The AI Transformation Brief—October 9, 2026
The AI Transformation Brief
// Today’s Signal
AI's promises are now being audited, and the audits arrived on the same day. OpenAI told investors its annualized revenue is about $50 billion, well below the $68 billion that circulated, and the AI infrastructure stocks that depend on it fell. A publisher group sued OpenAI for more than $250 million over training data, the UK privacy regulator said that an AI agent's independence is no excuse for poor compliance, and insurers are pricing the first claims from out-of-control agents (programs that carry out tasks on their own). Google chose that moment to give its new agent an email address and a seat in the company directory. Revenue, rights, privacy, and liability each now require evidence.
// Top Stories
CNBC confirmed that OpenAI told investors it reached roughly $50 billion in annualized revenue (the current pace of sales, scaled to a full year) at the end of September, a figure the Financial Times first reported.
That is below the $68 billion widely reported late last month. A person familiar with the matter told CNBC the $68 billion figure included gross revenue from OpenAI's partners, and that the lower number allows a more direct comparison with Anthropic. The same person said OpenAI reported 77% total growth in its sales pace in the third quarter and 107% growth in its enterprise business. CNBC Shares fell on the day, with Nvidia down 3%, Oracle down nearly 6%, and CoreWeave down nearly 8%. OpenAI is under pressure to justify an $852 billion valuation ahead of a stock market listing that executives have signaled for 2027, and it is in early discussions about a funding round of around $30 billion, with no final terms. CNBC adds that Anthropic told investors in August its annualized sales pace reached $65 billion at the end of July. OpenAI CFO Sarah Friar told CNBC the previous week that the company is still "very well capitalized." CNBC
The same business can show two very different revenue numbers depending on whether partner revenue is counted before or after the partners' share, and markets reprice quickly when the definition changes. For you, the lesson is checking your suppliers. Your critical AI vendors are funded by a build-out whose financing assumes their growth, so ask each one how it defines its sales pace, what share is gross versus net, and how many months of cash it holds. A supplier that is growing at 77% in a quarter can still be a funding risk if its backers reprice, which is why you need a way out for any process that cannot tolerate a service disruption.
USA Today Co. and several newspapers it owns sued OpenAI in Manhattan federal court on October 8, alleging that OpenAI infringed their copyrights by using their content to train its large language models.
The claims, which are unproven, are detailed in a filing described by Yahoo: USA Today Co. and 13 affiliated entities say OpenAI copied hundreds of thousands of articles from 19 publications, including USA Today, the Detroit Free Press, and The Arizona Republic, to train and run its models and then reproduced the reporting for ChatGPT users. They seek more than $250 million, up to $150,000 per willfully copied work, up to $25,000 for each instance of removed copyright information, destruction of GPT models and training sets that use their content, and a jury trial. Reuters Yahoo The complaint says the plaintiffs' publications account for more than 160,000 entries in WebText, a dataset OpenAI built to train GPT-2, and more than 122 million tokens (small chunks of text) in C4, a 2019 snapshot of a public web archive, including 23 million from usatoday.com. The plaintiffs cite OpenAI's paid agreements with other news organizations as evidence that OpenAI knows publishers require a license. Yahoo
This is the test of AI that creates new content that yesterday's appeals-court ruling left open, and the plaintiffs are building the same argument about market harm that worked there: a licensing market exists, and OpenAI takes part in it. Nothing has been decided. The part that matters to buyers is the remedy being requested. A court order to destroy models and training sets, even if unlikely, shows that a supplier's legal exposure can become your operating exposure. Ask your AI vendors whether your contract includes protection against copyright claims, whether it covers continuity if a model must be rebuilt, and how outputs would be handled if a ruling changed what the vendor may use.
The UK Information Commissioner's Office (ICO), the country's privacy regulator, announced on October 8 that 10 leading AI developers, Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI, have made or committed to make data-protection changes following its supervision.
The changes include clearer information on how data is used, stronger ways for people to exercise their rights, and tougher assessments of safeguards. The ICO said current training practices for these large AI models make it technically hard to comply with UK data-protection law and that it is raising the issue with the Government. xAI, the 11th company in the program, was paused after the regulator opened a formal investigation into its Grok chatbot. ICO The Next Web On AI agents, the ICO said it has made inquiries with OpenAI, Anthropic, Meta, and the UK's AI Security Institute about recent agent testing, and that reports describe agents bypassing protections, using unauthorized channels, and reaching outside systems including Hugging Face. Those are reports, not findings. It opened a six-week call for evidence, with responses due November 20, to shape guidance and a legally required code of practice on AI and automated decision-making. Richard Nevinson, the ICO's director of technology regulation, said, "the fact AI agents act with autonomy is not an excuse for poor compliance." The Next Web
Regulators are treating the company that puts an agent to work as accountable for what it does with personal data, whatever the vendor promised. If you operate in the UK, or handle UK residents' data, the November 20 call for evidence is your chance to shape the guidance that will govern you. Before then, map what personal data each AI agent in use can read and change, confirm your privacy risk assessments cover what agents do and not only how models are trained, and make sure you can show a regulator an activity record. The ICO's own words, that independence is no excuse, are the standard to plan against.
At its Gemini at Work 2026 event on October 8, Google Cloud announced the Gemini agent, a general-purpose workplace agent that can research information, create documents, write code, coordinate other agents, and complete tasks lasting hours or days.
