legislature repealed it outright, replacing it on 14 May 2026 with SB 26-189, a markedly narrower framework governing automated decision-making technology, due to take effect on 1 January 2027. The replacement abandons the original's duty of care around algorithmic discrimination altogether. In its place sit notice requirements, a right to an explanation of an adverse outcome within thirty days, and human review where commercially reasonable. The attorney general has indicated he will not enforce that statute either until rulemaking concludes.

Set that alongside the European Union's sixteen-month deferral of its high-risk obligations, and alongside the New York City enforcement record, where a state comptroller's audit identified seventeen instances of potential non-compliance that the enforcing agency had not caught, and a rather different picture emerges. Binding constraints on AI hiring are arriving more slowly and more thinly than the legislative wave of 2024 appeared to promise, even as the underlying technology proliferates and the vendors multiply.

This is not a counsel of despair. Real constraints did land, and they have held. The EU's prohibition on workplace emotion recognition is in force, carries the Act's heaviest penalties, and survived both a Commission review and an omnibus delay that touched almost everything else around it. Illinois HB 3773 is now law and binds employers in that state today. New York City's disclosure regime, however weakly policed, has at least made bias audits a visible expectation rather than a private courtesy. The direction of travel still points towards accountability. What has changed is that nobody can now say with confidence how fast it is moving, or how far it will go.

HireVue itself has evolved. The company removed facial analysis from its assessments in 2021, acknowledging that the technology “wasn't worth the concern.” The company now states that its video assessments only evaluate language, specifically how candidates talk about their experiences and past actions pertaining to competencies critical to the particular role. But voice analysis and linguistic pattern detection carry their own bias risks.

The market is adapting. Some companies are shifting from “culture fit” to “culture add,” seeking candidates who bring different perspectives rather than candidates who conform to existing norms. Research shows structured interviews are twice as predictive of job performance compared to unstructured ones, and they reduce the scope for bias. There are better ways to hire than asking an algorithm to judge someone's vibes.

But the technology continues to proliferate. New AI tools emerge constantly, promising ever more sophisticated assessments of personality, potential, and fit. The vendors may change. The fundamental problems remain.

A Mirror That Distorts

In the end, AI hiring tools hold up a mirror to the organisations that use them. They reflect the biases embedded in historical data. They reproduce the homogeneity of existing workforces. They encode the preferences of the people who build and train them. They are not neutral arbiters of talent. They are amplifiers of existing power structures.

The promise of eliminating human bias through technology is seductive. It offers absolution from the uncomfortable work of confronting discrimination directly. But there is no algorithmic shortcut to equity. Machines learn what humans teach them. If we teach them our biases, they will apply those biases at scale.

The question is not whether AI should play a role in hiring. Automation has benefits: efficiency, consistency, and the capacity to process far more candidates than any human recruiter. The question is whether we will demand transparency, accountability, and scientific validity from these systems, or whether we will allow “good vibes” to become another way of saying “people like us.”

Meredith Whittaker has called for algorithm audits that include experts, advocacy groups, and academics reviewing them and studying their effects on different populations. “We think that's not happening today,” she has stated, “and it could lead to serious problems as AI takes off.”

Ifeoma Ajunwa has argued that audits should be mandated and that failure to audit should constitute evidence of discriminatory intent. Sandra Wachter has developed bias tests that meet legal standards. Joy Buolamwini and Timnit Gebru have shown that these systems fail the people they are supposed to serve fairly.

The tools exist. The research is clear. The regulations are uneven: deferred in Brussels, repealed in Denver, thinly enforced in New York, and binding in Springfield. What remains to be seen is whether employers will choose accountability over convenience in the absence of anyone reliably compelling them to, and whether job seekers will be protected from algorithms that claim to see into their souls but see only reflections of the status quo.

Your next job interview may be judged by a machine. The question is what that machine has learned about who deserves a chance.

---

References and Sources

1. Dastin, J., “Amazon scraps secret AI recruiting tool that showed bias against women”, Reuters, October 2018. https://www.reuters.com/article/us-amazon-com-jobs-automation-insight-idUSKCN1MK08G

2. Electronic Privacy Information Center, “In re HireVue: Complaint and Request for Investigation, Injunction, and Other Relief”, submitted to the Federal Trade Commission, November 2019. https://epic.org/documents/in-re-hirevue/

3. Harwell, D., “A face-scanning algorithm increasingly decides whether you deserve the job”, The Washington Post, 22 October 2019. https://www.washingtonpost.com/technology/2019/10/22/ai-hiring-face-scanning-algorithm-increasingly-decides-whether-you-deserve-job/

4. Buolamwini, J. and Gebru, T., “Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification”, Proceedings of Machine Learning Research, volume 81, 2018. https://proceedings.mlr.press/v81/buolamwini18a.html

5. University of Washington News, “AI tools show biases in ranking job applicants' names according to perceived race and gender”, University of Washington, 31 October 2024. https://www.washington.edu/news/2024/10/31/ai-bias-resume-screening-race-gender/

6. American Civil Liberties Union, “Complaint of Discrimination: D.K. v. Intuit Inc. and HireVue Inc.” (redacted), filed with the Colorado Civil Rights Division and the Equal Employment Opportunity Commission, March 2025. https://assets.aclu.org/live/uploads/2025/03/Redacted-HireVue_Intuit-Complaint-of-Discrimination_Redacted.pdf

7. Ajunwa, I., “Automated Video Interviewing as the New Phrenology”, Berkeley Technology Law Journal, volume 36, number 3, page 1173, 2022. https://btlj.org/wp-content/uploads/2023/01/0008-36-3-Ajunwa_Web.pdf

8. Ajunwa, I., “An Auditing Imperative for Automated Hiring Systems”, Harvard Journal of Law & Technology, volume 34, number 2, 2021. https://jolt.law.harvard.edu/assets/articlePDFs/v34/5.-Ajunwa-An-Auditing-Imperative-for-Automated-Hiring-Systems.pdf

9. US Equal Employment Opportunity Commission, “Testimony of Dr. Ifeoma Ajunwa”, public meeting on navigating employment discrimination in AI and automated systems, 31 January 2023. https://www.eeoc.gov/meetings/meeting-january-31-2023-navigating-employment-discrimination-ai-and-automated-systems-new/ajunwa

10. Oxford Internet Institute, “Current discrimination laws failing to protect people from AI-generated unfair outcomes”, University of Oxford, 2022. https://www.oii.ox.ac.uk/news-events/ai-creates-unintuitive-and-unconventional-groups-to-make-life-changing-decisions-yet-current-laws-do-not-protect-group-members-from-ai-generated-unfair-outcomes-says-new-paper/

11. West, S.M., Whittaker, M. and Crawford, K., “Discriminating Systems: Gender, Race and Power in AI”, AI Now Institute, April 2019. https://ainowinstitute.org/publications/discriminating-systems-gender-race-and-power-in-ai-2

12. Harvard Business Review, “AI, Accountability, and Power with Meredith Whittaker”, Exponential View podcast, November 2023. https://hbr.org/podcast/2023/11/azeems-picks-ai-accountability-and-power-with-meredith-whittaker

13. New York City Department of Consumer and Worker Protection, “Automated Employment Decision Tools (AEDT)”, City of New York. https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page

14. Office of the New York State Comptroller, “Enforcement of Local Law 144, Automated Employment Decision Tools”, 2 December 2025. https://www.osc.ny.gov/state-agencies/audits/2025/12/02/enforcement-local-law-144-automated-employment-decision-tools

15. Fowler, M.A., “Expanding Use of Artificial Intelligence Into Employment and Labor Practice: Legislative Response and Legal Implications”, Chuhak & Tecson, published by the National Law Review, 21 November 2025. https://natlawreview.com/article/expanding-use-artificial-intelligence-employment-and-labor-practice-legislative

16. Seyfarth Shaw, “Illinois Department of Human Rights Temporarily Withdraws Proposed Rules on Use of Artificial Intelligence in Employment”. https://www.seyfarth.com/news-insights/illinois-department-of-human-rights-temporarily-withdraws-proposed-rules-on-use-of-artificial-intelligence-in-employment.html

17. European Commission, “Regulatory framework for AI”, Shaping Europe's Digital Future. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

18. Pinsent Masons, “Law delaying EU's 'high-risk' AI rules finalised”, Out-Law, 6 July 2026. https://www.pinsentmasons.com/out-law/news/law-delaying-eu-high-risk-ai-rules-finalised

19. Finnegan, “Colorado Replaces Landmark AI Act: An Overview of the New SB 26-189 Framework”, 2026. https://www.finnegan.com/en/insights/articles/colorado-replaces-landmark-ai-act-an-overview-of-the-new-sb-26-189-framework.html

20. Duane Morris, “California Federal Court Clarifies Limits On AI Bias Testing And Applicant Data Disclosure In Mobley v. Workday”, Class Action Defense Blog, 2 June 2026. https://blogs.duanemorris.com/classactiondefense/2026/06/02/california-federal-court-clarifies-limits-on-ai-bias-testing-and-applicant-data-disclosure-in-mobley-v-workday/

21. Quartz, “People are terrible judges of talent. Can algorithms do better?”, 2019. https://qz.com/work/1742847/pymetrics-ceo-frida-polli-on-the-ai-solution-to-hiring-bias

22. Rivera, L.A., “Hiring as Cultural Matching: The Case of Elite Professional Service Firms”, American Sociological Review, volume 77, number 6, pages 999-1022, December 2012.

