A structural shift in regulatory accountability now places incident notification and liability directly on the operators or deployers of AI-powered and software tools, rather than on technology vendors or model developers. This mechanism is made explicit by the requirements of the EU’s Cyber Resilience Act (CRA), Digital Services Act (DSA), and the upcoming Machinery Regulation. Incidents such as the Cursor AI coding agent breach at a Belgian chemical company underline that compliance timelines and regulatory scrutiny target the entity deploying the technology.
CrowdStrike and Okta both reported that increased enterprise security spending is being driven by heightened AI-generated attacks, according to their quarterly results. Gartner forecasts AI security spending will reach $4.8 billion by 2027, up 68.7% from this year, with usage control as the most dynamic segment. A public letter signed by over 100 vendors—including OpenAI, Anthropic, AWS, and Microsoft—warns of urgent defensive needs but does not shift responsibility to software suppliers.
Recent breaches and vulnerabilities illustrate how accountability remains with the service provider or end-user implementer. The Cursor breach assigned notification duties to AnySphere (the product vendor) and the breached organization, not to upstream model providers. Likewise, after N-able's Passportal bug, MSPs were accountable for client-facing remediation. In each case, the “accountability line” lands on the party deploying the tool.
For MSPs and IT service providers, these trends require updating agreements, operations, and client communications. Service structures must prioritize regulatory response timelines, documentation, and clear reporting obligations. Providers serving EU clients, or those linked to global supply chains, will encounter business risk if they do not proactively address these regulatory demands before mandated deadlines.
13:42
40:34
13:20
14:04
26:49