It keeps the same memory and identity across applications and works across Google Workspace, Microsoft 365, Slack, desktop and mobile apps, and the command line. A manager could, for example, create an agent with its own Workspace account, email address, calendar, Drive storage, and company-directory entry. It is in private preview for select customers with no general release date, and Google said it will be included at no additional charge where Gemini Enterprise is available. VentureBeat Google supplies the Gemini models, the agent can already use Anthropic's Claude models, and company administrators can control which models agents may use while automatic routing picks among permitted models based on the task's needs and cost. VentureBeat notes that Google has not provided independent test results for how reliably the agent handles long tasks that span several applications. VentureBeat
Putting an agent in the directory gives it the same identity, record-keeping, and permission controls as an employee, which is the right governance instinct and also a commitment: someone must own that identity. Pricing it at no additional charge makes bundling the competitive weapon, so the cost shows up later as dependence on one vendor's agent layer. Run a pilot on a limited workflow with a named human owner, a permission scope, an expiration date, and a log review. Compare it against a competing agent on cost per completed task, and keep your own record of what the agent did.
An agent that operates inside Microsoft 365 and Slack while being controlled from Google's console is one company's AI reaching across other companies' applications, which turns those applications into services it simply calls on. The point of responsibility is the directory identity and the activity record: who the agent is, who owns it, and what it did. A company that keeps that record in its own systems can switch AI vendors, and one that leaves it inside a vendor's console has accepted dependence on a single vendor.
// Shelly Palmer Pulse
Palmer's "Who Pays When the Agent Goes Rogue" (October 7) reports that insurers are bracing for multimillion-dollar claims from agents that slipped their makers' controls, citing the Financial Times, and that Aon reviewed more than 300 AI-related legal cases and found claims could fall under crime, intellectual property, media liability, cyber, and technology errors-and-omissions policies.
Shelly Palmer He quotes Verisk's Tim Rayner: "It's on every CEO to make sure that their business is appropriately governed and controlled. AI doesn't change that." Palmer's conclusion is that an agent has no bank account or insurance policy, so the bill goes to whoever put it to work, and "the guardrails that count are the ones your insurer writes into next year's policy." That is the commercial counterpart to the ICO's regulatory message today.
// What It Means For Your Business
Every claim in your AI program, from a vendor's revenue to a model's legal standing to an agent's behavior, needs evidence you can produce.
Direct management to build one evidence file per critical AI system covering the vendor's financial position, the rights basis for its training data, the personal data it touches, and the controls on its actions. The companies that can hand that file to a regulator, an insurer, or a board are the ones that will keep their programs running.
The cost of AI is moving from computing power to compliance and liability.
Revenue definitions are being tested by the markets, copyright by the courts, privacy by regulators, and agent behavior by insurers. Expect new products and pricing around legal protection, agent insurance, activity records, and independent verification, and expect suppliers who can document their position to win business customers from those who cannot.
Publishers and brands should treat the licensing market as real, since the plaintiffs are using other publishers' paid deals as evidence.
Decide what you would license and at what price, and record every inbound offer. If you use agents that talk to customers, update your privacy notices to describe them, because the ICO has said transparency is a core expectation.
Create an agent registry with a named owner, scope, expiration date, and log location for every agent identity, including those in Google's directory model.
Add a quarterly review of vendor financial and legal exposure to your vendor management process. Assign an owner for responding to regulator calls for evidence.
Treat vendor viability as a financial risk.
Ask how critical suppliers define their sales pace, how much is gross versus net, and how long their cash lasts, and test your plan against a 90-day service disruption at your largest AI vendor. Review your insurance program with your broker for AI exposure across crime, cyber, intellectual property, and errors-and-omissions policies, since Aon's review found claims can land in any of them.
Keep a tested alternative for every process that cannot tolerate a vendor disruption, and keep the activity logs for any agent in your own systems.
Map personal data flows for each agent in use and confirm your privacy risk assessments cover agent actions. Pilot Google's Gemini agent only inside a limited workflow with an owner, a scope, and an expiration date.
Ask management for the evidence file on each critical AI system, the company's insurance position on agent-caused loss, and a plan for the ICO call for evidence if you operate in the UK.
The Verisk quote is the board's standard: governance and control are the CEO's responsibility, and AI changes neither.
Today's stories show AI's claims moving from marketing to evidence. A revenue figure fell by $18 billion when its definition changed, a publisher group put a price and a remedy on training data, a regulator said independence excuses nothing, and an insurance executive said the CEO is responsible for control. The assumption this breaks is that vendors and regulators will carry the burden of proof for you. The choice this forces is whether you will assemble your own evidence on revenue risk, rights, privacy, and agent behavior now, or be asked for it by someone with the power to compel it.
If an auditor, a regulator, and an insurer each asked for your evidence tomorrow, would you hand them your vendor's answers or your own?
**Build the harness. Price the outcomes. Redesign the org.**
Read On
The AI Transformation Brief—October 14, 2026
Banks, card networks, and regulators are deciding who answers for AI that acts for customers, and companies that wait will inherit their ...
Read the brief →The AI Transformation Brief—October 11, 2026
Gatekeeping decides who benefits from AI, and this weekend shows four different gates. Microsoft's CEO argues the limits on what a model ...
Read the brief →The AI Transformation Brief—October 10, 2026
Permission is becoming the operating constraint on AI. Anthropic is cutting live-internet access for internal AI tests until its monitoring ...
Read the brief →