23. Knowledge at Wharton, “Is Cultural Fit a Qualification for Hiring or a Disguise for Bias?”, University of Pennsylvania. https://knowledge.wharton.upenn.edu/article/cultural-fit-a-qualification-for-hiring-or-a-disguise-for-bias/

24. HR Dive, “AI hiring software was biased against deaf employees, ACLU alleges in ADA case”, 2025. https://www.hrdive.com/news/ai-intuit-hirevue-deaf-indigenous-employee-discrimination-aclu/743273/

25. SHRM, “HireVue Discontinues Facial Analysis Screening”. https://www.shrm.org/topics-tools/news/talent-acquisition/hirevue-discontinues-facial-analysis-screening

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

“The world is full of magic things, patiently waiting for our senses to grow sharper.” — W. B. Yeats

Feb 2026

Today, I am exuberant. I am embracing the moment. UP early for a walkabout. A big part of the walking is to just explore and experience. No goal. No direction. No complaint, no slow or fast, just being and going. Stopping when I want for as long as I want to sip or gorge on experience.

I'm—speechless, and exhilarated by the Orsay. I had just started recording a field report when I walked into the impressionists and was blown away. There for most of 7 hours and still didn't see a third of it...

Back 'home' safe and tired. Making dinner (reheating leftover greek + onions and tomato) Watching ice skating. Chiba (Japan) just dominated to 'Kissing You' by Des Reeves (From '96 Romeo and Juliet). Not sure if she beat out Amber (Americans). But wouldn't be surprised. She was flawless.

Funny to me: American female skaters look like women, Japanese like little girls?

Watched 'I Like Me' about John Candy. Colin Hanks is a good narrator. Too bad Candy didn't take better care of himself. He was the kind of low-key, self-deprecating comedian that we just don't have enough of.

Top Five Candy's:

Uncle Buck Planes, Trains and Automobiles The Great Outdoors Spaceballs Summer Rental

Bonus Candy: Stripes and Home Alone

---

Cold and beautiful here. Seeing the weather back home is abject misery. :–/ Glad to be here!

Listening to Peter Frampton Comes Alive and I'm in You... All I want to be, Love your Way, In You, Signed Seal, all standouts.

So very alive.

I can see the sun in late December. I wonder if you feel it too.

---

Taxi ride back to the champs d' Elyse A man his bike with a baguette—almost as French a thing as I can imagine.

---

Good evening from Montmartre. I often come here at sunset. There's something beautiful about the death of day, something almost elemental. The night is like a warm blanket that veils imperfections and impurities. It is the one time where the dreams of the world sing. I never thought about it that way. Few people do. They would rather bask in the lies of day. It's not how we live, that defines us. It's the stories we tell each other. The night tells us the most splendid of tales. For somnolence nourishes all passions.

---

Today is a Paris day. They have all been Paris days this last week. It seems I've only just arrived, but it's been 7 days! Wednesday is too soon to leave. Perhaps Friday will salve my loss. It should be two weeks. Not a paltry 7 days. Then time in Ireland. The Emerald Isle. Home of my forefathers and potatoes and rocks.

While my ancestors were struggling, the Parisians were cutting off one another's heads and building monuments which still stand today. An incredible grandeur, this. Massive in a way difficult to understand. Los Angeles is also geographically large, but visually unimpressive. This place is an organic growth, like a mighty oak that started a thousand years ago as a sapling.

The window is open today in the upper room of the Shakespeare Company where I like to write. I write of love and of loss, longing and of hope.

Hope which I long to share. But elsewhere, important work calls while I wander and wonder.

This morning I found myself lingering over an exchange at breakfast—asking not to be forgotten, despite a tendency to live fiercely in the present, to let feelings drift rather than carry them forward. The reply has stayed with me ever since.

'Never again.'

Those are big words. It is just short of a vow, Not quite a promise in stone, but powerful enough to rest a fragile heart.

And this love in me is renewed again, day after day. How can you fight a power like gravity?

Ironic that with all of this historian art splashed out before me, my mind is diluted in the delta of this place. There is just so much and everywhere you look is another story. Another microcosm in which to get lost.

I awoke too early and am sleepy now that I have my desk at Shakespeare and Co.

The Seine is at flood stage. I climbed a barrier this morning and walked down to the rivers edge to draw Notre Dame. It was perfectly fine and no danger, but the guards caught me and evicted me from my spot. Merci, I told them as I smiled.

The gendarmes did not reciprocate.

Somehow everyone knows I am American. It was suggested it is my glasses and my tendency to smile at people. Makes sense to me. Being friendly is not exactly a European trait. And for a certainty, presenting happy is a strength I posses.

When I wear it, I wear my joy like a diamond necklace. Do men wear diamond necklaces? Male artists surely do not.

A bird outside my widow is singing in earnest. It wants the world to know that spring is here, just a little bit early. Cold and wet yes, but not the sort winter usually gives. It is the spring temp today. Bringing life to the birds. Everywhere, silently and without alert, unseen insects are starting to stir. Buds on branches beginning to swell.

The early days of Parisian spring are happening right under my feet. It will be a year from now and I will return to this place and see the fruit's of winter's labor. No longer as a tourist, but as a participant. To roll in the dirt of it, let the color run through my blood and spill up on my pages, my canvas. Pour the lust of want in to art not for glory or for riches (what fool thinks riches come to artists) but simply to be. To exorcise it from my being day after day.

Yes today is a Paris day. My day. Pounding cobblestones and marinating in the idea of place too vast for me to really comprehend.

---

Go and bask in the glory of Jehovah's people. Where you or I may muster a little Holy Spirit, one thousand plus souls with worry on their mind and love in their heart manage to collect it in massive sums.

The bells of Notre Dame are ringing in earnest, but they do little more than tickle excitement and nothing to draw souls closer to Jah.

Glow and stand erect. Believe that you are enough that you are loved and beloved in beyond your conception.

If you fear being a square peg, do not. The world is made of square pegs (I am a bit of a parallelogram that sometimes morphs to a dodecahedron) and the very best minds are rarely understood in their time (Van Gogh, Tesla, Dickenson— JESUS to name a few). You are lovable and fun and joyful in ways few others are. Let others perception of you be THEIR problem.

As for us and our household, we will serve Jehovah! And He is the one who accepts us beyond our understanding.

Do not fear, only embrace. Stand in the moment and be. Just be. Read Mark 3:1-6 and if it touches one heart, one mind, then we will have achieved more than that all these millions before me walking the cobblestones of Paris.

Dusty day dawning Three hours late Open the curtains And let the rest wait

My mind goes running Three thousand miles east I may miss the harvest But I won't miss the feast

Close your eyes, Listen to the voices around you. Think of all of the choices, the mistakes, the successes that brought us through this life. The good, the bad, the hard and the easy. But here we are knowing the throne of Jehovah. Eight BILLION living souls. Who knows how many billion preceded them, and we were called by the Creator. We heard his voice and came to him. With our boldness, our intelligence, our talent and power, we humbled ourselves before our God.

And I think that is beautiful.

Good wishes and powerful prayers from Shakespeare and Co, Paris.

---

There is NO wind in Paris!

#travel #romancingiberia

In Summary: * Waiting patiently for tonight's Rangers / Orioles game.

Prayers, etc.: * I have a daily prayer regimen I try to follow throughout the day from early morning, as soon as I roll out of bed, until head hits pillow at night.

Health Metrics: * bw= 224.76 lbs. * bp= 136/79 (68)

Exercise: * morning stretches, balance exercises, kegel pelvic floor exercises, half squats, calf raises, wall push-ups, BP breathing exercises, pilates

Diet: * 05:00 – 1 banana * 06:30 – 1 peanut butter sandwich * 10:30 – 1 6 inch Jimmy John's submarine sandwich, 4 hamburger patties with mushroom gravy

Activities, Chores, etc.: * 03:00 – listen to local news talk radio * 04:10 – bank accounts activity monitored. * 04:30 – read, write, pray, follow news reports from various sources, surf the socials, nap * 10:45 – watch MLB Central on MLB Network * 13:00 – watch old game shows with the wife * 15:00 – listening to The Jack Show * 17:00 – listening to general sports talk on 105.3 The Fan, DFW's #1 Sports Station, ahead of tonight's MLB game between the Orioles and the Rangers

Chess: * 11:50 – moved in all pending CC games

Calgary Paskapoo Slopes – 1986

Brian Mulroney, Calgary circa 1986 I think, he came to kick off the Calgary '88 Olympics with various federal support announcements and related construction projects, this was a Paskapoo Hill which became called Calgary Olympic Park (COP).

#Calgary #history #YYC #BlastFromThePast

Reading Trask (Penguin Guide to Puctuation) on a flight today, I found myself disagreeing with him. Substantially.

Not because he's careless with it. Quite the opposite. His punctuation is disciplined, systematic, almost instructional. He treats it as a framework through which thought is organised and communicated.

I realised that I approach it differently. For me, punctuation has never felt like a set of rules imposed upon language. It feels more like part of the act of expression itself. A comma is not a traffic sign. A dash is not a regulation. A full stop is not an instruction.

They are closer to the traces left by a thought in motion.

When I write, punctuation feels less like the Highway Code and more like the controls of a motorcycle. Not because it governs the journey, but because it becomes part of the journey. Rider and machine gradually disappear into a single act of movement. The controls cease to be separate things. They become extensions of perception.

The same is true of a painter's brush. The brushstroke is not there to organize the painting. It is evidence of the painting being made. And then, because I have spent so much time recently thinking about my next series of articles on music, it occurred to me that the distinction might be even clearer there.

A score is not music.

A score is an extraordinary achievement. It captures relationships, structures, timings, possibilities. But it does not contain music any more than a map contains a landscape.

