California's governor orders AI scrutiny while cops log 'LMAO' as mass-surveillance justification. Your vendors are watching both.
elcome to issue twenty-one. This week the US hands us two stories that, taken together, tell you everything about where AI accountability goes wrong. California's governor has issued an executive order promising a 'thoughtful conversation' about AI harms, while a few hundred miles away police officers are logging 'LOL' and 'LMAO' as their legal justification for trawling data from tens of thousands of surveillance cameras. We dig into both, plus what Siri's new AI permissions tell EU operators about vendor consent hygiene.
Let’s go.
yours, Flux
Flux Weekly is a 6-minute briefing for people who have to actually make AI work in Europe. Sole traders to enterprise, one issue every Friday morning.
- New We have added an audit-log quality checklist to the Flux compliance toolkit, prompted by this week's ALPR story, covering what a defensible human-oversight log actually needs to contain.
- Updated The Flux vendor due-diligence questionnaire now includes a section on AI-feature opt-in defaults, following Apple's iOS 27 Siri AI rollout and its expanded device-permission model.
- ICYMI Last week's issue on US police hiding spy-tech deployments is the essential backstory to this week's ALPR audit-log scandal, and it is in the archive if you missed it.
US Police Are Logging 'LMAO' as Legal Justification for Mass Surveillance Searches Across 82,000 Cameras
The audit trail is the punchline. A single Goshen Police Department officer ran a search across 6,474 automated licence plate reader networks, pulling data from 82,413 cameras, and typed 'idk' into the field where a legal reason is supposed to go. EFF's investigation found officers nationwide logging 'LOL', 'LMAO', and 'Sexy' as their documented justifications for mass surveillance searches. The field exists precisely to create accountability. It has become a joke.
For EU operators, the lesson is about audit-log culture. The EU AI Act requires meaningful human oversight and documented decision-making for high-risk systems. What the Flock ALPR data shows is that an audit field only works if the organisation using it treats it seriously. If your AI vendor or your own team sees logging as a checkbox rather than a genuine record, you have the same problem in miniature. A log full of 'N/A' or copy-pasted boilerplate will not satisfy a national authority inspection.
Does your AI inform a decision that affects a person's job, credit, education, or essential service?
- ✓No new EU AI Act implementing acts or guidelines dropped this week. The 2 December 2027 high-risk deadline remains 433 days away.
- ✓Secure messaging tension flagged by EFF is directly relevant to EU operators using AI-enhanced platforms subject to GDPR and the AI Act simultaneously.
- ✓The TEE (Trusted Execution Environment) debate over AI in encrypted apps will matter for EU health and legal-sector operators using tools like WhatsApp for client communication.
- ~California Governor Newsom issued an executive order on AI, framing it as the start of a 'thoughtful conversation' about harms rather than concrete prohibitions.
- 1EFF's Flock ALPR ReportCase study
EFF's full investigation into how US police are misusing audit fields across Flock's licence plate reader network.
Why we like it. The best real-world case study available for why audit-log culture matters more than audit-log existence.
- 2EU AI Act Article 14 (Human Oversight)Regulation
The actual text setting out what meaningful human oversight of a high-risk AI system must look like.
Why we like it. Read it next to the ALPR story and the gaps in your current logging practice will become obvious.
- 3EFF's iOS 27 Siri Privacy GuidePractical guide
A step-by-step walkthrough of every new AI permission Apple introduced in iOS 27 and how to limit them.
The Joke Is Not Funny When It Is Your Audit Log
By John Ferguson
I have spent a lot of time this week staring at a spreadsheet of 'LMAO' and 'idk' entries from American police officers querying mass surveillance networks. It would be funnier if I did not know that half the AI compliance documentation I see from real businesses looks structurally identical.
The problem is not laziness. It is that most teams build a logging process to satisfy a requirement, not to actually create accountability. The field gets added to the form, someone fills it in with whatever keeps the workflow moving, and six months later you have a log that tells an auditor nothing except that the system was used.
The AI Act's human oversight requirement is not satisfied by a field that exists. It is satisfied by a field that reflects a real human decision. That is a culture problem, not a software problem. And culture problems do not get fixed by buying a better compliance tool.
This week's newsletter is, in a way, a gift from American law enforcement to EU operators. They have shown you exactly what not-oversight looks like at scale, in public, with receipts. Take the lesson before your national authority has to deliver it personally.
John Ferguson · Founder, Agentic Fluxus
Short answer.No, and the ALPR story this week is your cautionary tale. A log full of identical boilerplate signals to an auditor that human oversight is not actually happening. The AI Act requires that oversight is meaningful, which means the log entry should reflect a real review. Rotate responsible reviewers, add a brief note on what was checked, and spot-audit your own logs quarterly before a regulator does it for you.
How would you describe the quality of your team's AI decision logs right now?
A Goshen Police Department officer queried 6,474 ALPR networks covering 82,413 cameras in a single session and typed 'idk' as the legal justification. The field exists to protect civil liberties. It was used as a shrug.
Among the documented justifications EFF found logged in Flock's ALPR system: 'Sexy'. Law enforcement and tech salespeople had promised the audit fields would prevent abuse. They did not.