Beyond the chat box

Eighty-five minutes, five sections. The first three are generative media, the fourth is physical AI, the fifth is what to do on Monday. The two halves share one idea: the model guesses, something else has to check. In media the check is a process (who approves the image, who calls back on the payment). In robots the check is physics, a safety standard and a fence.

Part IV gave you one mechanism for language models: given the text so far, score every possible next chunk, pick one, repeat. Image generation uses a different mechanism that is the same idea wearing a different coat. The method most products use is called diffusion, and the clearest description is still the 2020 paper by Ho, Jain and Abbeel. Training works like this. Take millions of real images. Add a small amount of random static to each, then a bit more, and more, over many small steps, until the picture is indistinguishable from noise. That part is mechanical; no model is involved. Now train a model on one narrow skill: given a slightly noisy image, predict the slightly cleaner version. Do that billions of times across every step of every image. The model never learns to draw; it learns to un-blur. At use time you run that skill backwards. Start from a field of pure random static, attach your caption (converted into numbers the model can condition on), and apply the un-blur skill twenty to fifty times. Each pass pulls the static a little closer to something that matches the caption. What comes out is a new picture. It is not retrieved from a library and it is not a collage of pieces; it is a statistically plausible image given the training data and the words. The analogy to text breaks in one place: a language model commits to one token at a time, while diffusion refines the whole canvas at once, repeatedly. The lesson transfers intact. It is prediction, not lookup, so it cannot be accurate about things it never saw, and the question of whose pictures it saw is the legal question in the next section. Audio and video use the same family of methods, with sound and frames in place of pixels.

Every generative media product you will be shown does the same three things. You describe, it generates, you edit, and you go round again. The table lines the four media up so the pattern is visible. For images the chunk is a patch of pixels and the generation is the un-blurring from the last slide; editing means masking a region (marking the part you want changed) and describing what should be there instead. For audio the chunk is a slice of sound. There are two common jobs: text-to-speech, where a script becomes spoken audio, and voice cloning, where a short sample of a real person’s voice, often under a minute, becomes a model that will say anything in that voice. Hold onto that sentence; it is the whole of section three. For video the chunk is a frame treated as patches, plus the sound track, and the products in late 2026 produce clips of seconds to a few tens of seconds in minutes; editing means extending a clip, changing the lighting or swapping a background. The right-hand column is the one to read twice. Image models still struggle with exact text, counts, hands and the same character appearing consistently across shots; OpenAI’s April 2026 image release lists dense typography, technical labels, arrows and diagrams as areas it improved and still recommends human review for. Voice models mispronounce names and numbers and sound confident doing it. Video models get physics and continuity wrong. These are not bugs to wait out. They are where prediction meets the need for correctness, which is exactly where Part IV told you the text model fails. The clip lengths and quality will be different by the time you read this. The shape of the workflow, and the column where your checks belong, will not.

Here is what generative media does well enough today that ordinary businesses already use it, with the catch attached to each. Marketing variants: take one approved image and produce fifty sizes, backgrounds and seasonal versions in an afternoon. Coca-Cola has run AI-generated holiday advertising two years running, with a 2025 remake of its 1995 “Holidays Are Coming” spot made with an AI studio; viewers noticed trucks with extra wheels and misplaced axles, and the company says engagement was high anyway. Both things are true, and the lesson is that someone must approve every frame. Product mock-ups: a convincing photograph of a product that does not exist yet, fine for a pitch, not for a specification. Voice-over and dubbing: ElevenLabs launched dubbing into more than twenty languages in October 2023, keeping the original speaker’s voice; a native speaker still has to check names and numbers. Transcription is the quiet success. OpenAI’s Whisper, released as open source in September 2022 and trained on 680,000 hours of audio, made good speech-to-text nearly free. It also hallucinates: an Associated Press investigation in October 2024 found researchers reporting invented sentences, including a non-existent medication, often on pauses or background noise, while a clinical tool built on it was transcribing millions of medical visits and deleting the source audio. Keep the audio. Check the quotes. Synthetic training data: when you have forty photos of a defect and need ten thousand, generate the rest and test only on real ones. Accessibility: alt-text, audio versions and captions are now nearly free, which means nobody checks them, so write the rule that someone samples them. In every case the Part III pattern holds: the model drafts, a human approves what carries your name.