Music happens when a performer inhabits those symbols.

Two musicians can play identical notes from the same score and produce entirely different experiences. What changes is not the notation but the performance. Perhaps writing contains a similar tension. Grammar, punctuation, and style guides are forms of notation. They help us record, preserve, and share expression. But they are not the expression itself.

The mistake comes when we confuse one for the other.

The score matters: The performance matters more.

[Trask, I suspect, would disapproved of the colon there, and most defitely of my use of this:– ] (square bracket).

Perhaps that is why I sometimes find myself resisting systems that seek to make writing simpler by turning it into rules. Simplicity can emerge in another way through practice. Not the practise of grammar rules, but the practise of the expression of ones own thought. Not through codification, but through feel.

A motorcyclist does not become graceful by memorising the Highway Code. A musician does not become expressive by memorising notation. A writer does not become eloquent by memorising punctuation rules. Those things matter. But they belong to a different realm.

They are the score: The living thing begins when someone starts to play.

David Marshall Montory

Afterthought: Punctuation, at a minimum, is guidance on cadence.

I stumbled onto a surprisingly good discovery feed called Scour. I’ve been browsing through it and found some genuinely solid blog posts. Just wanted to share.

#BlogDiscovery

At my house, the roads and fields are fringed with bushes of wild raspberries which with their red fruit look like from a fairy tale against the green of the bushes and greenery surrounding them.

I will pick these raspberries and bake a pie.

There are often white larvae inside these berries, maybe one day they will become butterflies, i don’t know.

I will when baking this pie, pretend that no such larvae exist.

Such is the power of imagination.

The world breaks everyone, and afterward, many are strong at the broken places.

My old friend,

I'm writing this in the final hours of your time here in Dust Meridian. This letter began a year ago, but time and tide have stood against it's execution. It stands to send tonight, Monday April 7, 2025.

Let me begin by saying how deeply I will miss you both.

Words fall short of capturing your presence in this place—a land not without beauty, but with a dearth of polished gems. You were rare among the common stones—shining not only to me, personally but to us as a couple, and unmistakably, to your fellowship.

I have cherished your clarity of spirit—your candor, creativity, and steady delight in spiritual things. That spark will be missed here in Dust, and far beyond.

I can only speak for myself, but you made me feel worthy in a way few others ever have in my time here. The work has been… costly. I love the people here and the men with whom I serve, but none of them have ever truly understood the weight I carry the way you did. I remember, during a visit last spring, you saw I was unraveling, and you said—

“I want you to know that our visits here are something we very much look forward too. And, you need to understand something— that is because of you. Everyone here is great, and we love them. But, we feel a specialness in you that we very much appreciate. Really... You... thank you.”

Your kindness helped me feel seen and loved in a way few others have since we arrived.

You probably don't recall it, but I will never forget it.

I’ve long counted on the understanding of others—and when that didn’t come, though I believe they were doing their best—I hitched up, said a prayer, and kept moving. But like a mule who only knows forward, even I have a breaking point. And I’ve reached it.

I’m not fine right now, but I will be—in time. Burnout set in last year, and it’s been deep, consuming. When I finally asked for help, what came was so inadequate it bordered on absurd—except it taught me something vital: when a man says he’s at his limit, believe him.

For now, I’m holding on. Just a body, waiting for the Spirit to mend what’s frayed. Trusting patience, His love, and His power to bring me back.

I wish I'd written sooner. Maybe I wouldn't have reached this place. Perhaps it's made darker by the loss of so many dear ones these past few months. The weight of my sister—and of my parents circumstance—certainly hasn't helped. Maybe if I’d taken the time to reflect on your kindness, to write it out, I might have sidestepped the pit of despair.

One thing is certain: your warmth, enthusiasm and patience made an insurmountable situation seem less daunting. Thoughts of the two of you kept me going many times. And, will do so in the future.

You've both had your own losses, challenges and setbacks. Yet you continue to move forward, bearing scars and the weight of it all, but still reflecting the glory of our God. I think that's beautiful.

At the funeral in February, you said something that struck me deeply. You looked at me and said:

“This is hard to bear—probably harder because you worry about her.” You were absolutely right. That was a bullseye.

All the success and privilege I’ve enjoyed—I only ever hoped it helped my partner feel supported and worthy. But I’m learning that no amount of effort or good intention can shield someone from life. No matter how hard I try to be a good husband (and I fall so short), she will still suffer.

That woman lost the only two people she truly trusts in this world. And there is nothing I can do about that.

While most people offered condolences for my loss, you were the only one who seemed to see the real grief I carried: not mine, but hers. You understood that what I truly lost was a part of her peace and happiness.

Husbands are replaceable. Little sisters—and the lifetime of comfort and care they carry with them—are not. We may be one flesh, but those girls were of one mind.

Your words helped me understand why the weight of all this has been so crushing. Thank you.

I’ve become an expired element here. The time to move on passed long ago—I just hadn’t caught up to it. Whatever change I hoped to effect has likely already played out. The needle has barely moved.

There’s an entrenched spirit here—tribalism, perhaps. The kind that circles wagons and draws lines rather than building bridges. The men on our body are not unkind, but they are not close. We are friendly, but not friends. That’s a dynamic I’ve never been able to crack.

Maybe, in time, with tenacity and a new generation trained to close ranks as brothers first and serve as older men second, that will change. I believe it can.

I’ve grown weary of the abundance of words that say little and mean even less—and of personalities content to sit back while others carry the weight of decision-making. They avoid commitment because it might require the sacrifice of their own time. It’s easier to sacrifice someone else’s.

Lately, I’ve come to see just how powerful a loving shepherd can be. I’ve spoken with men in positions of responsibility whose kindness and warmth honestly surprised me. There’s a new effort to train men to care in a way that makes people feel truly seen, valued, and worthwhile—in a world that constantly tells you otherwise.

You, my dear friend, have that same gift. That’s why I say you make me feel seen. And loved.

We are not problems to deal with, but people to be loved.

I will always remember standing on your deck in the rain and drinking icy tequila from that red bottle and I will never forget learning about bees from you. Both are treasured memories for me.

We will miss you. Even though we didn’t see each other often, just knowing you were close by was a comfort and an inspiration. It brought us real joy to know that those around you were benefiting from your care and attention. That’s not something easily replaced.

I wish we could have served together more closely—maybe one day we will. Until then, hold fast to your integrity. Never slow your service to, or love for, the Creator. But always, always make time to keep your foundations strong.

I’m sorry if this feels scattered... sometimes I write like a song, sometimes like a shotgun blast. I hope that two themes come through: Love and understanding.

Whatever comes next, and wherever you both go, know that a part of you stays with us both. We carry our dear ones in our hearts always. Some are stored in quiet corners, but souls like yours live in the lofty places of our love.

With deep respect and gratitude, Your friend.

---

---

#essay #letters #100DaysToOffload #Writing

---

2025-04-08 11:52:55

Lydia's Weekly Lifestyle blog is for today's African girl, so no subject is taboo. My purpose is to share things that may interest today's African girl.

This week's contributors: Lydia, Pépé Pépinière, Titi. This week's subjects: From Basic to Boss Lady: Styling Your Old Corporate Shirts the Ghanaian Way, Chanel buys Charvet, Gut health, and Gold Coast Restaurant and Lounge

---

From Basic to Boss Lady: Styling Your Old Corporate Shirts the Ghanaian Way. In many Ghanaian workplaces, a crisp corporate shirt is a wardrobe essential. Whether it's a classic white button-down, a striped Oxford shirt, or a pastel blouse, these pieces often become the backbone of our Monday to Friday outfits. But after wearing them repeatedly, they can start to feel boring. The good news? You don't need a whole new wardrobe to look stylish. With a few smart styling tricks, your old corporate shirts can look modern, elegant, and office ready even during Accra's hot and rainy seasons. Beat the Heat with Smart Pairings: Ghana's warm weather calls for breathable outfits. Pair your cotton corporate shirt with a lightweight midi skirt or wide-leg trousers in linen or cotton. Choose lighter colours to stay cool while maintaining a polished appearance. Belt It for a Flattering Shape: If your corporate shirt feels oversized, tuck it into high-waisted trousers or a skirt and add a slim belt. This simple trick defines your waist and creates a sleek, confident silhouette. Choose Comfortable Footwear: Complete your outfit with block heels, loafers, ballet flats, or smart leather sandals if your workplace allows them. Comfort is just as important as style, especially when navigating busy workdays. Confidence Is the Best Accessory: The most stylish women aren't always wearing the newest clothes—they're wearing their outfits with confidence. A well-ironed shirt, neat grooming, and a genuine smile will always make a lasting impression. Chanel buys Charvet. Chanel is one of the few big-time fashion and luxury houses operating independently from the big conglomerates like LVMH (Louis Vuitton Moet Hennessy), owned by French man Bernard Arnault, Kering, owned by French billionaire Francois-Henri Pinault, and Richemont, founded and controlled by South African billionaire Johann Rupert. Chanel’s main seller is Coco Chanel Perfume nr 5, selling about an estimated 10 million bottles per year bottles at around $190/100ml. They own their own flower plantations for some of the scents that go into Chanel 5. Other products are handbags, shoes, clothes, cosmetics, watches, skincare, eyewear and accessories. They are much less noisy than the other big luxury groups and don’t buy and buy others although they invested in some expensive wineries, and recently in a 15000- acre vineyard estate in the USA. But they have now bought 188-year old shirtmaker Charvet. A Charvet male shirt goes for about 7000 GHC, and they sell other luxury items as well. In case you wanted something for hubbies birthday. And I’ll have more on Chanel later on, lessons on how to climb to the top.

