# Data protection, AI governance and cyber security, explained in plain terms. The Assurance Desk is a news provider for the whole data protection, AI governance and cyber security sector. It explains the rules, the standards and the firms in plain terms. ## Latest - [Police and fire IT systems must become much more secure, HMICFRS says](https://theassurancedesk.com/news/hmicfrs-police-fire-cyber-security-report-october-2026.md): News, 27 October 2026. The inspectorate found old systems, gaps in supplier checks and backups, and leaders who do not treat cyber security as an everyday decision. - [ISC2 publishes the outline of its new AI security certification exam](https://theassurancedesk.com/news/isc2-ai-security-certification-pilot-exam-2026.md): News, 27 October 2026. People who secure AI systems, and the employers who hire them, can now see what the new credential will test. - [Oracle says AI helps it find about 3,000 flaws a quarter](https://theassurancedesk.com/news/oracle-ai-found-vulnerabilities-patching-october-2026.md): News, 27 October 2026. More flaws found faster means more patches, more often, for every organisation that runs Oracle software. - [Teams external chat abused to pose as IT support, Arctic Wolf finds](https://theassurancedesk.com/news/teams-external-chat-attacks-arctic-wolf-october-2026.md): News, 27 October 2026. A default Teams setting lets people outside your organisation message your staff, and attackers use it to pose as the help desk. - [University of Copenhagen data breach: details of 525,000 people accessed](https://theassurancedesk.com/news/university-of-copenhagen-data-breach-october-2026.md): News, 27 October 2026. Names, identity numbers and contact details sat in a test system that hackers reached, and the full extent is not yet known. [All news](https://theassurancedesk.com/news.md) ## Dates ahead - 20 November 2026, UK: [ICO call for evidence on agentic AI: Views close at the end of the day](https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence/) - 2 December 2026, EU: [EU AI Act: New bans apply. Content tools already on the market must meet the marking duty](https://theassurancedesk.com/guides/eu-ai-act-timeline.md) - 2 August 2027, EU: [EU AI Act: General-purpose AI models on the market before 2 August 2025 must comply. National AI sandboxes are due](https://theassurancedesk.com/guides/eu-ai-act-timeline.md) - 2 December 2027, EU: [EU AI Act: The high-risk rules apply to AI listed in Annex III](https://theassurancedesk.com/guides/eu-ai-act-timeline.md) ## Our research - [Is Cyber Essentials worth it? What the evidence shows](https://theassurancedesk.com/news/cyber-essentials-research.md): 19 October 2026. 38 of 41 customer reviews we read mentioned guidance. - [Outsourced DPO services: what does the monthly fee buy?](https://theassurancedesk.com/news/outsourced-dpo-research.md): 19 October 2026. 25 outsourced DPO providers in our review. - [Does your AI policy answer everyday staff questions?](https://theassurancedesk.com/news/workplace-ai-policy-research.md): 19 October 2026. 8 of 16 policy sets gave staff a clear way to report a mistake or concern. ## [Data protection](https://theassurancedesk.com/data-protection.md) - [Capcom data breach: CAPCOM ID email addresses accessed](https://theassurancedesk.com/news/capcom-data-breach-october-2026.md): News, 23 October 2026. Capcom says no card details were taken, but anyone with a CAPCOM ID should watch for fake emails in Capcom's name. - [What is the DSPT, and does your organisation have to complete it?](https://theassurancedesk.com/guides/dspt-data-security-and-protection-toolkit.md): Guide, 23 October 2026. If your care home, GP practice or clinic has access to NHS patient data, this yearly check is how you show you keep it safe. - [Most people in Kroll's breach cases were hit through a third party](https://theassurancedesk.com/news/kroll-third-party-data-breach-victims-2026.md): News, 23 October 2026. A breach at one supplier can reach the customers of many firms, so the contract and the plan matter before anything goes wrong. ## [AI governance](https://theassurancedesk.com/ai-governance.md) - [Do UK firms have to label AI in their adverts?](https://theassurancedesk.com/guides/do-you-have-to-label-ai-in-adverts.md): Guide, 27 October 2026. The UK and the EU answer this differently, so where people see your advert changes what you must do. - [Should staff use ChatGPT with memory switched on?](https://theassurancedesk.com/guides/chatgpt-memory-at-work.md): Guide, 21 October 2026. Memory can make ChatGPT more useful at work, and it also keeps details about people, so it deserves a decision of its own. - [Which websites did AI cite on AI governance?](https://theassurancedesk.com/news/ai-answers-ai-governance-sources-october-2026.md): Research, 13 October 2026. Our October snapshot shows which websites appeared in answers to selected UK questions about AI governance. ## [Cyber security](https://theassurancedesk.com/cyber-security.md) - [What is DEFCON 658, and what does it ask of MOD suppliers?](https://theassurancedesk.com/guides/what-is-defcon-658.md): Guide, 27 October 2026. If an MOD contract or subcontract carries DEFCON 658, your firm has cyber security steps to take, and they come round each year. - [AI phishing as a service: Abnormal AI finds Athena StealthRoute](https://theassurancedesk.com/news/athena-stealthroute-ai-phishing-as-a-service.md): News, 23 October 2026. A kit that writes phishing emails with AI and shows scanners a harmless page is a reminder that defences cannot rest on staff alone. - [ConnectWise breach: Microsoft says Storm-0940 used AI agents](https://theassurancedesk.com/news/connectwise-breach-storm-0940-microsoft-365.md): News, 23 October 2026. Firms whose IT provider used ConnectWise's cloud backup service should check their Microsoft cloud accounts for changes the attacker may have left behind. ## Expert views > We spend a lot of time asking what AI might do to us. We spend almost none asking what can be done to AI. > Alan Woodward on LinkedIn, AI Security Risks: Prompt Injection and LLM Trust, Alan W. posted on the topic - [Expert views: when attackers hijack AI models and agents](https://theassurancedesk.com/news/expert-views-attacks-on-ai-agents-october-2026.md): Expert views, 23 October 2026. Experts and a new Symantec report point the same way: protect the AI itself, and keep the risk in proportion. ## Tools and templates - [Can staff use your AI policy?](https://theassurancedesk.com/resources/workplace-ai-policy-worksheet.md): Work through one real task, find the answers and agree what happens next. - [Customer security questionnaire: template and example answers](https://theassurancedesk.com/resources/customer-security-questionnaire.md): Use a blank questionnaire and worked examples to prepare your next customer response. ## Providers We score every provider in the directory on the same six questions, using public sources. [See the providers](https://theassurancedesk.com/advisers.md) [All guides](https://theassurancedesk.com/guides.md) ## Sources - ICO, Agentic AI call for evidence: https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence/ (checked 21 October 2026) - EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727 (checked 2 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.