The weaknesses are the strengths seen from the other side, and most are structural rather than temporary. A diffusion model draws what text looks like; it has no spelling. Products improved this a great deal through 2025 and 2026, and the vendors’ own release notes still recommend human review of labels, diagrams and dense type. Consistency across shots is harder still: each image is a fresh sample from noise, so “the same mug, same angle, ten scenes” needs either a trained custom model or a lot of discarding. Counting is the famous one. Six fingers, extra wheels, thirteen in a dozen: the model has no arithmetic, only a sense of what hands and trucks tend to look like. And anything that has to match reality, a floor plan, a wiring diagram, a chart of your actual revenue, is simply the wrong job; Part III said let code calculate, and the same applies to pixels. The middle column is where most business value lives: mood, style, variation, a voice reading a script, a transcript, a first cut. Each is fine if a specific person checks it once, and most of these checks take minutes. The right column is not about quality. A real person’s face or voice without written consent is now a legal line in the EU, in most US states and under a federal statute, as section three shows. Generated “evidence” of a site, a defect or an incident is fraud whether or not anyone meant it to be, and a generated image presented as a record of an event is the thing the disclosure rules exist to stop. The rule of thumb: if a wrong pixel would cost money, generate the mood and let a person or code supply the facts.

This is an invented run; the tools, counts and job titles are made up, and the division of labour is the point. Marketing writes a brief: the product, the audience, three formats, the brand rules, and a list of things that must not appear. Then, before anything is generated, code fetches the facts. The price, the SKU, the legal line and the logo file come from the product system. They are not typed into a prompt and they are never drawn by the model. The model’s job is the mood: forty variants of background, lighting and layout built around one approved product photograph, with an explicit instruction that it renders no text. Template code then composes the final images, overlaying the real price, the real logo and the real legal copy at pixel-exact positions, the same way every time. A vision model does a first pass, flagging extra limbs, wrong colours and breaches of the brand rules; it is a filter that reduces the pile, not a judge that approves anything. Finally a named person picks six, signs them off, decides whether the campaign needs an AI-assisted label (section three), and the content credentials are attached. Read the three cards and you will see Part III’s support agent again. The model handles what is allowed to vary. Code handles what must be identical. The human handles whatever a court or a customer will later ask about: approval, consent for any real face or voice, and the disclosure decision. Teams that let the model draw the price learn this the expensive way.

First the caveat, on the slide and in the book: this is not legal advice, the law differs by country, and it is moving. What follows is the position in the United States as of October 2026, which is clearer than most people expect. On 29 January 2025 the US Copyright Office published the second part of its report on artificial intelligence, on copyrightability. Its conclusion: “human authorship is a bedrock of copyrightability, and thus works entirely generated by AI are not copyrightable.” It specifically rejected the argument that detailed prompts, or many rounds of refining prompts, amount to authorship: prompts “may reflect a user’s mental conception or idea, but they do not control the way that idea is expressed.” Seven weeks later, on 18 March 2025, the D.C. Circuit decided Thaler v. Perlmutter, affirming that an AI system cannot be the author of a work and that human authorship is required to register; Dr Thaler had listed his “Creativity Machine” as sole author of an image, and lost at every level. The Office was equally clear about what remains protectable. Where a human-made work is perceptible in the output, where a human creatively selects and arranges AI-generated material, or where AI was used for ideas and edits to a human work, the human contribution can be protected, decided case by case. In practice: a competitor can lift your prompt-only hero image and you have no copyright claim; your logo, copy and layout are still yours; and the brief, the edits and the record of what you chose are the evidence of the human part, so keep them. Other jurisdictions differ; the UK, for instance, has a statutory provision for computer-generated works that is itself under review. The durable rule travels: the more a human shaped it, the more of it you own.