Gut health. Your gut of late is one of the top health areas under research and appears to do a lot more than just digest your food. I’d say that the number one of a healthy gut is to have a regular stool, once every 1 or 2 days, and an easy one, with a soft brownish sausage as result. Anything else is suspicious. Very difficult stooling is mainly as a result of not eating sufficient fibres and or not drinking sufficient. Change white rice and white bread for brown rice and bread, drink such that your urine is very pale yellow. And search for fibre rich food. If because of this you will now change your diet then go slow, a bit more every day of the fibre rich things. Not all in one go. We’ve meanwhile realized that your gut bacteria need to be maintained at a good level, and there are about 500-1000 different ones in there. If you recently were on antibiotics you’ve killed a lot of the good ones with the bad ones and need to repopulate your guts by eating lots of different types of fermented foods. Some doctors go as far as inserting a little bit of stool of a healthy gut person into the anus of a “sick” gut person to help rebuild the biome. Apart from digesting your food some of these bacteria create chemicals that influence your mood, your sex drive, your sleep, a whole lot of things (These bacteria actively synthesize and modulate neuroactive chemicals that influence various physiological and psychological functions). And a recent discovery is that some of these chemicals produced are markers of diseases which only much later will show their face (like cancer or inflammatory bowel disease). So in a few years expect that during a routine medical check-up doctor asks for a stool sample, this time not to establish why you have a running stomach or if you have worms, but to ascertain if your biome is balanced or if maybe you have a slowly developing cancer somewhere. Bon appetite.

Gold Coast Restaurant and Lounge (32 Fifth Ave Ext, Cantonments, Accra). The place was recently given a new look and from the increased size of the owner’s stomach I concluded that they are doing well. We sat outside and had beef and goat kebabs at 25 GHC which were spicy and tender but could have simmered a bit longer on the BBQ. But the spring rolls were a fatty crust with nothing worth mentioning inside. We also had Gold Coast loaded rice which was a sort of Peking Royal rice from a Chinese restaurant, quite fatty though the oil was of good quality and taste, with ample shrimps, chicken, beef, squid and egg through it. Also ample salt. The mini paper napkins of about 8 x 8 inch when fully folded open but then tear were not very helpful. This is a common problem, are napkins a big expense item when you pay a bill of say 6-700 GHC. The sad ending was that we paid our bill, left a reasonable tip but asked the waiter to get us 5 GHC note for the parking boys, but then we never saw that waitress again, despite lookin for her. Theft in open air and plain sight. My bill says that Judith Korto was the waitress.

Lydia...

Do not forget to hit the subscribe button and confirm in your email inbox to get notified about our posts.

I have received requests about leaving comments/replies. For security and privacy reasons my blog is not associated with major media giants like Facebook or Twitter. I am talking with the host about a solution. for the time being, you can mail me at wunimi@proton.me

I accept invitations and payments to write about certain products or events, things, and people, but I may refuse to accept and if my comments are negative then that's what I will publish, despite your payment. This is not a political newsletter. I do not discriminate on any basis whatsoever.

I spent the entire day with my mom at her job, along with our dog. My mom spends a lot of time away from home so I thought my dog could come visit her and stay with her at work since her days are numbered. We had a great and creative time together! I got half of the sheet’s embroidery done, so I think it will definitely be done by the weekend.

We also met with my brother, sister in law, and nephews for dinner. It was so much fun! My oldest nephew is so creative and insightful. I am always amazed by him. It was nice to have family time.

Thank you for your message. I am currently out of office with no set return date. I will get back to you when the time is right.

Never get attached to a pottery piece until it is finished and safely at home.

I went to check on my wedding gift and sadly, tragedy struck. I was trying to semi-rush the drying process so it could go into the next kiln batch because we leave in a week and a half. Never ever rush the drying of a piece, it always cracks. Not even a small, fixable crack. A huge, straight down the middle, deep crack. Completely unfixable.

At least it hasn’t been fired yet so I am able to reclaim the clay, but I will have to start over. Which is fine, it just means the gift won’t be ready on time. Which is also fine.

Thank you for your message. I am currently out of office with no set return date. I will get back to you when the time is right.

It’s crazy how the days just pile up. Day 55? That’s wild.

Tomorrow was supposed to be my dog’s euthanasia day, again. However, because she is apparently the most stubborn lady, it has once again been rescheduled to next weekend. I am grateful for all this extra time of course, but the anticipation of it is draining me. I already did get to do all my craft projects, the hole is dug, I even started embroidering the sheet she will be wrapped in. I am both dreading and expecting the day to come.

I spent some time at pottery with my mom today and got pretty close to finishing the wedding gift I made for my brother and sister in law. I am so proud of it, it turned out even better than I would have expected.

Thank you for your message. I am currently out of office with no set return date. I will get back to you when the time is right.

And boom. Full 180. Very productive day. I woke up at 6am, went to pottery for a few hours before helping my mom out in the morning for another few hours. I went back to pottery for a bit before my workout class at noon. All that before noon!

I am happy I worked out, ran some errands, picked up some things from the library, and returned to pottery in the evening. It felt good to get back to some normality.

Thank you for your message. I am currently out of office with no set return date. I will get back to you when the time is right.

Executive Summary

Enterprise computing has spent the past fifteen years consolidating independent software products into integrated trust platforms. The pattern is visible everywhere an organization buys software. Exchange, Active Directory, Office, and antivirus were once separate purchases that became Microsoft 365, where email, identity, documents, device management, and security tooling ship as one subscription under one admin centre. Gmail, Drive, and Cloud Identity became Google Workspace. Okta grew from single sign-on into a full identity and access platform. Palo Alto Networks and CrowdStrike have each spent years folding firewalls, endpoint protection, SIEM, and cloud security into single platform offerings, and both openly describe consolidation as their core strategy. The commercial case for this shift is well understood and largely valid: fewer vendors, lower administration costs, native integration, and better routine security outcomes. Its validity rests on a real transfer, because most organizations cannot hire or retain the depth of security skill the platforms employ, and consolidation moves the work to the perceived skilled. That is a rational move as far as it goes, but it is a trust transfer as much as a skills transfer, and it is made without properly evaluating the risk that travels with it. What has gone almost entirely undiscussed is that structural cost. Twenty years ago, a compromised email server was a compromised email server. The identity system, the file store, the finance application, and the endpoint tooling ran as separate products with separate credentials, so each failed on its own and the damage stopped at its own edges. Today those same functions sign in through one identity service and answer to one management console, which means a single compromise of that shared layer can reach all of them at once. Modern enterprise security has quietly exchanged many small, independent failure domains for a few very large shared ones, and it has made that exchange without ever considering the consequences.

The danger is not that one vendor sells many products. It is that the products become mutually trusting extensions of one security boundary. Integration is trust extension by another name, and the clearest illustration is the administrative layer itself. In a typical platform deployment, one identity service authenticates every user into email, file storage, endpoint management, the security console, and the AI assistant, and one global administrator role governs them all. That shared layer is what makes the platform convenient, and it is also the hidden concentration of risk: a single phished administrator credential, a single hijacked admin session, or a single stolen signing key at the provider is no longer an email problem or a device problem. It is immediately a company-wide problem, because the compromise propagates along the same integration paths the platform was sold on. The attacker who holds the common element holds everything the common element touches. The market has already conceded this point, even if the marketing has not. An entire category of add-on businesses now exists to re-engineer the platforms' own administrative model. CoreView built its business on carving Microsoft 365 tenants into segmented virtual tenants with delegated, least-privilege administration. AvePoint sells governance and permissions control over the same environments. CyberArk, BeyondTrust, and Delinea sell privileged access management whose core promise is containing what a compromised administrator account can reach, and Semperis sells detection and recovery for the identity tier itself, marketing explicitly to the scenario where Active Directory or Entra ID is the thing that fails. These products are a tacit admission that the platform's shared administrative layer is a liability serious enough to build companies around, and they address it only at the layer the customer controls, quietly ignoring the larger vulnerability that sits above every tenant: the single platform owner itself.

That owner is a second, largely invisible administrative layer sitting above every customer. The platform vendor holds the signing keys, the update channels, and the operational access that outrank any control the customer can configure, which makes the provider a hidden super-administrator shared by every organization on the platform. The compound risk is who has access to and influence over that hidden super-administrator. The customer's threat model must now include everyone who can reach the provider's control plane: the provider's own employees and contractors, the attackers who target the provider precisely because of what it holds, and the external parties able to compel or influence the provider through law, ownership, or pressure. That last class is universal rather than a property of any one flag. Chinese providers are subject to their government, British providers to theirs, American providers to theirs, and every provider everywhere answers to some jurisdiction whose interests are not the customer's. Nor is state power the only route in, because history already records vendors secretly owned outright by intelligence agencies, most famously Crypto AG, the Swiss encryption company covertly owned for decades by the CIA and Germany's BND while it sold deliberately weakened equipment to more than one hundred governments,1 and organized crime has repeatedly bought, built, or penetrated its way into positions of vendor access. None of these actors appear in the customer's directory, none are governed by the customer's controls, and every one of them stands upstream of the customer's entire environment. The key change sits here, and it is easy to miss because it is an absence rather than an event. An organization could always vet the people who held administrative power over its systems: it hired them, screened them, contracted them, supervised them, and could remove them. The platform era transfers the highest level of that power to people the organization cannot name, cannot screen, cannot supervise, and cannot remove. The ability to vet who has access, the oldest control in security, quietly stopped applying at exactly the layer where access is greatest.

