GRC Report Staff

UK CMA Investigates Microsoft Over Copilot Subscription Changes

When Microsoft folded Copilot into its Microsoft 365 subscriptions last year, the change arrived quietly enough. Existing customers on Personal and Family plans suddenly found themselves with new AI features at no extra cost for the remainder of their subscriptions. The real decision came later, when renewal notices began arriving and the free addition became a more expensive default.

Australian Privacy Commissioner Revises Retail Facial Recognition Guidance

The legal fight over Bunnings may be over, but the Office of the Australian Information Commissioner is making sure its lessons are not left behind in a tribunal ruling. The regulator on Tuesday published updated guidance for organizations covered by the Australian Privacy Principles that are considering deploying facial recognition technology in busy, publicly accessible spaces such as retail storefronts. The revisions are not a change in the law. They are a statement of how the Office of the Australian Information Commissioner (OAIC) intends to apply it after the Administrative Review Tribunal's March 2026 decision in the long-running Bunnings case.

Columbus Energy Faces Polish Consumer Protection Proceedings Over Renewable Energy Sales Practices

The President of the Office of Competition and Consumer Protection (UOKiK) has opened proceedings against Columbus Energy, one of Poland's best-known renewable energy installers, over allegations that the information consumers received before signing a contract, the way the company described their right to withdraw, and the time some customers waited to recover their money after exercising that right.

BIS Warns Frontier AI Is Giving Cyber Attackers a Cheaper Way In

Anthropic’s Mythos did not merely find a weakness in a computer network. In testing, it followed the weakness through. The frontier artificial intelligence model identified vulnerabilities, developed exploits and carried an attack across multiple stages, adjusting its approach with limited human oversight. In some attempts, it completed a full network takeover. OpenAI’s GPT-5.5, released weeks later, showed similar capabilities and performed slightly better on a benchmark of expert-level cybersecurity tasks.

EY Sanctioned Over Made.com Audit Failures as FRC Cites Weak Challenge of Management Forecasts

The UK's audit watchdog has fined Ernst & Young £1,197,000 after concluding the firm failed to obtain sufficient audit evidence in critical areas of its 2021 audit of online furniture retailer Made.com Group, shortcomings the regulator said stemmed from an inadequate challenge of management's forecasts.

MAS & Singapore Banks Form AI Taskforce as Frontier Models Redraw the Cyber Threat Landscape

Since May, regulators, banks and financial infrastructure operators in Singapore have been sitting around the same table, confronting a problem that is becoming harder to dismiss with each new generation of artificial intelligence. On Tuesday, that quiet collaboration acquired a name. The Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) formally launched the AI-Driven Cyber and Technology Risk Taskforce, or ACT, an industry-wide initiative intended to strengthen the financial sector's defenses against threats created by frontier AI models.

Harvey Norman, Latitude Ordered to Pay $35.9 Million Over Misleading Interest-Free Finance Campaign

On Tuesday, the Australian Federal Court ordered Harvey Norman Holdings and Latitude Finance Australia to pay a combined $35.9 million (AUD $55 million) after finding they engaged in misleading conduct and made false or misleading representations in a nationwide advertising campaign that ran between January 2020 and August 2021. Harvey Norman was ordered to pay $22.8 million (AUD $35 million), while Latitude was ordered to pay $13.1 million (AUD $20 million). According to the Australian Securities and Investments Commission (ASIC), the combined penalty is among the largest it has secured in a case involving misleading conduct related to financial products and services.