AI features in many catastrophe stories. The public record is more concrete than the stories: laws with dates, a voluntary framework, and test results with stated caveats. None of it forecasts a 2027 disaster.
What is documented
EU AI Act. It entered into force on 1 August 2024. The Commission's page lists four risk levels. General purpose AI obligations have applied since 2 August 2025, and providers of models that may pose systemic risks must assess and mitigate them. The Act became generally applicable on 2 August 2026. An "AI Omnibus" that entered into force on 27 July 2026 delays high risk obligations to 2 December 2027 for Annex III use cases and 2 August 2028 for embedded products.
NIST. The AI Risk Management Framework 1.0 was released on 26 January 2023 for voluntary use, and a Generative AI Profile followed on 26 July 2024.
UK AI Security Institute. Its Frontier AI Trends Report (18 December 2025) says models complete apprentice level cyber tasks about 50% of the time, up from just over 10% in early 2024, and that it tested the first model completing expert level tasks in 2025. It found universal jailbreaks for "every single system we've tested to date," while biological misuse defences improved. On self replication, two frontier models exceeded 60% on an 11 task subset by summer 2025, though AISI notes these are simplified tasks. It also says: "This report should not be read as a forecast."
Not documented: any credible dated prediction of AI caused catastrophe.
What is affected
Organisations that build or deploy AI, especially in the EU, and teams whose security posture depends on attackers not having automation.
How to check if you're exposed
- List AI features and vendors you use.
- Classify each against the AI Act risk levels.
- Note where an AI agent can take actions with credentials.
What to do now
- Keep an inventory of models and AI services.
- Give agents least privilege and log their actions.
- Patch faster, since AISI results suggest automation helps attackers.
- Track EU obligations that apply to you, with the changed dates.
Why it matters
Faster attackers raise the cost of slow patching and unmanaged credentials, which are old problems. Regulation is moving toward documentation and risk management.
Quick check
Did the AI Act's high risk deadlines change?
Per the Commission page, the AI Omnibus delayed them to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Does AISI forecast catastrophe?
No. Its report says it should not be read as a forecast and notes its tests are controlled proxies.