Figure 1. The vetting boundary, before and after platform consolidation. On the left, every holder of administrative power sits inside the boundary the organization controls: hired, screened, supervised, removable. On the right, the boundary still exists but covers only the tenant, while signing keys, update channels, and operational access sit with a provider layer the customer cannot name, screen, supervise, or remove, shared with every other tenant on the platform.

That compounding has elevated the risk to unprecedented levels, because no previous era of computing concentrated this much organizational authority in a place so few customers can observe and so many third parties can reach. A compromise at that layer is the customer-side admin breach repeated at industry scale, striking thousands of tenants through a single point they cannot see, cannot audit, and cannot revoke. This is not a theoretical exposure, because the pattern has already been evidenced repeatedly: a poisoned build system at SolarWinds pushed trojanized updates to roughly eighteen thousand organizations,2 a compromised management platform at Kaseya delivered ransomware to some fifteen hundred downstream businesses in a single weekend,3 a breached support system at Okta exposed session material affecting its customer base,4 a hijacked accounting-software update channel in Ukraine became the launch vector for NotPetya,5 and, on the availability side of the same coin, one faulty content update from CrowdStrike disabled roughly 8.5 million Windows machines in a morning.6 In every case, the same integration that made the platform efficient is what carried the failure to everyone connected to it.

Security and resilience are different objectives, and platform consolidation trades one for the other. The distinction is simple and worth fixing in mind, because the two words are routinely used as if they were interchangeable. Security is about keeping bad things out: the lock on the door, the password policy, the patched server. Resilience is about what still works after something gets in or breaks: whether the business can take orders when the email system is down, whether staff can still sign in when the identity provider fails, whether one infected machine stays one infected machine. A house with an excellent lock and no smoke detector is secure but not resilient, and a hospital that can run on paper charts through a network outage is resilient even on a day its security fails. Consolidation raises the security average by reducing routine hygiene failures, and at the same time it increases the risk of rare but organization-wide failures by concentrating systemic dependency, common-mode failure, and provider-side blast radius. An organization can be harder to compromise on a typical day and more exposed to catastrophic correlated failure than it has ever been, and both statements can be true at once. Microsoft serves as the principal case study, not because it is uniquely at fault but because its combination of Windows, Entra ID, Microsoft 365, Defender, Sentinel, Azure, Intune, and Copilot forms the largest shared identity and management plane in enterprise computing, and because the Storm-0558 intrusion demonstrated how a provider-side compromise propagates beyond the provider's own environment.7 The same structural analysis applies to Google, AWS, Okta, Palo Alto Networks, and CrowdStrike, because the issue is architectural and economic rather than vendor-specific.

It all comes down to a single question that should sit inside every procurement decision, and currently sits inside almost none: if this trusted component suddenly becomes unavailable, compromised, or no longer trustworthy, how much of the organization continues to function? That question applies equally to AI models, identity providers, cloud platforms, security suites, and national digital infrastructure. Organizations that cannot answer it have solved one problem and replaced it with an even bigger one. They have made an uninformed trade into a different level of jeopardy, exchanging fixable small-scale security incidents for systemic large-scale failures.

SECTION 1

Introduction

This is not about Microsoft. Microsoft will appear throughout, and one Microsoft incident will serve as the principal case study, but the subject is larger than any vendor. The subject is a structural shift in how enterprises organize trust, and the fact that this shift happened without anyone formally deciding to make it.

Over the past fifteen years, enterprise computing moved from a portfolio of independent software products toward integrated trust platforms. The email system, the identity provider, the endpoint agent, the SIEM, the device manager, and increasingly the AI assistant no longer arrive as separate products from separate vendors with separate failure modes. They arrive as one platform, sharing one identity plane, one management plane, and one commercial relationship. The industry describes this as consolidation. That word is accurate but incomplete, because what consolidated was not merely the invoice. What consolidated was trust.

Modern enterprise security has quietly exchanged many independent failure domains for fewer, much larger trust domains. This is the hidden vulnerability of the platform era, and it needs to be stated plainly and examined in the open, because it currently lives nowhere: not in the vendor's marketing, not in the procurement checklist, not in the risk register. The exchange is not inherently good, and it is not inherently bad. It is a trade, and every trade has a cost. The security industry has spent a decade marketing the benefits of this trade while giving almost no sustained attention to its costs, which is precisely how the cost became an unexpected one. What follows is an attempt to state the costs plainly, so that organizations can decide whether the trade is one they meant to make, and whether alternatives exist that can alleviate the risk.

SECTION 2

The Platform Economy

Platform vendors did not set out to concentrate systemic risk. They set out to win customers, and they responded rationally to what customers asked for.

Consider the incentives from the buyer's side. A mid-sized organization running best-of-breed security in 2015 might have held contracts with a dozen vendors: one for email, one for identity, one for endpoint protection, one for log management, one for mobile device management, one for data loss prevention. Each contract meant a procurement cycle, a renewal negotiation, an integration project, a training burden, and a distinct console for a security team that was already understaffed. Integration between these products was fragile, expensive, and perpetually behind. Consolidation solved real problems. It reduced operational complexity, cut administration costs, replaced brittle third-party integrations with native ones, and gave security teams a single pane of glass that mostly worked instead of six panes that mostly did not. For many organizations, measured security outcomes genuinely improved.

Now consider the incentives from the vendor's side. Every additional product a customer adopts increases integration depth. Integration depth increases switching costs, and switching costs increase retention and pricing power. A vendor that sells one product competes on that product's merits every renewal cycle, while a vendor that sells a platform competes on the cost of leaving. Neither side is behaving badly here. Buyers are reducing friction, vendors are maximizing lifetime value, and these are the ordinary mechanics of enterprise software economics.

But follow the mechanics one step further. Deep integration between products requires those products to trust each other. The identity service must be trusted by the email service, the management agent must be trusted by the endpoint, and the security tooling must be trusted by everything, because it must see everything. Each act of integration is also an act of trust extension. The commercial logic of the platform economy, executed faithfully by rational actors on both sides, produces ever larger shared trust boundaries as a byproduct. Nobody designed that outcome. It emerged, and emergent architecture is precisely the kind that never gets a risk review.

SECTION 3

The Promise of Consolidation

It is important to state the case for platforms honestly, because the case is strong and the benefits are real and clearly visible. The argument that follows does not require pretending otherwise.

Platform consolidation improves the security average, and the evidence for this is reasonable. A single identity provider with consistent conditional access policies beats a patchwork of federation agreements maintained by hand. A natively integrated endpoint and SIEM stack surfaces signals that a bolted-together equivalent drops on the floor. Unified patching and configuration management reduce the routine hygiene failures that account for a large share of real-world breaches. Small organizations in particular gain access to security capabilities they could never have assembled or staffed independently. These are not marketing claims. They are true, and the typical organization on a well-run platform is probably harder to compromise on a typical day than the same organization running a loose federation of point products.

The mistake is stopping the analysis there. Security and resilience are not the same objective, and they do not always move together. Security asks how likely a compromise is, while resilience asks what happens when one occurs. Consolidation systematically improves the first measure while systematically degrading the second. It reduces the frequency of small, survivable failures and increases the severity of rare, correlated ones, so the everyday incidents become fewer while the catastrophic ones become larger.

An organization can therefore be more secure on average and simultaneously exposed to a category of failure it never faced before. Both statements are true at once. This is the “true, and” structure of the problem, and it is why the platform debate generates so much confusion. The vendor cites the improved day-to-day record, the critic cites the catastrophic exposure, and neither is wrong. The question is whether the organization ever consciously weighed that exposure, and in most cases the answer is no.

Figure 2. The trade, itemized. Each problem consolidation genuinely solved maps to a problem it introduced, and the two columns are not separable: the mechanism that delivers the benefit is the mechanism that creates the exposure. Procurement evaluated the left column. The right column arrived with it, unexamined.

SECTION 4

The Missing Conversation

Read any major security vendor's platform messaging and a pattern appears. The benefits of consolidation are quantified: fewer consoles, faster response times, lower total cost of ownership, reduced alert fatigue. The costs of consolidation are absent, and not minimized but absent. There is no slide in the deck titled “What happens to you if we are compromised.” There is no line in the business case for correlated failure. The renewal conversation covers licence tiers and feature roadmaps, and it does not cover blast radius.

This is not a conspiracy. It is an incentive structure. No vendor profits from articulating the systemic cost of its own success, and no procurement template asks for it. The result is an industry-wide conversation that resembles a mortgage broker explaining interest rates while never mentioning that the loan is denominated in a foreign currency. The stated terms are accurate, but the material risk is simply outside the frame.

Regulators have started to notice the shape of the problem in adjacent domains. Financial regulators speak of concentration risk when too many institutions depend on one clearing house or one cloud region. The security industry has no equivalent vocabulary in common use. It has “vendor lock-in,” which frames the issue as a commercial inconvenience, and “single point of failure,” which frames it as a component-level engineering flaw. Neither term captures what has actually been built: organization-wide dependence on the continued integrity of one provider's control plane. That gap in vocabulary is part of why the trade stayed hidden and its cost unexpected, because you cannot negotiate over a risk you cannot talk about. This is the conversation that needs to be in the open.

SECTION 5

Trust Concentration

The danger is not that one vendor sells many products. It is that the products become mutually trusting extensions of one security boundary. That distinction exposes the risk, so it is worth talking about clearly and examining without blinders.

