Four checks from the week, none of them optional for very long. The week ran from a regulator deadline to the gap between feeling productive and being profitable, then closed on who controls your tools. - A date you can diarise. PDPC steps up enforcement from the start of 2027 against NRIC numbers used to authenticate. The audit belongs this quarter. - A ratio that explains your integration bills. Most applications in the average estate are not connected, and a third of IT time goes to wiring them by hand. - A gap between productive and profitable. Smaller organisations did not move on agent scaling while larger ones did, and financial impact stayed flat. - A reminder that tools rest on contracts. One coding tool loses a model family in November, and two further vendor posts covered security findings and agents running physical devices. Take the deadline first. The other three are decisions, not dates.

Three vendor decisions in one week, none of them about benchmarks. OpenAI notified SpaceX on 28 August that it intends to wind down the contract providing OpenAI models to Cursor, with a proposed shutoff date of 12 November 2026. - Ownership can end your model access. OpenAI cited the change of control and terms of service compliance, and gave the maximum notice its contract allowed. - Your coding tool is a dependency. Anyone relying on those models inside Cursor now has a fixed window to plan an alternative. - Supply chain security got its own post. OpenAI published findings from the Hugging Face incident on 26 August alongside steps on model security and monitoring. - Agents are reaching hardware. Anthropic opened a research preview of the Model Hardware Standard on 27 August, a shared specification for agents operating physical devices. Write down which vendor contract sits under every tool you depend on.

Individual productivity is real. Enterprise profit has not caught up. McKinsey surveyed 1,719 respondents across 97 nations between May and June 2026. The share of smaller organisations scaling AI agents stayed flat at 22% while larger organisations moved from 27% to 40%. Enterprise financial impact barely shifted, with 37% attributing at least some EBIT impact to AI. - High performers stayed rare. Only 6% attribute 5% or more of EBIT to AI, the same share as the previous year. - Redesign is what separates them. Nearly three quarters of high performers redesigned workflows outright, against roughly one quarter of everyone else. - Running costs have started to bite. One in five organisations say AI operating costs, tokens included, are constraining use. - Building is now a real option. 32% decided against buying a software product because coding agents let them build it in house. Redesign one workflow properly before you buy the next seat.

You cannot orchestrate what was never connected in the first place. MuleSoft surveyed 1,050 IT leaders for its 2026 Connectivity Benchmark Report. The average organisation now runs 957 applications with only 27% of them connected. Teams also report spending 36% of their time designing, building and testing custom integrations. - Coupling is the hidden tax. 71% say their infrastructure makes systems overly dependent on one another, which is why one change breaks three things. - Integration is the named AI blocker. 82% of IT leaders put data integration among the biggest challenges they face when using AI. - Agents inherit the mess. 86% agree that without proper integration, agents add complexity rather than value, and half of agents currently run in silos. - Ungoverned interfaces are the quiet risk. 27% of APIs sit outside any governance, and only 54% of organisations run a central framework. Count your connected applications before you count your agents.

Your login screen may be the compliance gap nobody has audited yet. PDPC has set a hard stop. From 1 January 2027 the Commission will step up enforcement against private organisations using NRIC numbers for authentication, pointing them to the June 2025 joint advisory issued with CSA. - Authentication is not identification. Recording an NRIC number differs from using it to verify someone. The second use has to go. - This is a security failure, not paperwork. PDPC says the practice raises the risk of unauthorised access and may breach the duty to keep reasonable security arrangements. - Check the quiet systems first. Membership portals, booking forms, document passwords and phone verification scripts are where these logins survive unnoticed. - A companion advisory landed with it. PDPC also published guidance on common data protection lapses, which reads well as an audit checklist. Four months of runway is plenty, but only once you start counting.