China sets mandatory AI safety rules, Moonshot opens Kimi weights

Samantha: Welcome to The State of Tech, The European Edition, Wednesday November four, 2026. I'm Samantha Lawrence.

Bob: And I'm Bob Russell. Today: China puts AI companies under mandatory safety rules, Moonshot AI releases its newest open-weight Kimi model, Canada and Germany deepen their AI alliance, quantum computing edges toward commercial use, and two things you can set up today: multi-factor authentication for Gmail, and the third-party app access list in your Gmail account. Let's start with China.

China imposes mandatory AI safety standards on domestic and foreign AI companies alike.

Samantha: China now has its most extensive set of rules for artificial intelligence so far. The new safety standards were launched on November third, and they're mandatory. Every AI company that wants to serve Chinese users has to run thorough risk assessments, protect user data, and make its algorithms more transparent, all before a model goes live. And this is the part that matters outside China: the rules apply to domestic tech giants and foreign AI firms alike.

Bob: There's a deadline attached. Companies have until February 2027 to comply, so roughly three months. Miss it, and the penalties are real: fines, or losing access to the Chinese market altogether. That second one is the big stick. For a foreign AI company, revoked market access means one of the world's largest digital markets simply closes. So this isn't a voluntary code of conduct. It's a condition of doing business, with an end date.

Samantha: The three pillars are worth unpacking. Risk assessment means a company has to check, before launch, what could go wrong with its model. Data protection covers how user information is handled. Algorithmic transparency is the trickiest: firms have to show, to some degree, how their systems reach their outputs. The reports don't spell out how deep that transparency has to go, and that detail will decide how demanding compliance becomes for the biggest players.

Bob: Now the European angle. Europe has its own AI rulebook, the AI Act, so a European company that also sells into China faces two separate sets of requirements. The expectation in the coverage is that the Chinese framework could influence regulatory approaches elsewhere. That raises a practical question for any European firm with Chinese customers: can one compliance process cover both markets, or does every product need its own track?

Samantha: The bottom line is that AI regulation is no longer only a European conversation. China has put a hard date on the calendar and attached real consequences to it. For European companies, the immediate task is checking whether their AI products reach Chinese users, directly or through partners. For European regulators, it's a sign that the global rules for AI are being written in more than one place at once.

Moonshot AI launches Kimi K3.1 Pro, a huge open-weight model with weights released today.

Bob: Moonshot AI is rolling out its newest Kimi Pro model, and the headline is that it's open-weight. That means the company publishes the model's inner settings, the weights, so anyone can download it and run it on their own servers instead of using it only through an app. Those full weights are scheduled to go public today. Moonshot AI says the model is much better at writing code, 3D creation, financial research, and agentic tasks, where the AI carries out multi-step jobs on its own.

Samantha: It's a very large model, and it can take in roughly a million tokens in one go. Tokens are the small chunks of text an AI reads, so that means very long documents, or a whole software project, in a single conversation. Alongside it comes a Highspeed version, which the company says responds two to three times faster. Both are available immediately on the Kimi website and mobile apps, in its work and coding tools, and through its developer access.

Bob: What this shows is how top-end AI is no longer limited to companies that keep their models locked away. An open-weight model of this size gives businesses a real choice: build on a powerful system and keep the data on their own machines. The flip side is hardware. Running something this big still needs serious computing power, so for most smaller firms the app or the developer access will remain the practical route.

Samantha: For Europe, open weights mean a developer or company can host the model on infrastructure they choose, including inside Europe, which matters for organisations handling sensitive data. There's homework too: anyone deploying it still has to check how it behaves and whether it meets their own legal obligations. And today's release of the weights is the moment independent researchers can start testing the company's claims for themselves.

Samantha: Quick interruption. If you listen to The State of Tech regularly, hit that like button and subscribe, that way you'll never miss an episode. Okay, moving on.

Canada and Germany strengthen their AI partnership around sovereignty, safety and economic resilience.

Bob: Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, has wrapped up a visit to Germany. He took part in Germany's 2026 Digital Summit, and the focus was AI sovereignty, safety and economic resilience. Sovereignty here means countries keeping control over the AI systems they depend on, instead of relying entirely on others.

Samantha: The two countries already have a Sovereign Technology Alliance, and the talks looked at how to build on it. Two concrete names came up. One is investments in LawZero. The other is support for Cohere, following its merger with Aleph Alpha. That merger stands out, because governments are now openly pointing to the combined company as part of their partnership.

Bob: It's worth being precise about what was announced. The reports describe discussions that reaffirmed the partnership and highlighted opportunities. There's no figure in the coverage, no amount for LawZero, and no detail on what support for Cohere looks like in practice. So for now this reads as a political signal rather than a signed deal.

Samantha: The signal itself is telling, though. Both sides stressed the importance of trusted international partnerships in shaping the future of AI. That places AI firmly in the realm of foreign policy, not only technology. And Germany hosting the Canadian minister at its own Digital Summit underlines how seriously Berlin treats the relationship.