A vendor that sells you ten unrelated products has sold you ten things. If one is compromised, you have a compromised product, and the other nine stand behind their own authentication, their own credentials, their own administrative planes. The failure is contained by architecture, not by luck. A vendor that sells you ten integrated products has sold you one product with many interconnected facets. The products authenticate through a common identity service, they are administered through a common management plane, and they extend trust to each other by design, because that mutual trust is precisely what makes the integration valuable. Single sign-on, unified policy, automatic enrolment, shared telemetry: every convenience on the feature list is a trust relationship on the architecture diagram, and each one needs to be examined in that light, asking who owns it, who can access it, and who controls it.

Compromise the common element and the compromise is not contained. It propagates along the same integration paths that the sales material celebrates. The identity plane that signs a user into email also signs that user into the document store, the device manager, the security console, and the AI assistant that has been granted standing access to all of the above. The feature and the failure mode are the same object viewed from opposite sides.

This is a systems principle, not an accusation. It applies to any sufficiently integrated platform from any vendor, and it applies outside computing entirely. Aviation engineers call it common-mode failure: the condition where nominally redundant systems fail together because they secretly share a dependency. Redundancy that shares a dependency is not redundancy. It is one system with extra steps. Enterprise security has spent a decade building exactly this structure and calling it defence in depth. Multiple products, multiple layers, multiple controls, one identity plane underneath all of them. The layers are real, but the independence is not, and the exposure scales with the plane: the more systems one identity plane underwrites, the greater the risk carried by its failure.

What remains is to examine what that structure looks like when it fails, why the clearest available case study is Microsoft, why the same logic already governs how sophisticated organizations think about AI dependence, and why the industry's most consequential architectural question is one almost nobody asks at procurement time: if this trusted component suddenly becomes unavailable, compromised, or no longer trustworthy, how much of the organization continues to function?

SECTION 6

Microsoft as Case Study

Microsoft is the case study for one reason, and it is not misconduct. It is scale, and a design focused on customer need and business revenue. The combination of Windows, Entra ID, Microsoft 365, Exchange, Defender, Sentinel, Azure, Intune, and Copilot forms the largest shared identity and management plane in enterprise computing, one plane underwriting the daily operation of governments, critical infrastructure, and a large fraction of the world's businesses. The scaling principle applies directly: the more systems one identity plane underwrites, the greater the risk carried by its failure, and no plane underwrites more than this one. In 2023, that risk stopped being theoretical.

The events are established in the public record. Between May and June 2023, a threat actor tracked as Storm-0558 and assessed to be affiliated with the People's Republic of China accessed Exchange Online mailboxes belonging to 22 organizations and more than 500 individuals, among them senior United States officials responsible for managing the relationship with China.7 The actor did not phish an administrator or exploit a customer's misconfiguration. It held a Microsoft consumer signing key, issued in 2016, and used it to forge authentication tokens, and a flaw in token validation meant that a key intended only for consumer accounts was accepted for enterprise ones. The key had been scheduled for retirement in March 2021 and was still in service two years later. The intrusion was detected not by Microsoft but by a customer, when analysts at the U.S. Department of State noticed anomalies through detection rules their own team had built on premium audit logging.

The Cyber Safety Review Board conducted the authoritative review, and its conclusions were unusually blunt for a public inquiry. The Board found the intrusion “preventable,” stated that it should never have occurred, described a long chain of avoidable security failures, and judged Microsoft's security culture inadequate, shaped by operational and strategic decisions that had deprioritized enterprise security investment in a company whose centrality in the technology ecosystem demanded the opposite.7 Two details in the record deserve particular weight. The first is that, as of the report's publication, Microsoft did not know how or when the actor obtained the key. The second is that meaningful detection required premium logging that many customers had not purchased, which meant visibility into a provider-side failure was itself a paid feature. Microsoft made that logging free after the incident, which was the correct response and also an admission of what the previous arrangement had been.

The engineering failures matter, and the architectural reading matters more. Consider what any victim organization could have done differently: nothing. No conditional access policy, no multi-factor rollout, no tenant hardening guide addressed a forged token signed with the provider's own key, because every control the victims owned operated below the plane where the failure occurred. The failure happened in the layer no customer can vet, with a credential no customer knew existed, discovered through telemetry most customers could not afford, in an incident the provider itself could not fully explain. Ownership, access, and control, the three questions every trust relationship should face, were answered by events: the customers owned none of it, could not see who reached it, and controlled nothing that would have stopped it.

Two honest qualifications complete the case study. Microsoft responded seriously, launching its Secure Future Initiative, hardening key management, and expanding free logging, and the record does not support a claim that Microsoft is uniquely negligent among providers. Storm-0558 has been tracked for over twenty years and is linked by industry to the 2011 theft of RSA SecurID seed material, because sophisticated actors have always hunted concentrated key material; it is the highest-value object in computing precisely because of what it unlocks.7 And that is the point that survives every qualification. The incident was not an aberration in an otherwise sound structure. It was the structure behaving exactly as designed under hostile conditions, at the largest plane in the industry, and the plane has only grown since, with AI assistants now holding standing access inside the same trust boundary.

SECTION 7

AI and the Blast Radius Principle

On 26 July 2026, Satya Nadella gave an interview to Fareed Zakaria on CNN that deserves close reading, because in it the chief executive of the largest platform company in the world articulated the resilience principle this analysis has been building toward, applied to artificial intelligence. His advice to businesses using AI was direct. Retain your data, your prompts, and the metadata generated every time you use a model, because that record is what would let you train weights of your own. Keep the harness, the context, and the memory separate from any single model, so that you can use several models and remain in control if one disappears. A firm that lacks this control, he said, “will not remain a firm because you've essentially outsourced your thinking.”8

Strip away the AI vocabulary and this is the working question in different clothes. If this model suddenly becomes unavailable, compromised, or no longer trustworthy, how much of the firm's capability continues to function? Nadella's prescription answers it the way a resilience engineer would: keep the assets that make the dependency valuable, the context, the memory, the orchestration, and the record of use, outside the dependency's trust boundary, so that the dependency stays substitutable. Substitutable dependence is manageable dependence. Dependence without substitution is the outsourcing of a function, and a function outsourced without an exit is a function that can be lost.

The consistency question follows on its own. If dependence on a single AI model threatens a firm's survival because its thinking has moved outside its control, dependence on a single platform deserves the same scrutiny, because what sits inside the platform is not thinking but functioning. The identity plane is the organization's memory of who its people are. The communication and document systems are its memory of what it knows and has decided. The management plane is the orchestration of everything it operates. An organization that cannot authenticate, communicate, or administer itself when one provider fails has outsourced not its thinking but its ability to act, and no consistent application of Nadella's principle can exempt the platform that employs him, or any of its competitors, from the standard he set for AI. This is not an accusation of hypocrisy. The advice is correct, and correct advice earns consistent application: retain your context, preserve your orchestration, avoid dependence on any single provider, and remain in control if one disappears.

AI then raises the stakes on the platform side of the comparison, because the two subjects are converging. Assistants and agents do not arrive as separate systems with separate credentials. They join the existing plane, authenticate through the same identity service, and hold standing access to the mail, documents, and telemetry the plane already unifies, and increasingly they hold delegated authority to act. The blast radius of the shared plane now extends beyond reading an organization's information to doing things in the organization's name. The trade is the familiar one, capability purchased through trust extension, and it means the single-model warning and the single-plane exposure are the same lesson at two layers. The organizations best positioned for the AI era will be the ones that learned it at both.

SECTION 8

Google, AWS and the Industry

None of this is a Microsoft condition, and the structural analysis applies across the industry with the same evenhandedness. Google operates the same architecture at comparable scale. Workspace and Cloud Identity consolidate mail, documents, meetings, and device management under one Google account and one admin console, and a compromise of that account layer or of Google's own signing infrastructure would propagate exactly as the model predicts. Amazon concentrates differently but no less consequentially. AWS Identity and Access Management is the control plane for a vast share of the world's production infrastructure, and AWS Organizations extends it so that a compromised management account governs every account beneath it. The market is different; the architecture is the same.

The identity and security vendors deserve particular attention, because their products are the trust concentration. Okta's offering is the shared identity plane sold as a standalone service, which makes Okta a super-administrator for thousands of organizations that run nothing else of Okta's, and its 2023 support-system breach demonstrated the provider-side path into customer sessions in miniature.4 Palo Alto Networks named its strategy plainly, describing the folding of firewalls, cloud security, and security operations into a single offering as platformization.9 CrowdStrike's consolidation pitch is equivalent, and its July 2024 content update demonstrated what the availability side of a trusted channel looks like at scale.6 The companies selling protection from concentrated risk are pursuing concentration as their growth strategy, and there is no contradiction in their doing so, because the economics reward it. That is precisely the problem.

The universality now has a regulatory echo, because the institutions responsible for systemic risk have started to treat providers as systemic. Financial regulators developed the vocabulary first, in concentration risk, and the European Union's Digital Operational Resilience Act goes further, establishing direct oversight of ICT third-party providers designated as critical to the financial sector, on the explicit reasoning that a provider's failure is a systemic event for everyone built on it.10 Regulation is a lagging indicator, and its arrival is the clearest available confirmation that the exposure described here is real. Authorities do not build oversight regimes for hypothetical risks.

The conclusion of the industry survey is the one that matters for decisions. Changing vendors does not exit the structure, and changing jurisdictions does not either, since every provider answers to some flag and every platform concentrates by design. The exposure is escaped only by architecture, and the question an organization should be asking is never which platform to trust, but how much of the organization still stands when any platform fails.