The ownership question on the last slide was about outputs. The cases on this slide are about inputs: whose work went into the training data, and with what permission. Four matter most, as of October 2026, and all four will have moved by the time you read this. Bartz v. Anthropic is the one with a number. In June 2025 Judge Alsup ruled that training a language model on books Anthropic had lawfully bought and scanned was fair use, and that downloading pirated copies from shadow libraries was not. The pirated-copies claim went to a class of roughly 482,000 books; Anthropic settled for $1.5 billion, with preliminary approval in September 2025 and final approval on 21 July 2026. New York Times v. OpenAI and Microsoft, filed in December 2023, is the big one for text and for outputs: the Times alleges both that training on its articles infringed and that ChatGPT reproduces them. It has survived a motion to dismiss, been consolidated with other publishers’ suits, and in November 2025 a magistrate ordered OpenAI to produce a sample of 20 million de-identified chat logs. Summary judgment on fair use was being briefed through November 2026; no trial date. Getty Images v. Stability AI is the image case, and the UK verdict in November 2025 surprised people: Getty dropped its main copyright claims after accepting there was no evidence training happened in the UK, and lost the remaining argument that the model itself was an “infringing copy”, because the model stores no copies. It won narrow trade-mark findings about reproduced watermarks. The court allowed an appeal on the point of law. The US version, refiled in California in August 2025, proceeds on trade-mark claims with a trial listed for January 2028. Read across and a pattern appears: buying and training is winning, pirating is losing, and “the output copied the input” is still open.

Because the training-data cases are unresolved, the large vendors have offered something concrete: an indemnity. Microsoft announced its Copilot Copyright Commitment in September 2023; OpenAI followed with Copyright Shield in November 2023; Adobe, Getty, Shutterstock, Amazon and IBM made similar promises. The shape is the same: if a paying business customer is sued over copyright in the tool’s output, the vendor defends and pays. Three things make it less than it sounds. It applies to business tiers; OpenAI’s covers the developer platform and ChatGPT Enterprise, not the free or Plus consumer products. It is conditional, and the conditions are written down. Microsoft’s published terms require that the content filters be switched on in the required mode, that a “protected material” system prompt be in place, and that the customer test its own application for reproducing third-party content and keep a report of the testing to hand over if a claim is made; output retroactively flagged by an asynchronous filter is excluded. Break a condition, or take the output and edit it into something infringing yourself, and the promise is off. And it covers copyright. It does not cover a real person’s face or voice, which is a consent question and increasingly a statutory one; it does not cover your trade-mark, defamation or consumer-law exposure; and it does not cover the reputational cost, because the indemnity pays lawyers, not customers. The practical rule for a business is short. Use a paid tier. Leave the filters on. No real faces or voices without written consent. Keep the brief and the edit history, because that is both your copyright evidence and your indemnity evidence. Then the promise is worth something.

Three numbers, each a floor. In early 2024 an employee of Arup, the engineering firm, in its Hong Kong office received a message about a confidential transaction, apparently from the chief financial officer in the UK. A video call followed. The CFO was on it; so were several colleagues. Every one of them was a deepfake. The employee made fifteen transfers totalling HK$200 million, about US$25 million, to five accounts, and discovered the fraud only on checking with head office. Hong Kong police described the case in February 2024 without naming the company; Arup confirmed to the Financial Times in May that “false voices and images were used.” The second number is from the FBI’s Internet Crime Complaint Center report for 2025, published in April 2026: 22,364 complaints carried an AI descriptor, with $893 million in losses. That counts only cases where the victim knew AI was involved, which is why it is a floor; the same report puts distress scams using cloned relatives’ voices at over $5 million and deepfake job interviews at about $13 million. The third number is older and bigger: business email compromise, the “the CEO says pay this invoice now” fraud, cost $3.0 billion in 2025. Voice cloning is the follow-up phone call that turns a suspicious email into a believable instruction. Total losses reported to the FBI in 2025 crossed $20 billion for the first time. The point of the slide is not that deepfakes created a new crime. Impersonation fraud is old. What changed is that the tell, the thing that used to give it away, the voice that was not quite right, the face you could not see, is gone.