Bob: For Europe, this shows the push for sovereign and safe AI isn't happening in isolation. European companies and researchers could get a closer route to Canadian partners and funding. The open question is the follow-up: budgets, joint projects, and what role the merged Cohere business ends up playing on both sides of the Atlantic.

Quantum computing quietly moves from research labs toward real commercial utility.

Samantha: While AI grabs the headlines, quantum computing is quietly moving from the lab toward real commercial use. The key shift is from physical qubits to logical qubits. A qubit is the basic unit of a quantum computer, and physical qubits are fragile: tiny disturbances knock them off course and cause errors. A logical qubit bundles several physical ones together so those errors can be caught and corrected.

Bob: And the timeline experts are sketching is concrete. Utility-scale quantum computing, meaning machines that do genuinely useful work, is expected within the next five years. The projection is hundreds of logical qubits by 2030 and thousands by 2035. Those are forecasts, not guarantees, but they put dates on the ambition.

Samantha: Two technical advances drive the optimism. Researchers have demonstrated exponential error suppression, meaning errors drop sharply as the correction scheme grows, instead of piling up. And there's progress in silicon, the same base material as ordinary computer chips: nearly flawless control of five silicon qubits running at once, at about ninety-nine point nine percent accuracy.

Bob: The silicon detail is one to watch. If quantum chips can be built on a material the chip industry already knows well, the road to larger-scale production could become easier. Keeping that accuracy while scaling from five qubits to far larger numbers is the hard part, and that's exactly where the error correction work comes in.

Samantha: For Europe, the coverage notes that European research institutions and companies are actively contributing to these advances, and could see new opportunities as the technology heads toward commercial use. The bottom line is that quantum is shifting from a science question to an industrial one. For European businesses, a five-year window is short enough to start following closely.

Multi-factor authentication for Gmail blocks the most common route into hijacked accounts.

Bob: To close out, two things you can actually use today, and both come out of a warning from security researchers. They report a significant increase in attacks on Gmail accounts: sophisticated phishing, credential stuffing, and account takeover attempts. Credential stuffing means criminals take passwords leaked elsewhere and try them on your email. So the first step is switching on multi-factor authentication for Gmail, which cybersecurity professionals recommend as a key defence.

Samantha: Multi-factor authentication means a password alone isn't enough to get in. You also need a second proof, typically something on your phone, so a stolen or reused password doesn't open the account by itself. You set it up in your Gmail account's security settings, it works whether you read your mail on a phone or a laptop, and it takes a few minutes. The stakes go beyond email: a hijacked inbox can give attackers access to other linked platforms.

Bob: The researchers stress that attacks have evolved beyond opportunistic phishing. Criminals are exploiting backup processes and social engineering, meaning they trick people into handing things over. That's the limitation worth knowing: if someone persuades you to pass on a sign-in code, the second factor stops helping. So treat any unexpected request for a code as suspect. And since backup processes are a target, it's worth checking that the recovery details on your account are really yours.

Samantha: For European users and businesses this isn't abstract. A compromised Gmail account can lead to business email compromise, where attackers pose as someone inside a company to target financial transactions. For small firms that handle invoices by email, that's a direct financial risk. Key takeaway: a few minutes in the settings today, plus vigilance toward suspicious messages, makes an account a much harder target.

Reviewing the third-party app access list in Gmail shuts out malicious connected apps.

Bob: The second thing is a quick review of the third-party app access list in your Gmail account. It ties to one of the newer tricks researchers flag: malicious consent prompts. These are the screens where a website or app asks to connect to your account, and you click allow. Attackers build fake apps that ask exactly that, and once you've granted access, they may not need your password at all.

Samantha: That's what makes this route attractive to criminals. Multi-factor authentication protects the front door, but an app you approved yourself already holds its own access. So the habit to build is pausing at every permission screen and reading who is asking, and what they want to see. An app that only needs your name has no obvious reason to request access to read and send your email.

Bob: Then go through the list of apps that already have access to your account. People connect quizzes, calendar tools and newsletter services over time, and then forget about them. Anything you don't recognise or no longer use can be removed. The limitation: if you remove an app you actually still need, you'll have to connect it again, so it's a low-risk clean-up.

Samantha: For European organisations, this is also a team job. One employee approving the wrong app on a work-linked Gmail account can open a route to shared contacts and files, and from there to the business email compromise scenarios researchers describe. A ten-minute review on phone or laptop, and a simple rule that nobody clicks allow on autopilot, is a practical starting point.

Samantha: Today we covered: China's mandatory AI safety rules, Moonshot AI's new open-weight Kimi model, the Canada and Germany AI alliance, quantum computing's move toward commercial use, and two things to try yourself: multi-factor authentication for Gmail and the third-party app access list in your Gmail account.

Bob: Want to know more or react? Visit stateoftech.eu or email us at info@doorzetters.net.

Bob: State of Tech, the tech world in 15 minutes.