Each item this week is a decision someone may already have made for you. Between them, they decide who watches the cooling controllers in your buildings, who caps your AI spending, what a supplier's new owner can do, and who may host an open model for others.
1.Cooling and building controllers often sit outside IT, with facilities or the supplier who installed them
On 2 November, freezers and fridges in about 40 Delhaize and 15 Carrefour stores in Belgium warmed up overnight. Delhaize calls it an IT incident in its cooling systems; Carrefour Belgium confirmed a cyberattack. On 5 November, five US federal agencies, among them the cyber security agency CISA, urged organisations to harden industrial refrigeration and cold-chain monitoring. Their fact sheet names no vendor or victim.
Cooling, heating and building controllers often belong to neither IT nor the operational technology team that runs machines and control systems. They sit with facilities, or with the supplier who installed them. Banks and insurers have them too, in office buildings and in the cooling of server rooms. Someone has to own them, put them in the asset inventory and keep them off the internet. Otherwise the first alarm is spoiled stock or an overheating server room.
Ask your team: Which cooling, heating and building controllers do we run, who owns each one, and which can be reached from outside our network?
Sources: VRT NWS, cyberattack on Delhaize cooling installations, 02-11-2026 · Dutch IT Channel, citing Belga and RTL Info, 02-11-2026 · CISA, FBI, HHS, USDA and DOT, fact sheet on industrial refrigeration and cold-chain monitoring systems (IC3), 05-11-2026
2.Gartner expects AI agents in IT operations on uncapped token pricing to overrun their cost expectations by more than half
On 26 October, Gartner predicted that through 2027, enterprises running AI agents in IT operations on uncapped token pricing will exceed initial cost expectations by more than 50%. A token is the unit of text a model reads or writes, and the meter most AI pricing runs on. The comparison is with subscription or bundled pricing. I read the full text in a reprint; Gartner's own page would not open for me.
For financial and industrial organisations alike, the pricing model is often chosen by whoever runs the pilot. If the IT team picks a usage-based plan to get started, the budget owner never chose the exposure, and the board first sees it on the bill. I would treat a spending cap on any usage-priced AI service as a governance control. The budget owner sets it, in the contract or the admin settings.
Ask your team: Which of our AI services are priced per use, is there a spending cap on each, who set it, and what happens when a team reaches it?
Sources: Gartner, top AI trends in infrastructure and IT operations for 2027 (press release), 26-10-2026 · CXOtoday, reprint of the Gartner release, 26-10-2026
3.A Dutch government memo sets out contract options for when a critical hosting supplier changes owner
A ministry memo dated 17 September is now published by the Tweede Kamer, the Dutch lower house. It describes a cabinet letter on Solvinity, the company that hosts DigiD and MijnOverheid. The letter sets out the options for change-of-control clauses: terms that apply when a supplier gets a new owner. It answers a motion on critical government infrastructure. I have not seen the letter itself or confirmed it was sent. The parliamentary committee has moved its debate on digital autonomy to Thursday 26 November.
The same clause works for any buyer that depends on a critical supplier. A bank's core hosting or an offshore firm's vessel data can sit with a supplier that changes hands. The decision is whether your critical supplier contracts let you renegotiate or leave when ownership or jurisdiction changes. Without that clause, a takeover can bring your supplier under another country's law while your contract still binds you.
Ask your team: Which of our critical supplier contracts let us renegotiate or leave if the supplier changes owner or falls under another country's law?
Sources: Tweede Kamer, interior ministry memo on the collected Solvinity letter, 2026D51918 (memo dated 17-09-2026; letter itself not seen), 05-11-2026 · Tweede Kamer, committee decision list moving the debate on digital autonomy to 26-11, 2026D51370, 14-10-2026
4.Mistral's new AI model, Large 4, may be run on your own servers; offering it as a hosted service needs a separate licence
Around 29 October, Mistral released the weights of Mistral Large 4 on Hugging Face, the main site for sharing AI models. Weights are the trained model: the files you download to run it yourself. The licence is Mistral's own, the Mistral Ecosystem Open-Weight License, a modified MIT licence. You may self-host and modify the model, but offering it to others as a hosted service needs a separate commercial licence.
"Open weights" does not settle what you may do with them. A machine builder that puts the model behind a service its customers log into may count as offering a hosted service. So may a group IT team that hosts it for other companies in the group. Before a team self-hosts a model or builds one into a product, legal should have read its licence for that use. Skip that, and a product can launch on terms that require a commercial licence you never negotiated.
Ask your team: Which open-weight AI models do our teams run or build on, and has legal read each licence for what we plan to do with it?
Sources: Mistral, Mistral Large 4 announcement, 29-10-2026 · Hugging Face, Mistral-Large-4-1T-A52B model card and licence, 29-10-2026
From Delfen this week
- On 26 October I published CRA Article 14 for machine builders: who files the 24-hour warning on delfen.ai, about the EU Cyber Resilience Act.
- On 6 November delfen.ai retired its toolkits and put the Sovereign Agent Logbook in their place. It keeps a record of what an AI agent reports it did and who approved it, in a file on your own server: delfen.ai/logbook. Old toolkit links redirect.
- No corrections.
- Past issues of this update are at delfen.ai/cto-update.
Checked and quiet
On 8 November a tracker still showed EN 18286, the European standard for an AI provider's quality system, as the only harmonised standard cited under the EU AI Act. I could still find no enforcement action under the Cbw, the Dutch cyber security act. I found no new fine under DORA, the EU's digital resilience rules for financial firms, and no letter on quantum risk from the European Central Bank. The first list of standards under the Machinery Regulation, the new EU safety rules for industrial machines, is still not out.