Walk the Arup case slowly, because every step is one your organisation could take tomorrow. It opened with a message, apparently from the UK-based CFO, about a confidential transaction. Nothing technical about that; it is the standard opening of invoice fraud, and the secrecy is part of the design, because a victim who is told not to discuss it will not discuss it. Then came the video call. The CFO was there. Colleagues were there. All were deepfakes assembled from publicly available footage; senior people at large firms have hours of conference video online, and a voice clone needs far less. According to the police account, the employee had initially been suspicious and the call resolved the suspicion, which is exactly what it was for. Fifteen transfers followed, to five accounts, totalling HK$200 million. Each on its own looked like an ordinary payment. The fraud was discovered when the employee checked with head office. Notice what worked and what did not. No detector was involved at any step; the faces and voices were good enough that a colleague who knew these people accepted them. The thing that eventually worked was a human asking another human through a channel the attacker did not control. The panel lists the controls that would have stopped it earlier, and none of them is new. Call-back: any payment instruction received by call or video is confirmed by phoning a number you already held, never one supplied in the message. The two-person rule: above a threshold no single person moves money, whoever asks and however senior. And secrecy as a red flag: “confidential, do not involve finance” is the signal, not a reason to comply. The deepfake was perfect. The process was absent. You can only fix one of those.

The instinct, when shown a convincing fake, is to want a better detector. Resist it. Detectors lag the generators they are built to catch, they return a probability rather than a verdict, and in practice nobody runs one on a live video call at four in the afternoon. They are useful afterwards, as forensics; they are a poor gate. The other instinct is “our people would notice.” Arup’s employee knew the people on the call, and that familiarity was precisely what the clone exploited. A control that depends on human perception of media is a control that is already beaten. What works is process, and three controls cover most of it. Call-back on a known number: any request that arrives by call, video or message to pay, change bank details or hand over credentials is confirmed by phoning a number already in your directory, never one supplied in the message. Two minutes, every time, and it defeats every clone because the attacker does not control your directory. The two-person rule on money: above a threshold, two named people approve, with no exception for seniority or urgency; Part III built this rule into a finance agent and it belongs in your finance team too. And a shared secret: a code word for families and small teams that no clone can know. The US Federal Trade Commission’s guidance on family-emergency scams makes the same point from the consumer side, that a cloned voice makes the panicked request more believable and the answer is to verify before paying. The best illustration is Ferrari in July 2024, as reported by Bloomberg: an executive took a call from a convincing clone of the chief executive’s voice, discussing a confidential acquisition and a currency hedge. He said, “Sorry, Benedetto, but I need to identify you,” and asked which book the CEO had recommended days earlier. The call ended. A clone copies a face and a voice. It cannot copy a secret.

You will be sold three things under the heading “we can tell what is fake.” They are different, and only one of them is yours to control. Content Credentials, from the Coalition for Content Provenance and Authenticity (C2PA), are an open standard: a cryptographically signed, tamper-evident record of how a file was created and edited, travelling with the file. Members include Adobe, Microsoft, Google, OpenAI and camera manufacturers. When a credential is present and verifies, you learn who signed it and which tools touched it. That is genuinely useful for the media you produce and for sourcing from suppliers who sign theirs. The limit is the one the C2PA’s own FAQ states: credentials can be separated from the file, most platforms and tools strip metadata on upload, and the absence of a credential proves nothing either way. It is not a detector. The standard is adding “durable” credentials that use watermarks and fingerprints to re-find a stripped manifest, which helps, and does not change the logic. Invisible watermarks, such as Google DeepMind’s SynthID, are patterns the generator hides in the pixels, the audio or, for text, the choice of words, and that the vendor’s detector can read. Google’s documentation says the text watermark survives light edits and cropping, returns a three-way answer (watermarked, not, uncertain), degrades under heavy rewriting or translation, and “is not designed to directly stop motivated adversaries.” It also only identifies that vendor’s outputs. Classifiers that answer “is this AI?” lag the generators, produce false positives on real content, and a fraudster uses the newest model. All three have a place: use provenance to prove what you made and to vet suppliers, and use detectors for forensics and bulk screening. None of them is the gate on a payment. That is the last slide.

