US cops are hiding their spy-tech use to dodge scrutiny. EU operators: your vendors may be doing the same thing.
elcome to issue twenty. This week the most important story for EU AI operators came, again, from the United States. Law enforcement agencies across the country are actively concealing their use of facial recognition, licence plate readers, and cell-site simulators to avoid public accountability, and the EFF has the receipts. We also dig into a revealing FOIA dump about Medicare's AI decision-making system, which tells a cautionary tale about what happens when high-stakes automation runs without meaningful oversight.
Let’s go.
yours, Flux
Flux Weekly is a 6-minute briefing for people who have to actually make AI work in Europe. Sole traders to enterprise, one issue every Friday morning.
- New We have added a vendor transparency checklist to the Flux compliance toolkit, specifically covering how to assess whether a supplier has a documented history of opacity in other jurisdictions.
- Updated The Flux high-risk AI system tracker has been updated to reflect the 440-day countdown to the 2 December 2027 application date for high-risk provisions.
- ICYMI Last week's issue covered the US DoD's illegal retaliation against Anthropic for refusing mass-surveillance work, which remains essential background for this week's vendor-trust theme.
US Police Are Deliberately Hiding Their Spy-Tech Deployments, and Your AI Vendors Probably Know the Playbook
The concealment is the point. The EFF's latest investigation documents a systematic pattern: law enforcement agencies across the US are structuring surveillance-tech contracts, budget lines, and procurement records specifically to avoid triggering public-records laws and community oversight. Tools involved include automated licence plate readers, cell-site simulators, and facial recognition systems. The strategy is not accidental. It is policy.
Why EU operators should care deeply. Many of the vendors supplying these concealed surveillance stacks also sell into European markets. If a supplier has a documented habit of helping clients obscure AI deployments from regulators and the public in one jurisdiction, your AI Act due-diligence obligation to assess that supplier's transparency practices is not a box-tick exercise. It is a genuine risk question. The AI Act's requirements around transparency and traceability exist precisely because this behaviour is real.
The Medicare AI story adds a second data point. Separately, the EFF released roughly 1,000 pages of records about the US Medicare WISeR AI model, which automated prior-authorisation decisions for medical services. The documents, obtained through litigation, reveal significant problems with how the system was deployed and overseen. For EU operators building or procuring AI in high-stakes contexts, this is a live example of what inadequate human oversight actually produces.
The pattern across both stories is identical. Opacity in deployment, resistance to scrutiny, and systems making consequential decisions without accountability. The AI Act's requirements for high-risk systems are not theoretical safeguards against hypothetical bad actors. They are responses to exactly these documented behaviours. If your vendor or your own system cannot produce a clear audit trail this week, that is your action item.
- ✓Digital sovereignty debate intensifies: European officials are invoking the concept across cloud, AI, and semiconductor policy, with the EFF documenting both its promise and its risks for civil liberties.
- ✓AI Act countdown ticking: 440 days remain until high-risk AI provisions apply on 2 December 2027, meaning compliance build-out needs to be underway now, not next year.
- ✓Transparency obligations look increasingly prescient this week given documented vendor opacity in the US market, which EU supply chains are directly exposed to.
- ~US law enforcement agencies are systematically structuring contracts to evade public-records scrutiny on surveillance AI, including facial recognition and licence plate readers, per new EFF investigation.
- 1EFF's Street-Level Surveillance HubVendor research
A detailed, regularly updated database of surveillance technologies in use by law enforcement across the US, including which vendors supply them.
Why we like it. If you are procuring any tool from a vendor that also sells into law enforcement, this tells you what their transparency record looks like under pressure.
- 2EU AI Act High-Risk System Classification Guide (EU AI Office)Official guidance
The official guidance document explaining how to determine whether your AI system falls into a high-risk category under Annex III of the AI Act.
Why we like it. With 440 days left, knowing your classification tier is the single most important first step for any operator that has not done it yet.
- 3AlgorithmWatch Automating Society Report
The Hiding Is the Product
By John Ferguson
This week reminded me why I started this newsletter. The EFF story about police hiding their surveillance tech is not a niche civil-liberties concern. It is a supply-chain story. The same vendors structuring contracts to avoid scrutiny in Sacramento or Atlanta are bidding on European public-sector contracts right now.
The Medicare AI story hit differently. Roughly 1,000 pages of records, released only because someone sued for them, revealing an AI system making healthcare decisions with inadequate oversight. I keep thinking: how many similar systems are running quietly inside European institutions right now, with no EFF and no FOIA equivalent to surface them?
The AI Act's transparency and human-oversight requirements are not bureaucratic pedantry. They are the structural answer to exactly this behaviour. The question for EU operators is whether you are building your compliance posture around the spirit of those requirements, or just the letter.
My honest advice this week: pick one vendor you rely on and spend thirty minutes genuinely testing their transparency. Ask for their law enforcement data policy. Ask what they would do if a client asked them to conceal a deployment. The answer will tell you more than any certification document.
John Ferguson · Founder, Agentic Fluxus
Short answer.Ask your vendor directly for their transparency report, their law enforcement data-request policy, and any documented instances where they declined a client request on ethics grounds. If they cannot produce all three within a reasonable time, treat that as a red flag. Under the AI Act, your due diligence on high-risk system providers is your responsibility, not theirs.
When you procure an AI tool, how do you assess the vendor's transparency track record?
EFF's investigation found that some US law enforcement agencies are burying surveillance-tech contracts inside unrelated budget categories to prevent them appearing in public procurement searches. The technology is running. The paperwork just says it isn't.
Amazon launched a Ring camera feature called 'Throw Away the Key Encryption', implying footage becomes inaccessible. The EFF's analysis found it adds a procedural speed bump at best and does not materially limit Amazon's own access to content. The name is doing considerably more privacy work than the feature.