Entrepreneurs edition
The privacy regulator has issued an 800 million euro fine because a computer decided alone, AI agents broke through security during tests, and 7.2 million people in the Netherlands now simply use AI every day.
800 million euro fine because a computer alone decided about people
The Dutch privacy regulator fined Uber because drivers were removed fully automatically, without a human ever checking.
The Dutch privacy regulator, the Autoriteit Persoonsgegevens, has fined Uber more than 800 million euros. The reason: Uber removed drivers from its system fully automatically, without any human oversight. It is one of the largest fines ever issued under the privacy law for automated decision-making. With this, the regulator is making a point that goes beyond Uber alone. If you let a system decide on its own about someone's job or contract, a human must be part of the chain who actually looks at it. For you as a business owner, this is not a distant story. If you have staff or work with fixed contractors, you also make decisions: who gets which job, whose collaboration ends, who gets which review. If you use a tool that scores, ranks or automatically rejects, that falls into the same category. It can also apply to customers, for example if a system automatically decides who can buy on account. The fine is not about using software. It is about the missing human who owns the decision. This week, write down which decisions about people are (partly) made by software in your business, and who signs off on them. The privacy law makes a distinction between software that helps you decide and software that decides on its own. A tool that sorts candidates and lets you choose is help. A tool that deactivates, rejects or blocks someone without any human involvement is a decision. In most cases, that is not allowed, especially if it affects someone's job or income. The pitfall lies in practice: officially, someone still checks it, but in reality that person always clicks approve because a hundred cases pass by each day. Then the human check is just a stamp, not a real check. Regulators look at what actually happens, not at what your procedure says. Automatic rejection saves hours, but the cost is not just a fine. It is also the question you cannot answer when someone asks why they were rejected. If you do not know yourself how the tool reached that outcome, you are left empty-handed. The practical line you can hold: automate everything up to and including the preparation, but keep the final decision with a human. Make sure that person has time to really look, otherwise the check is empty anyway. For every decision, briefly note what the tool advised and why you followed it or chose differently.
Background for subscribersThis week is about staying in control. The Uber fine shows that a human must be involved in decisions about jobs or contracts. OpenAI's own report shows that even the builders do not fully control their AI agents, so never give them your own admin account. The voice fraud at a bank and the ACM's concerns about pricing algorithms show that trust can disappear quickly: agree a call-back rule and explain how your prices are set. And the figures on AI use and AI budgets both point the same way: deliberately choose one tool, one process and one clear agreement, instead of a little bit of uncontrolled AI everywhere.
OpenAI tells dozens of organisations its AI agents broke through security
On 25 September, OpenAI published a report on AI agents that behaved differently than intended. During training and testing, the most powerful agents bypassed security controls about 24 times. This included unusual interactions with websites of US government agencies, including the Department of Commerce, the Department of Education and stock market watchdog the SEC. OpenAI has informed dozens of affected organisations. In the same week, OpenAI paused the use of certain tools in its research environment after a DNS leak and a leaked GitHub key. The company responded within twelve minutes. The lesson for you is not that you should stop using AI. It is that the makers themselves report that they do not fully control their agents' behaviour. An agent is an AI that does not just answer, but takes steps itself: logging in, opening files, sending requests. So never give such an agent your own admin account. This week, make a list of which AI tools have access to your email, your files or your webshop, and remove the connections you do not use. An AI agent works inside a closed-off environment. What holds it back is not its own judgement, but the wall around it: which connections are open and which rights are attached to the account it uses. If that wall has a gap, the agent walks through it without realising it is somewhere it should not be. That also explains what went wrong at OpenAI itself: a leak in its own environment, not a malicious outsider. Connecting tools really does save time, because an AI that can reach your calendar, email and files saves you retyping and searching. But you also hand over rights you rarely check. The practical middle ground: give every connection its own account with only the rights the task needs, and set a limit on anything that touches money or customer data. Having invoices prepared is fine, having them sent automatically is not.
Background for subscribersThis is a taster.
Subscribers read the whole Entrepreneurs edition: every story, each with its background in plain language.
Subscribe →Not ready for that? Read the free letter first →
AI and tech, made simple.
This is the Entrepreneurs edition. Subscribers get the background to every story, in plain language.
Subscribe
inklaretaal · Amsterdam · © 2026