A resignation. A warning. A media story. A rapid political response. 

Within hours, a technical concern about the direction of artificial intelligence had become part of a much larger public debate about regulation, corporate responsibility and the future of the technology. 

That is what makes the recent Jacob Coxon affair worth examining. 

Not because it proves that a hidden operation was behind the story. The public evidence does not establish that. Nor does it prove that every claim made about the networks surrounding Coxon is accurate. 

It is interesting for a more practical reason: 

It shows how quickly an AI-related signal can travel from technology into media, politics, regulation and commercial risk. 

For organisations using AI, that movement matters. 

The signal 

On 9 September 2026, Jacob Coxon announced that he was resigning from Anthropic. He said he had spent the previous three years working in pre-training research at both Anthropic and OpenAI. 

His explanation was unusually direct: 

“Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives.” 

Coxon argued that the leading AI laboratories were engaged in a race towards increasingly capable systems without sufficient confidence that those systems could ultimately be controlled. His warning was subsequently reported by major technology and mainstream media organisations, and rapidly entered political discussion in Washington DC. 

The story was no longer simply about an employee leaving an AI company. 

It had become a political signal. 

That transformation is the important part. 

A technical claim became a public controversy. The controversy became a regulatory conversation. The regulatory conversation began to affect how governments, companies and the wider public understood the direction of AI development. 

This is how risk often moves. 

It rarely remains inside the function where it begins. 

The anomaly 

One detail attracted particular attention: reporting about Coxon’s resignation appeared shortly before Coxon’s own public announcement. 

The anomaly is the sequence. Normally, something goes viral first and only later attracts mainstream media coverage. Here, it was the opposite: a Wall Street Journal interview was published, and just 18 minutes later a tweet about it went viral. How was it possible for a 6 month old account that was posting for the first time? We still don’t know. 

Coxon’s warning did not enter an empty information environment. 

It arrived in the middle of an established debate involving: 

• frontier AI laboratories; 

• AI safety researchers; 

• policymakers; 

• technology journalists; 

• civil-society organisations; 

• investors and philanthropic funders; 

• campaign and political-technology networks; and 

• regulators considering how existing rules should apply to new systems. 

The same statement can have very different consequences depending on the network into which it enters. 

A technical concern discussed among researchers may remain a specialist issue. 

The same concern, once reported by a major publication, amplified by influential figures and taken up by politicians, can become evidence in a wider policy argument. 

The message has not necessarily changed. 

Its position in the network has changed. 

This is why network analysis is often very useful 

Instead of asking only:  Who was behind this?, it is more useful to ask: 

• Who was already positioned to recognise the signal? 

• Which relationships allowed it to spread? 

• Which institutions had an interest in the issue? 

• Which media channels were already covering related developments? 

• Which policymakers were looking for evidence that intervention was necessary? 

• Which organisations could translate a technical warning into a political or regulatory narrative? 

These questions do not assume wrongdoing. 

They identify the conditions under which a signal can become consequential. 

Regulation is not static 

The commercial lesson is not that every organisation should investigate the personal and institutional networks surrounding every AI story. 

The lesson is that AI risk can change faster than many governance structures can respond. 

Regulation is often treated as a finished object: 

What does the law require today? 

That question is necessary, but increasingly insufficient. 

In the United Kingdom, the Government’s approach to AI regulation is principles-based. It asks existing regulators to interpret and apply principles such as safety, security and robustness; transparency and explainability; fairness; accountability and governance. The Government’s guidance also recognises that regulators will need to develop tools, guidance and approaches over time as the technology and its applications change. 

This is not a single, fully specified AI rulebook that can simply be read once and filed away. 

It is a developing regulatory environment. 

The practical consequences may emerge through: 

• legislation; 

• regulator guidance; 

• enforcement priorities; 

• technical standards; 

• sector-specific expectations; 

• contractual requirements; 

• procurement practices; 

• litigation; 

• political pressure; and 

• public reactions to high-profile incidents. 

The European Union’s AI Act illustrates the same point from a different direction. 

The Act is being implemented progressively. From 2 August 2026, the AI Office and national authorities began enforcing certain provisions, including rules relating to prohibited practices, general-purpose AI models and transparency. Other obligations apply later, including rules for certain high-risk systems from 2 December 2027 and high-risk AI embedded in regulated products from 2 August 2028. 

For an organisation operating in or dealing with the EU, the relevant question is therefore not simply whether the AI Act exists, it is: Which obligations apply to our systems now, which are approaching, and which implementation developments could alter our position? and this is not only a legal question, it is an intelligence question. 

Three layers of exposure 

Organisations should distinguish between at least three layers of AI-related exposure. 

1. Current exposure 

What applies to the organisation now? 

This may include: 

• existing legal and regulatory obligations; 

• data protection requirements; 

• sector rules; 

• contractual commitments; 

• internal governance requirements; 

• supplier terms; 

• existing AI use cases; and 

• systems already embedded in operational workflows. 

2. Emerging exposure 

What is developing around the organisation? 

This may include: 

• proposed legislation; 

• regulatory guidance; 

• enforcement signals; 

• technical standards; 

• sector-specific interpretations; 

• supplier changes; 

• emerging case law; 

• political developments; and 

• public expectations concerning responsible AI use. 

3. Strategic exposure 

What could materially change the organisation’s position? 

This might include: 

• a new AI capability; 

• a major incident involving a supplier or model; 

• a change in regulatory interpretation; 

• political pressure following a public controversy; 

• an unexpected use of AI within the organisation; 

• a new dependency on a third-party platform; or 

• a change in the assumptions underlying an existing AI deployment. 

