Every December we sit down with clients to ask the same two questions: what actually changed this year, and what does it commit us to next year? This time the first list was long enough to publish. 2025 was the year AI governance stopped being a discussion topic and started being a set of dated obligations, signed affirmations, and documented incidents.
Here's our field guide – with receipts.
The year in eight datapointsLink to this section
January – capability went feral. DeepSeek's R1 matched frontier reasoning at open-weights prices, topped the app charts inside a week, leaked a database, and collected government bans – Australia's included – inside a fortnight. The lesson stuck: your AI surface is set by app stores, not procurement.
February – training became law. The EU AI Act's Article 4 made AI literacy a legal obligation for providers and deployers touching the EU market. First time a major regulator wrote down what we've argued for years: untrained operators are themselves a risk.
March–April – AI got hands. Reasoning models went mainstream, and OpenAI's adoption of the Model Context Protocol turned the chat box into a connected operator with access to files, tickets, and tools. Prompt injection graduated from party trick to enterprise threat model.
May – the labs blinked first. Anthropic shipped Claude Opus 4 under ASL-3 – a frontier lab saying, in public, this model needs stronger safeguards. Safety frameworks became procurement artefacts.
August – regulation and whiplash, same month. The AI Act's GPAI obligations went live, and GPT-5 launched by retiring beloved models overnight, teaching everyone the difference between recipe training and judgement training at planetary scale.
October – frontier became commodity. Haiku 4.5 delivered May's state-of-the-art at a third of the price, and the agent era got its flagship models. Rationing-based governance quietly expired.
November – the teeth, in one month. CMMC clauses entered DoD contracts with executive affirmations attached. Days later, Anthropic documented a state-sponsored campaign in which an AI agent ran 80–90% of a cyber-espionage operation. Obligation and threat, same news cycle.
Late November – the curve, summarised. Claude Opus 4.5 became the first model past 80% on SWE-bench Verified – at roughly a third of its predecessor's price. Capability up, cost down, six months apart. That one datapoint is the whole year in miniature.
Three themes under the noiseLink to this section
1. Training turned into evidence. Article 4 wants records. CMMC's AT family wants records. ISO 42001 – which went from curiosity to serious certification pipeline this year – wants records. Insurers are asking. The common thread isn't "run awareness sessions"; it's prove who was trained, on what content, on which version, when. Training programmes that can't answer that are compliance theatre with a projector.
2. AI became an actor, not a tool. Connected assistants, computer-use agents, an espionage campaign with an AI operator. The governing question shifted from "what may people paste?" to "what may software do, who authorised it, and who answers for it?" Identity, access, and accountability frameworks all inherit that question in 2026.
3. Change outran policy cycles. DeepSeek fortnight. GPT-5 week. Six-month commodity curves. Annual policy reviews and yearly training now govern an environment that turns over quarterly. Cadence, not content, is where most programmes are failing.
What 2026 commits you toLink to this section
The diary already has entries. August: the AI Act's high-risk requirements and full enforcement powers arrive – recruitment, credit, and essential-services AI carry real homework, and as of today that deadline stands. November: CMMC Phase 2 is expected to bring third-party certification into new DoD awards, and the assessor queue will not care about anyone's excuses. All year: agents move from early adopters into the default toolbars, and your acceptable-use policy written for chatbots will read like a policy about fax machines.
Our advice hasn't changed all year, so we'll compress it: govern by data class, not product name. Train judgement, not menus. Give agents the service-account treatment. And make every control produce its own records as it runs – because 2025's clearest message is that sooner or later, someone official asks you to prove it.
A small note from our workshopLink to this section
Longtime readers know we end the year with a hint of what we're building. This one's bigger than usual: for two years, every engagement has ended with the same client question – how do we keep this alive between courses, and how do we hand the evidence to whoever asks? We've stopped answering with spreadsheets and started building the answer properly. More in the new year. It's the most excited we've been about anything since we started this company.
Rest well over the break. 2026 will not be slower.