SECTION 9

Security versus Resilience

Security and resilience are different objectives, and the difference is worth stating with some rigour, because the trade between them, whose price the customer ultimately pays, is the missing conversation and the big-picture view where the analysis converges. Security is concerned with the likelihood of compromise: keeping hostile actors and failures out, reducing the probability that a bad day begins. Resilience is concerned with behaviour under failure: what continues to function once the bad day has started, how far the damage spreads, and how the organization recovers. Mature engineering disciplines hold the two apart as a matter of course. Automotive engineering distinguishes collision avoidance from crashworthiness, and no serious manufacturer argues that good brakes make airbags unnecessary. Enterprise computing routinely collapses the two into the single word security, out of convenience, misunderstanding, or marketing need, and the collapse is where the trade hides.

Consolidation trades the two against each other through one mechanism, the shared plane. The plane raises the security average honestly: consistent policy, unified patching, integrated monitoring, and professional operations reduce the routine failures that produce most incidents. The same plane couples failure domains, so the incidents that do occur are correlated across everything the plane touches. The everyday failures become fewer and the catastrophic ones become larger, which is the trade stated as engineering rather than as marketing. The resilience discipline exists to face this squarely. NIST's cyber resiliency engineering framework begins from the assumption that compromise will occur and asks systems to anticipate, withstand, recover, and adapt,11 which is a formal way of saying that resilience is engineered in advance or not at all. The hospital that runs on paper charts through a network outage did not improvise that ability during the outage. Someone designed it, funded it, and rehearsed it while the network still worked.

Why, then, does the trade keep being made? The most honest answer is a measurement asymmetry. Security improvements are measurable on a quarterly cadence: incident counts fall, patch compliance rises, scores improve, and every stakeholder from the analyst to the board sees the line move. Resilience is tested only by rare events, so its erosion produces no signal at all. The organization that quietly loses its ability to function without its platform sees nothing on any dashboard, and may in fact watch every measured metric improve while it happens. Organizations optimize what they can measure, and consolidation flatters every measured metric while consuming the unmeasured one. The vendor's numbers are real. The erosion is real. Both are true at once, and only one of them appears in the budget and on the executive suite's agenda. And when a problem finally exposes the erosion, it registers as a serious loss and a post-mortem mention, and even then it often fails to cycle into the yearly awareness process, so the organization absorbs the incident without absorbing the lesson, and the asymmetry resets for another cycle.

What resilience actually looks like, as an organizational property, is concrete. Identity that can fail without stopping the business, because break-glass access and offline authentication paths exist and are tested. Communications with an out-of-band channel that does not share the platform's fate. Degraded-mode operations that are planned, documented, and rehearsed rather than invented mid-incident. Exit capability preserved while it is still affordable, in data formats, in contracts, and in institutional knowledge. None of this can be purchased as a feature, because resilience is a property of the organization's architecture and preparation, not of any product inside it, and no platform can sell independence from itself.

SECTION 10

What Should Be Done

The first correction is conceptual, and it dissolves the assumption on which the entire one-bucket model rests. Operating at scale does not require a single integrated platform. That equation, scale therefore consolidation, is an un-engineered simplification, and it entered the industry through marketing rather than through need. No requirements analysis produced it. It is what organizations absorb when they respond to vendor messaging instead of their own environment. Every other discipline that engineers at scale reaches the opposite conclusion: aircraft separate flight controls from cabin systems, power grids partition into islands that can shed and reconnect, and naval architects divide hulls into compartments precisely so that one breach does not become a sinking. Scale in serious engineering produces segmentation and independence of critical functions. Only in enterprise IT has scale been sold as a reason to merge everything behind one identity plane, and the difference is not that IT discovered a better principle. The difference is that IT let its architecture be designed by its procurement.

The discipline that corrects this already exists, and it needs to be embedded into security decisions rather than treated as a specialty for defence programmes. Systems Security Engineering, in the sense of NIST SP 800-160 rather than the Gartner market category that shares the acronym, treats security as an engineering concern that must be present from requirements onward: identifying critical assets, modelling threats at the architectural level, evaluating trade-offs explicitly, and producing verifiable evidence for why a system deserves trust.11 Peter Hillier has made the sharpest recent case for this discipline, arguing that Zero Trust, whatever its merits as a runtime enforcement posture, is incomplete because it treats access as the whole problem and cannot guide the design of the system it protects; in his formulation, Zero Trust is the bouncer while systems security engineering is the architect.12 Applied to the platform question, the discipline changes what a procurement decision is. Before an organization adopts an integrated platform, systems security engineering requires it to model what the shared trust boundary actually contains, to treat the provider itself as a dependency with failure modes, to ask what continues to function when the common element fails, and to demand evidence rather than assurances. Hillier extends the same argument to the supply chain, and it lands directly on trust concentration itself: contract clauses, attestations, and certifications cannot reveal whether an architecture over-trusts a third-party service, whether a critical dependency has quietly become a single point of mission failure, or whether update mechanisms are constrained, monitored, and recoverable.13 Those are engineering questions, and only engineering work answers them.

This points to the final and least welcome correction, which is cultural. In security there is no easy solution, and the marketing of one is itself a signal worth flagging as a problem. A vendor whose pitch is that complexity disappears inside their platform is asking the organization to relocate its complexity, not eliminate it, and to relocate it into a layer the organization can no longer see, audit, or revoke. Any offering marketed as the simple answer to enterprise security should be treated as questionable on that basis alone, because the claim misrepresents the nature of the problem. What actually reduces risk is unglamorous: understanding your own environment, mapping the dependencies you have rather than the ones the reference architecture assumes, analyzing failure modes before they are demonstrated for you, preserving exit capability while it is still affordable, and doing that work continuously as the environment changes. This is hard work, and it is a necessity rather than an option, because the alternative is not a simpler security posture. The alternative is an unexamined one that opens your organization to extreme risk, held together by a vendor's assurances, waiting for the day events answer the working question and expose an internal lack of knowledge and process that was there all along.

SECTION 11

Over fifteen years, enterprise computing traded many small, independent failure domains for a few very large shared ones. The shift happened almost quietly, and the few who voiced concerns were dismissed as resistance against progress and security itself. It emerged from rational behaviour on both sides of every transaction: buyers reducing friction and acquiring skills they could not hire, vendors deepening integration because integration is what retains customers. The benefits were real and remain real, and the cost was structural, cumulative, and absent from every document in which the exchange was agreed. What was purchased was a better average day. What was paid was the independence of everything behind one identity plane, the ability to vet the people holding the greatest access, the capacity to function when the shared layer fails, and a transfer of ownership and control away from the customer and onto the operating business, without any assurance of accountability or transferability in return.

The evidence carries the argument without embellishment. Storm-0558 demonstrated a provider-side compromise crossing tenant boundaries with a credential no customer knew existed, at the largest plane in the industry, in an incident the provider could not fully explain. SolarWinds, Kaseya, NotPetya, Okta, and CrowdStrike demonstrated the same propagation through build systems, management platforms, support systems, and update channels, and Crypto AG demonstrated that even the ownership of a vendor cannot be assumed. Every one of these was a failure in a layer the affected customers could not name, screen, supervise, or remove. The honest accounting holds both truths at once. The organizations on these platforms were, on the typical day, harder to compromise than they would have been alone, and on the atypical day they discovered their fate was coupled to thousands of strangers through a single point of trust, with the price of the coupling paid by them and not by the parties who designed it.

The corrective does not require a new idea, because every principle needed is already evident in other industries that have gone through the same pain points, lessons that IT security has somehow missed. Aviation, power, and naval engineering already build scale through segmentation and independent failure domains. Systems security engineering already exists as a discipline and asks the right questions at the right time. Somehow even the industries that learned these lessons in steel and at sea are having difficulty applying the same principles to their own IT systems, operating compartmentalized hulls and partitioned grids on top of consolidated identity planes, as if the discipline applied to everything except the computing that now runs it. The chief executive of the largest platform company has already articulated the standard, telling enterprises to retain their context, keep their memory and orchestration separate from any single model, and remain in control if a provider disappears, on the grounds that a firm without that control has outsourced something it cannot remain a firm without. Nothing in that standard is specific to AI. The work is not invention. The work is consistency, applying the industry's own best principles to the platforms where they are least welcome, because that is where the concentration is greatest.

The practical instrument is one question, asked before any contracts are signed rather than after the incident, and asked even in emergencies and under stress, because pressure is exactly when skipping it multiplies errors: if this trusted component suddenly becomes unavailable, compromised, or no longer trustworthy, how much of the organization continues to function? The question applies without modification to an AI model, an identity provider, a cloud platform, an enterprise security suite, and a nation's digital infrastructure, because all of them are the same object at different scales, a concentration of trust that something else depends on. The question will not ask itself. The cycle does not self-correct, since incidents produce post-mortems and post-mortems fail to be reflected in operations unless their lessons are specifically highlighted and chosen, so the question survives only where someone puts it in the budget, on the agenda, and in the procurement template, and keeps it there. An organization that can answer it has options, degraded modes, and an exit. An organization that cannot has paper assurances and no backup plan when things go wrong.

None of this argues for abandoning platforms, and none of it can honestly be read as nostalgia for a dozen consoles and brittle integrations. The platform era is not reversible and, on its own terms, not regrettable. The argument is narrower and harder. The trade at its centre must be made with open eyes, priced in the budget, owned by executives who are held accountable for it, and engineered against by the organizations they serve, because examined or not, it is already the reality they operate in. A hidden trade, fixing one problem and inheriting an even bigger one, does not go away because nobody discusses it. The only decision actually available is whether to see it, and the organizations that choose to see it will be the ones still functioning on the day the question stops being hypothetical. That day is approaching faster than the fifteen-year arc suggests, because AI is transforming the speed of scale, folding new capability and new authority into the same shared planes in quarters rather than decades, and it has moved this challenge from the background of enterprise architecture to the forefront. The trade is compounding while the conversation is still missing. Caveat emptor.

