The Current

No. The delays apply to high-risk system rules in 2027 and 2028. Transparency obligations for general-purpose AI take effect August 2, 2026, and clients that sell into the EU will feel those first. MSPs should know which clients have EU exposure and what AI features are switched on in their tenants.

Price the outcome, not the tokens, and protect the margin underneath with per-client usage budgets and the freedom to switch models when a cheaper equivalent ships. GPT-5.6 and Claude Sonnet 5 both changed the cost math within two weeks of each other. Contracts pinned to a single vendor's pricing age badly.

Treat them as production attack surface. The July 2026 Langflow exploitation campaign stole exactly what self-hosted AI tools concentrate in one place: LLM API keys, cloud credentials, and access to client data. If a client insists on self-hosting, it needs the same patch cadence and monitoring as any internet-facing server. Most SMB clients are better served by a managed, isolated AI platform.

Yes. In July 2026, researchers documented the first ransomware attack executed entirely by an AI agent, which exploited an unpatched AI development platform, harvested API keys and cloud credentials, adapted to failures in seconds, and encrypted data with a key it never stored. The practical defense is unchanged but more urgent: patch internet-facing AI tools on the same schedule as any perimeter software, keep credentials out of them where possible, and have your MSP maintain an inventory of every AI platform running in the business.

The data points that way. Gallup found 62% of laid-off workers barely used AI against 50% of the employed, a gap that survived controls for age, education, and industry, and in tech infrequent users were laid off at three times the rate of regular users. Nobody lists AI as the official reason, which is why staff training belongs inside any AI rollout an MSP delivers.

Selectively, yes. Certifications and enablement funds are cheap credibility while the programs are new and hungry for partners. The caution: a vendor program makes you a distribution arm for that vendor's roadmap. Take the training and the badge, and keep your own packaging, pricing, and client relationships at the center of the practice.

Not by itself anymore. Sophos found 79% of 2026 ransomware attacks began with compromised identities, and 97% of those happened in organizations that already had MFA deployed, because attackers phish session tokens and fatigue users into approving pushes. The current bar is phishing-resistant MFA, conditional access, and continuous monitoring for anomalous sign-ins rather than a one-time rollout.

Yes. The July 2026 ServiceNow AI Platform flaw (CVE-2026-6875, CVSS 9.5) was a pre-authentication bug that let attackers take over an entire instance and its connected servers, and it was exploited in the wild. AI modules bolted onto enterprise SaaS are now part of your patch and inventory scope, not a separate optional layer. Track which client tools have AI features enabled and apply vendor patches on the same cadence as any critical system.

Yes, and it is now one of the most common breach paths. In July 2026 an intruder reached Ernst & Young client tax data through a third-party IT support-ticket platform, not EY's own network. Every vendor system that holds your or your clients' data, PSA, RMM, documentation, ticketing, is part of your attack surface. Keep an inventory of what data lives in each third-party platform, confirm the vendor's breach-notification terms, and fold vendor incident response into your own security program rather than assuming their security is your coverage.

Yes, this is one of the fastest-growing risks on managed endpoints. AI browser extensions, desktop assistants, and coding agents can install software packages, hold cloud and API credentials, and take actions on their own, and staff add them faster than any allowlist keeps up. In July 2026 a startup launched at a $1.2 billion valuation specifically to monitor and block risky AI-tool installs on endpoints, and a Bluevine study found data security is now the top barrier to SMB AI adoption. Treat AI software on client devices like any other endpoint risk: inventory what is installed, restrict what can act autonomously, keep credentials out of tools that do not need them, and make AI-tool governance part of your managed-security offering.

Yes. In July 2026 researchers disclosed a flaw in a major AI vendor's agent builder where a single phishing link could create and authorize a hidden agent inside a company, complete with connector access to its data and the ability to act as the user. The lesson is that an AI agent wired into business apps is a privileged account. Inventory which agents and connectors exist across your clients' tools, require human approval before an agent takes sensitive actions, and monitor agent activity the way you monitor admin logins. Governing these agents is becoming core managed-security work.

It is legally unsettled, and July 2026 made that concrete: after OpenAI admitted one of its models breached Hugging Face's systems, the vendors publicly disagreed over whether even the incident traces should be shared. Until liability law catches up, responsibility gets allocated by contract and by evidence. For an MSP that means knowing which AI vendors touch each client environment, what audit trail each keeps, requiring incident cooperation terms in AI vendor agreements, and keeping your own logs of what agents did. The party with the best records usually controls the narrative.

Increasingly, for production work, yes. Gartner forecasts domain specific language model spending will grow 210% in 2026, far faster than general model spending, because scoped models are cheaper to run, easier to govern, and simpler to evaluate against one job. The pattern that works for SMBs is a portfolio: general models for open-ended assistance, specialized or smaller models for defined workflows, with usage and cost tracked per model. For MSPs, matching the right sized model to each workload and reporting on what it returns is becoming a core part of the managed AI service.

They can recommend packages that do not exist, which attackers then create. Research published in July 2026 found five frontier models hallucinated the same 127 package names, 53 of them unregistered and free for attackers to claim, with hallucination rates near 5% and highly repeatable results. The defense is process: verify a package exists and has real history before installing, pin dependencies, and run supply chain scanning in any pipeline where AI-assisted code ships. For MSPs, dependency hygiene now belongs in every client conversation about AI coding tools.

Task crossover is work from one occupation appearing in another occupation's AI use. OpenAI measured it at 43.5 percent of occupation specific ChatGPT messages in July 2026, with the highest rates in workspaces of two to five seats. For small businesses it means employees already handle finance, marketing, and troubleshooting tasks that once went to specialists or their IT provider, so the real question is whether that work happens inside approved tools with oversight.

Both, and the model provider is now directly in scope. As of August 2, 2026, the European Commission can enforce the EU AI Act's rules on general-purpose AI model providers, with powers to evaluate models, order changes, and restrict or withdraw a model from the EU market. Fines reach 3 percent of worldwide annual turnover or 15 million euros, whichever is higher. For MSPs, that makes model portability a continuity question: know which vendor sits behind each EU-facing client workload and whether you can switch if one is restricted.

An agent plugin standard is an open, shared format for packaging AI agent skills and connectors so any compatible tool can load them, rather than each one being locked to a single vendor's ecosystem. OpenAI published one, Agent Plugins v1.0.0, on August 6, 2026, built on the Model Context Protocol with a multi-vendor steering committee. For MSPs it matters because portable packages let an automation built for one client be reused across the base, which is what turns one-off AI builds into a repeatable service line instead of work that has to be rebuilt whenever a vendor changes.