These layers should not be collapsed. 

A rule that is legally binding today is not the same as a proposal. A regulatory concern is not the same as a confirmed enforcement position. A plausible future risk is not the same as an established obligation. 

But all three may be relevant to a responsible business decision. 

The mistake is not considering uncertainty, but treating uncertainty as if it were irrelevant until it becomes a formal requirement. 

The risk moves 

Imagine an organisation deploying an AI tool today. 

The initial assessment might conclude that the system presents limited regulatory exposure. Perhaps it is being used for internal research, drafting or customer-support assistance. The organisation has a policy, the supplier has provided assurances and the relevant teams believe the risks are manageable. 

Six months later, the technology may be broadly similar. 

The risk environment may not be. During that period: 

• a regulator may publish new guidance; 

• an industry incident may change expectations; 

• a supplier may alter its terms; 

• a new standard may become commercially important; 

• a use case may expand beyond its original purpose; 

• political attention may increase; 

• a customer may request evidence of AI governance; or 

• a deployment that was considered low-risk may begin affecting people, decisions or critical processes. 

The underlying model may not have changed., but the organisation’s exposure has changed because the environment around it has changed. That is why AI governance should not be reduced to a one-off compliance exercise, it requires a view of the landscape. 

The organisational AI risk landscape 

For most businesses, AI risk is not a single category. It is a set of connected exposures. 

Regulatory risk: Which laws, principles, guidance and enforcement priorities apply? 

Technology risk: What systems are being used, what can they do and how might they fail? 

Legal risk: What contractual, intellectual-property, privacy, employment or liability issues arise? 

Operational risk: What workflows or decisions depend on AI, and what happens if the system is wrong, unavailable or manipulated? 

Third-party risk: Which vendors, models, APIs and platforms create dependencies? 

Reputational risk: How would customers, employees, regulators or the public react if the deployment became controversial? 

External risk: Which developments in politics, regulation, technology, markets or public opinion could change the organisation’s position? 

These risks interact. 

A supplier change can create a contractual problem. A contractual problem can expose a governance gap. A governance gap can become a reputational issue. A public controversy can attract political attention. Political attention can accelerate regulatory scrutiny. The risk moves across boundaries and it creates a visibility problem. An organisation may have a legal review, an IT inventory, a procurement process and an AI policy, while still lacking a coherent picture of how those elements connect. 

Visibility comes before control 

Most organisations want to begin with the question:  How do we govern AI?  but it should be: Where is our AI exposure? 

Before deciding what to regulate, remediate, accept or monitor, an organisation needs to understand: 

• where AI is being used; 

• who owns each use case; 

• which models and suppliers are involved; 

• what information is processed; 

• what decisions or workflows depend on the system; 

• which legal and contractual obligations apply; 

• here existing controls are mature; 

• where governance is informal; and 

• which external developments could materially change the risk profile. 

Without that map, governance becomes reactive. The organisation discovers the risk when something happens: a supplier changes its terms, an employee uses an unapproved tool, a customer asks an uncomfortable question or a regulator focuses attention on a previously overlooked use case. 

The Coxon affair demonstrates the same principle at a different level. The interesting issue is not only the resignation. It is the system around the resignation: the actors, relationships, incentives, information channels, institutional interests and narratives through which a signal travelled and organisations face their own version of that problem. 

You cannot manage exposure you have not mapped. 

From compliance to risk intelligence 

This does not mean that organisations need to predict the future, because they cannot know precisely which technology, regulatory development or political event will become decisive. The objective is more practical: 

• establish what is known; 

• separate fact from interpretation; 

• identify where uncertainty exists; 

• monitor the developments most relevant to the organisation; 

• assess plausible changes in exposure; and 

• prioritise action before a manageable issue becomes a crisis. 

That is the gap between static compliance and regulatory intelligence. 

Static compliance asks: Are we meeting the requirement?  Risk intelligence asks: What is our position, where is the environment moving and what should we do next? While both questions matter, the second becomes increasingly important when the technology, regulation and public debate are all changing at the same time. 

The Meriol approach 

This is the problem Meriol Intelligence is designed to address. 

An AI governance policy may be necessary. A compliance review may be necessary. A technical assessment may be necessary. 

But none of these necessarily provides a complete view of an organisation’s AI risk landscape. 

Meriol’s AI Risk Landscape Assessment is designed to help organisations understand: 

1. Current exposure — where AI is being used, which obligations apply and where governance or control gaps may exist. 

2. Emerging exposure — which regulatory, political, technological, supplier and external developments could affect the organisation. 

3. Strategic position — which risks deserve attention first and what actions would improve the organisation’s ability to respond. 

The purpose is not to produce another generic checklist. 

It is to establish a clearer answer to four practical questions: 

The Jacob Coxon affair took less than a day to move from an employee resignation to a major political story, one that could ultimately accelerate calls for tighter regulation and greater control of emerging technologies, not only of frontier AI models, but of open-source AI and the broader artificial intelligence ecosystem as a whole. 

Your organisation may not receive a warning that arrives so clearly. 

The signal may appear first as an unexpected supplier change, an internal workaround, a customer complaint, a regulator’s speech, a new standard or a controversial use of AI elsewhere in your sector. 

The question is whether you will recognise its significance early enough. 

You do not need to predict the future. You need enough visibility to prepare for it. 

Assess your AI risk landscape