Endnotes and Sources

AI collaboration: this essay was researched, drafted, and source-verified in collaboration with Claude (Anthropic). All positions, judgments, and final wording are the author's.

---

Footnotes

1. Crypto AG / Operation Rubicon. Crypto AG, a Swiss manufacturer of encryption equipment, was secretly owned from 1970 by the U.S. Central Intelligence Agency and Germany's Federal Intelligence Service (BND), and sold deliberately weakened devices to more than 100 governments; the BND exited in the early 1990s and the CIA retained ownership until the company's sale in 2018. Greg Miller, “The intelligence coup of the century,” The Washington Post, 11 February 2020, joint investigation with ZDF and SRF, https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/, accessed 7 August 2026. ↩

2. SolarWinds Orion supply chain compromise (SUNBURST), disclosed December 2020. SolarWinds stated in its Form 8-K filed with the U.S. Securities and Exchange Commission (14 December 2020) that up to approximately 18,000 customers may have installed the trojanized Orion update. See also CISA Cybersecurity Advisory AA20-352A, “Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations,” 17 December 2020 (last revised 15 April 2021), https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a, accessed 7 August 2026. ↩

3. Kaseya VSA supply chain ransomware attack, July 2021. REvil ransomware was distributed through a vulnerability in the Kaseya VSA remote management platform, affecting managed service providers and, per Kaseya's estimates, fewer than 1,500 downstream businesses. CISA, “Kaseya Ransomware Attack: Guidance for Affected MSPs and their Customers,” July 2021, https://www.cisa.gov/news-events/news/kaseya-ransomware-attack-guidance-affected-msps-and-their-customers, and CISA-FBI joint guidance, 4 July 2021, https://www.cisa.gov/news-events/alerts/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa-supply-chain-ransomware-attack, both accessed 7 August 2026. ↩

4. Okta support case management system breach. From 28 September to 17 October 2023, a threat actor using a compromised service account accessed files associated with 134 Okta customers, including HAR files containing session tokens later used to hijack the sessions of five customers; a subsequent review found the actor had also run a report containing names and email addresses of all customer support system users. David Bradbury (Chief Security Officer, Okta), “Tracking Unauthorized Access to Okta's Support System,” 20 October 2023, https://sec.okta.com/articles/2023/10/tracking-unauthorized-access-oktas-support-system/; “Root Cause and Remediation,” 3 November 2023, https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/; “Update and Recommended Actions,” 29 November 2023, https://sec.okta.com/articles/october-security-incident-recommended-actions/, all accessed 7 August 2026. ↩ ↩2

5. NotPetya, June 2017. The destructive malware was seeded through the compromised update mechanism of M.E.Doc, Ukrainian accounting software, and propagated globally across firms including Maersk and Merck. The White House, Statement from the Press Secretary, 15 February 2018, attributed the attack to the Russian military and described it as the most destructive and costly cyber-attack in history, causing billions of dollars in damage across Europe, Asia, and the Americas; as reported by CNN, “White House blasts Russia for NotPetya cyberattack,” 15 February 2018, https://www.cnn.com/2018/02/15/politics/white-house-russia-notpetya, accessed 7 August 2026. ↩

6. CrowdStrike Falcon content update incident, 19 July 2024. A faulty channel file update caused system crashes on approximately 8.5 million Windows devices. David Weston (Vice President, Enterprise and OS Security, Microsoft), “Helping our customers through the CrowdStrike outage,” The Official Microsoft Blog, 20 July 2024, https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/, accessed 7 August 2026. See also CrowdStrike, Preliminary Post Incident Review, July 2024. Not a compromise but a demonstration of update-channel blast radius. ↩ ↩2

7. Storm-0558 intrusion, May to June 2023, disclosed July 2023. A threat actor assessed to be affiliated with the People's Republic of China acquired a Microsoft account consumer signing key issued in 2016 and used it, together with a token-validation flaw that accepted consumer-signed tokens for enterprise accounts, to access Exchange Online mailboxes of 22 organizations and more than 500 individuals; Microsoft's initial disclosure cited approximately 25 organizations. Cyber Safety Review Board, Review of the Summer 2023 Microsoft Exchange Online Intrusion, dated 20 March 2024 and released 2 April 2024, https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewOfTheSummer2023MEOIntrusion508.pdf, accessed 7 August 2026. ↩ ↩2 ↩3 ↩4

8. Satya Nadella, interview with Fareed Zakaria, Fareed Zakaria GPS, CNN, aired 26 July 2026, https://www.cnn.com/2026/07/26/business/video/gps-0726-microsoft-interview-satya-nadella, accessed 7 August 2026. See also TechCrunch, “Satya Nadella says companies that trust one AI for everything may not survive,” 27 July 2026, https://techcrunch.com/2026/07/27/satya-nadella-says-companies-that-trust-one-ai-for-everything-may-not-survive/, accessed 7 August 2026. ↩

9. Palo Alto Networks announced its “platformization” strategy on its fiscal second-quarter 2024 earnings call, February 2024 (chief executive Nikesh Arora), and has since described it as the company's core strategy; see Palo Alto Networks, fiscal Q4 2024 earnings release (Form 8-K exhibit), 19 August 2024, quoting Arora on “strong execution on our platformization strategy,” https://www.sec.gov/Archives/edgar/data/1327567/000132756724000023/ex991q424earningsrelease.htm, and Futuriom, “Palo Alto Shares Plunge on Strategy Shift,” February 2024, https://www.futuriom.com/articles/news/palo-alto-shares-plunge-on-strategy-shift/2024/02, both accessed 7 August 2026. ↩

10. Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (DORA), applying from 17 January 2025, including a pan-European oversight framework for ICT third-party service providers designated as critical (designation criteria specified in Commission Delegated Regulation (EU) 2024/1502), https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng, accessed 7 August 2026. ↩

11. NIST Special Publication 800-160, Volume 1 Revision 1, Engineering Trustworthy Secure Systems (Ron Ross, Mark Winstead, Michael McEvilley, November 2022), https://csrc.nist.gov/pubs/sp/800/160/v1/r1/final, accessed 7 August 2026, and Volume 2 Revision 1, Developing Cyber-Resilient Systems: A Systems Security Engineering Approach (2021), linked from the Volume 1 publication page; direct DOI https://doi.org/10.6028/NIST.SP.800-160v2r1 [UNVERIFIED; alternative: navigate from the Volume 1 page above]. ↩ ↩2

12. Peter Hillier, “Beyond the Buzzword: Why Systems Security Engineering Delivers More Than Zero Trust Ever Could,” Medium, 17 June 2025, https://medium.com/@pjhillier/beyond-the-buzzword-why-systems-security-engineering-delivers-more-than-zero-trust-ever-could-e60065804d0d, accessed 7 August 2026. ↩

13. Peter Hillier, “Supply Chain Security Is Not Just a Procurement Clause,” Medium, 7 April 2026, https://medium.com/@pjhillier/supply-chain-security-is-not-just-a-procurement-clause-702645a8614d, accessed 7 August 2026. See also Peter Hillier, “Systems Security Engineering Is Supply-Chain Security (Whether Industry Likes It or Not),” Medium, 11 February 2026, https://medium.com/@pjhillier/systems-security-engineering-is-supply-chain-security-whether-industry-likes-it-or-not-31971977f28f, accessed 7 August 2026. ↩

The Latin American Institute of Terraforming was invited to participate in a public hearing before the Committee on Science, Technology, Innovation, and Information Technology of the Brazilian Federal Senate to discuss Bill No. 3018 of 2024, which regulates the operations of artificial intelligence data centers.

During the session, we began by reviewing the diverse, growing, and as-yet-unknown socio-environmental impacts of data centers. We therefore demonstrated that the precautionary principle—as a rule for environmental protection and public health—appears to be the appropriate public policy for addressing the growing and as yet unknown impacts of this infrastructure.

We then provided an overview of Latin America, which led us to conclude that: governments across the continent have a debt to settle regarding the sustainability of AI; self-regulation does not work for the sustainability of data centers; and the challenge requires specific regulatory frameworks with clear conditions.

Likewise, in reviewing the Chilean case, we conveyed to the Senate that, due to the lack of clear legal safeguards governing the socio-environmental impacts of this infrastructure, data center projects in Chile often end up in court, which entails significant capital costs and uncertainty for both companies and affected communities.

This may serve as a useful lesson for Brazil, showing that the lack of adequate legal frameworks and public policies has delayed plans to develop this infrastructure, and that such infrastructure cannot be developed without involving communities throughout the environmental assessment process.

Among our suggestions for Bill 3018/2024 are:

1. Strategic and participatory socio-environmental planning as a role of the State: Above all, to avoid what is happening in the United States, where states compete aggressively to attract hyperscale data centers and decisions are shifted from public forums to private agreements and executive orders. This model privatizes benefits and control while socializing economic risks and environmental damage. It also undermines democratic accountability and resilience in the face of ecological limits (Kollar, J., 2026).

2. Requirement to undergo participatory and territory-specific environmental licensing procedures.

3. Requirements for metrics and accountability mechanisms regarding socio-environmental impacts.

4. Ensure mechanisms for energy justice.

5. Not losing sight of fundamental issues for public policy, such as the low social value of AI among populations like that of the United States, the minimal employment impact of data centers, and the risks of an economic and financial AI bubble—all of which leave open the question of how Brazil should legislate to address these dangers and shield its economy and population.

You can read our full statement at this link.

#English

---