Two years ago this slide would have said “the law is behind.” It is not any more, and the obligations fall on ordinary businesses, not only on the model companies. The European Union’s AI Act, Article 50, applies from 2 August 2026. Providers of systems that interact with people must make sure people know they are dealing with an AI. Providers of generative systems must mark their audio, image, video and text outputs in a machine-readable way so they can be detected as generated; systems already on the market have until December 2026 for that. Deployers, which means you if you publish, must disclose deepfakes, defined as generated or manipulated content resembling real people, places or events that would falsely appear authentic, clearly and at the latest on first exposure, with an exception for evidently artistic or satirical work. Generated text published to inform the public on matters of public interest must be labelled unless a human has editorial responsibility. Fines run to €15 million or 3% of worldwide turnover. In the United States the TAKE IT DOWN Act was signed in May 2025. It makes it a federal crime to publish, or threaten to publish, intimate images of a person without consent, explicitly including AI-made “digital forgeries”, and from 19 May 2026 it requires platforms hosting user content to remove such material within 48 hours of a valid request, enforced by the Federal Trade Commission at $53,088 per violation. Beneath the federal law, Ballotpedia counted 49 states with at least one deepfake statute by July 2026, 48 on intimate imagery and 33 on election deepfakes, most passed since 2024. And the old law never went away: fraud, defamation, passing off, trade marks, privacy and advertising rules all apply. Arup’s attackers did not need a deepfake statute to be criminals.

Disclosure is now partly law and partly brand judgement, and a single rule covers both: label anything a customer would be annoyed to discover. The grid makes it operational. Top left is the serious quadrant: realistic media that depicts a real person, place or event, or could be mistaken for a record of one. In the EU this is a deepfake under Article 50 and must be disclosed visibly on first exposure. On YouTube, since March 2024, creators must declare when a video makes a real person appear to say or do something they did not, alters footage of a real event or place, or generates a realistic scene that did not occur; the label appears in the description, and on the video itself for sensitive topics such as health, news, elections and finance, and YouTube says it will penalise creators who consistently fail to disclose. Top right is realistic but invented: a stock-style scene, a synthetic presenter, a dubbed voice that is nobody’s. Nobody is harmed, and the honest move is still a plain label, because a customer who finds out later feels tricked and the label costs nothing. Bottom left is a real person, obviously stylised: written consent is the gate and the label is a courtesy, and dubbing your own presenter belongs here. Bottom right is the exempt zone, which both YouTube and the EU recognise: illustrations, icons, alt-text, captions, background clean-up, and text that a person edited and takes responsibility for. The brand point: Coca-Cola’s AI holiday advertising drew sustained criticism two years running and the company stood by it openly, which is survivable. The campaigns that hide the method and are found out are the ones that become the case study.

Part I offered one line: a robot is an agent with kinematics. Part III then gave you the six parts of an agent, only one of which is the AI. Put them together and physical AI stops being mysterious. The goal and instructions are written by you and, today, are narrow: move these totes to that rack. The model looks at camera frames and decides the next motion; the trend through 2025 and 2026 is towards a single model that sees, plans and moves, which the field calls a vision-language-action model, and this is where Google DeepMind’s Gemini Robotics and Nvidia’s GR00T models sit. The tools are literal hands: motors, grippers, wheels or legs, driven by control code running hundreds of times a second. The model does not twitch the motors any more than Part III’s model ran the SQL; it asks, and code does. Knowledge is a map, the shape of a tote, what “fragile” implies, mostly learned from human demonstrations and simulation. Memory is short and critical: where am I, what am I holding, what did I just drop. Guardrails are the part that changes character. In software they were permissions and spend caps. In a robot they are speed and force limits, people-detection stops, fenced zones and an emergency stop, and they are written into safety standards rather than prompts; the 2025 edition of ISO 10218 folded the collaborative-robot rules of ISO/TS 15066 into the main industrial-robot standard and made its functional-safety requirements explicit. Then the two additions. Physics: gravity, friction, a wet floor, a box heavier than it looks, and no retry button, because a wrong token is deleted and a dropped crate is not. And a battery: Boston Dynamics quotes four hours for the new Atlas, hot-swappable in three minutes, and a shift is eight. Energy, heat and wear are the engineering. They are not the AI, and they are most of the cost.

