Microsoft signs UK AISI + US CAISI. NHS locks GitHub. Berlin closes a decade.

Microsoft on Tuesday announced new agreements with the UK AI Security Institute (AISI) and the US Center for AI Standards and Innovation (CAISI), structuring its frontier-model evaluation relationship with both governments simultaneously. With CAISI, the agreement covers pre-deployment evaluation of national-security capabilities — cyber, biosecurity, chemical weapons. The UK agreement covers high-risk capability evaluation, safeguard testing, and a third strand: research on how conversational AI systems interact with users in sensitive contexts. AISI describes the partnership as “sustained two-way collaboration between government and companies developing and deploying frontier AI”.

For Europe, the structural detail is that the UK has, on this day, deliberately positioned its frontier-safety regime as broader in scope than the US one. AISI’s remit now publicly extends into societal-resilience work — areas including emotional dependency on AI systems, mental-health interactions, and the erosion of trust in human professionals such as doctors and therapists. These have been recognised research priorities for AI safety institutes globally, but UK and US agencies have moved cautiously into them. Anchoring this work in a Microsoft commercial partnership puts it on a different footing.

The transatlantic alignment is now visible. CAISI signed Tuesday with Google DeepMind, Microsoft, and xAI, building on its 2024 partnerships with OpenAI and Anthropic that have been renegotiated. AISI’s separate Microsoft partnership is the largest commercial counterparty Britain has signed. The European Union has neither an institutional equivalent nor a comparable agreement with any frontier lab. The AI Act regulates how AI is deployed inside the Single Market. It does not give Brussels access to the models before they are deployed. London does have that access. Washington does have that access. Brussels does not. That gap is now operationally visible across two consecutive days of formal announcements.

According to reporting first published in the New York Times and confirmed by Reuters, the Wall Street Journal, and Axios, Trump administration officials are now actively considering an executive order that would create a federal review process for new artificial-intelligence models before they reach the public. A White House AI working group has been convened. Tech executives from OpenAI, Google, and Anthropic have been briefed. The catalyst, on the record, is Anthropic’s Claude Mythos Preview — the same model that triggered the Eurogroup’s access demands on Monday.

The reversal is sharp by any measure. On January 20, 2025, Trump revoked Biden’s October 2023 executive order, which had used the Defense Production Act to require developers of high-risk AI systems to share safety-test results with the federal government before deployment. Three days later he issued his own order, “Removing Barriers to American Leadership in Artificial Intelligence”, signalling deregulation as the policy frame. In June 2025, his administration renamed the AI Safety Institute to the Center for AI Standards and Innovation. Commerce Secretary Howard Lutnick described the rebrand as a repudiation of safety being “used under the guise of national security”. The new discussions reverse roughly fifteen months of deregulatory posture, in response to a single model.

For Europe, the implications are structural. A US pre-release vetting regime would close part of the regulatory asymmetry that has been visible all week — the AI Act regulates deployment, but the most consequential decisions about frontier models have happened upstream of deployment. The structural model under discussion at the White House, according to multiple reports, deliberately mirrors the UK AISI framework. If a US executive order is signed, the world’s three principal frontier-AI safety regimes — CAISI, AISI, and a still-to-be-named US successor framework — will sit in the United States and the United Kingdom. The European Union’s AI Act, finalised in 2024 and now days from its August 2 high-risk deadline, will not occupy that layer of the architecture.

The Rise of AI Conference 2026 closed its tenth-anniversary edition on Wednesday at Humboldt Carré in Berlin. Founded by Fabian Westerheide in 2015 as a Singularity discussion meetup, Rise of AI has grown over a decade into one of the most consistently relevant gatherings of European AI decision-makers — deliberately constrained at around 300 in-person seats and roughly 1,400 online viewers in order to keep the conversations substantive rather than the audience large.

The two-stage programme — the Meta Stage for policy and business, the Applied AI Stage for practical deployment — covered four core themes: applied AI, regulation and policy, sustainable and trustworthy AI, and strengthening Europe’s AI ecosystem. Confirmed speakers included Prof. Dr. Jürgen Schmidhuber (Director of the AI Initiative at KAUST and a foundational figure in modern deep learning); Prof. Dr. Peter Sarlin (co-founder and CEO of AMD Silo AI); Dr. Irakli Beridze (Head of the UN Centre for AI and Robotics, UNICRI); and Prof. Dr. Feiyu Xu (Professor of Industry AI at the German University of Digital Science). Speakers from deepset, Cloudian, and the Berlin Senate Department for Economics and Energy joined the Applied AI Stage rotation.

The conference’s timing this year landed unusually well. The same week brought the SAP/Prior Labs €1 billion commitment, the EEA briefings on AI’s environmental footprint, the Eurogroup’s Mythos access standoff, the CAISI agreements with three frontier labs, AISI’s Microsoft partnership, and now reports of a Trump executive order on pre-release review. The Berlin convening was, in effect, the European AI ecosystem’s opportunity to debate in person what every other room this week had been debating institutionally. The continuing question, raised repeatedly across both stages, is whether Europe will be a builder or a buyer of frontier capability over the next decade — and whether the answer is set in Berlin, in Brussels, or, increasingly, in Washington and London.

On April 29, 2026, NHS England issued an internal guidance note designated SDLC-8, ordering that all source code repositories “must be private by default” and may not be public “unless there is an explicit and exceptional need.” The compliance deadline is May 11, 2026; teams seeking exemption had to apply by May 6 — yesterday. The guidance was approved by the NHS Engineering Board. The justification, named explicitly: the risk that frontier AI models — specifically Anthropic’s Mythos — could ingest the code and reason over it for vulnerabilities. The story was broken by The Register and New Scientist; the leak source was Terence Eden, a former NHSX adviser and prominent UK open-source advocate.

An NHS England spokesperson told The Register: “We are temporarily restricting access to some NHS England source code to further strengthen cybersecurity while we assess the impact of rapid developments in AI models. We will continue to publish source code where there is a clear need.” The reaction inside the open-source community has been sharp. An open letter on Keep Things Open has now collected over 682 signatures, including former UK Health Secretary Matt Hancock, who described the policy as a “huge mistake”. Critics including Eden argue that Mythos has likely already ingested the public code — closing it now does not retract that — and that the NHS’s own service standard requires open-source publication of taxpayer-funded software. Neither the UK AI Security Institute nor the NCSC has recommended this action.

The same day, the UK’s National Cyber Security Centre (NCSC) published its first formal position on AI in cyber defence at the CYBERUK 2026 conference. Deputy chief technology officer Peter Haigh warned that AI can improve threat detection, vulnerability discovery, software security, and incident response — but that frontier tools are unreliable, hard to validate, and hard to integrate safely. “In the near term, AI is likely to expose weaknesses in organisations that have not taken appropriate steps to secure their systems,” Haigh said. The NCSC published an eight-pillar risk framework that UK enterprise security leaders can now use as the audit basis for AI defence procurement. Haigh’s remarks were delivered alongside the keynote address by Security Minister Dan Jarvis.

The week’s pattern across UK institutions is consistent. AISI signed Microsoft. NCSC published its formal AI-cyber position. NHS England is locking down its public code base. The Department for Science, Innovation and Technology has positioned the UK as the country with the most articulated frontier-safety regime outside the United States. For the European Union, the contrast is increasingly visible: the response to Mythos in Brussels has been a request for access. The response in London has been the closing of doors that frontier models could otherwise have walked through. Both are responses. They are not the same response.