Part I said the bottleneck had moved from “can it talk” to “can it manipulate for a shift without a babysitter, a lawsuit or a dead battery.” The ladder is a teaching device, not an industry standard, but it sorts the claims. Talking is done; the language models from Part IV can describe a scene, answer questions and take instructions, and a humanoid doing this on stage is a chatbot with legs. Seeing and navigating is done, on wheels: Amazon’s fleet, the subject of a later slide, has been crossing warehouse floors around people for a decade. Grasping is mostly solved, one object class at a time. A known rigid box is routine. Thin-walled parts, floppy bags and reflective packaging are each their own research problem, which is why Figure makes a point of showing thin-walled parts at BMW. The fourth rung is where the industry actually is. Manipulating for a shift means thousands of picks over hours without a person clearing a jam every twenty minutes, and the figure that would tell you whether it works, the mean time between a human intervention, is the one vendors do not publish. What they publish instead is cumulative counts: Agility’s 100,000 totes at one site, Figure’s 30,000 cars “contributed to.” Those are real and they are not the same thing. The top rung, an unfamiliar task in an unfamiliar place with nobody watching, is where the keynotes live and nobody is. Elon Musk, announcing the start of Optimus production on 21 October 2026, said the AI “needs substantial work” before the robot can handle open-ended tasks, and that the design still needs changes for safety, reliability and durability. Take vendors at their word when they are being modest.

This is the deck’s one slide of names, and it carries its date because every row will be stale within months. Each entry is what the company itself has said, read in October 2026, and the thing to notice is the difference between a cumulative count and a reliability figure; nobody on this board publishes the second. Tesla began what it calls early production of production-quality Optimus units at Fremont on 21 October 2026, with Musk saying in the same breath that the design still needs safety, reliability and durability changes and that the AI needs substantial work before open-ended tasks; 20,000 a week by the end of 2027 is a stated target. The 2024 “We, Robot” event, where Optimus units served drinks, turned out to be human-assisted, as a Tesla engineer later acknowledged. Figure put Figure 02 on BMW’s Spartanburg line in 2025 and says it contributed to the assembly of 30,000 cars; Figure 03 arrived for logistics in June 2026. Numbers of robots and terms are not disclosed. Boston Dynamics showed the product version of the electric Atlas at CES in January 2026 and started production; all 2026 units go to Hyundai’s robotics centre and Google DeepMind, with other customers from early 2027. Agility is the most instructive row: a paid robots-as-a-service contract with GXO since June 2024, over 100,000 totes moved at one Georgia site, 65,000 hours across programmes, and two more sites from early 2027. Unitree sells on price, 5,215 humanoids in 2025 mostly to labs, and listed in Shanghai in August 2026. 1X ships NEO to homes at $20,000, with chores it cannot do handled by a remote human on request. Apptronik has raised over $935 million and is in pilots at Mercedes. Nvidia sells none of this and supplies the brain, the simulator and the data to most of it.

Where physical AI lands follows one variable: how constrained the environment is. The most constrained end has been automated for decades. Fixed arms weld and paint; wheeled drive units move shelves; the work is repetitive, fenced and measured, and Amazon alone passed one million deployed robots in July 2025. This is where the money has been and still is, and almost none of it is humanoid. Next come humanoids in a warehouse corner: one job, one site, a human nearby. Agility’s Digit moves totes onto a conveyor at a GXO site in Georgia under a paid contract; Figure’s robots move parts at BMW’s Spartanburg plant. These are real and small, and they are chosen precisely because the task is narrow and the floor is flat. Alongside them is the hybrid, which is less discussed and more honest: the robot does what it can and a remote human takes over the hard ten percent. That is how Mercedes trained Apollo in Berlin, by teleoperation, and how 1X ships NEO, with a remote 1X operator for chores it does not know. Teleoperation is not cheating; it is how the training data gets made and how the service stays reliable while autonomy improves. It is only a problem when it is hidden, as it was at Tesla’s 2024 event. Then the hard places: care, hospitals, the last mile. Unstructured, full of people, high consequence. Expect assistive devices and delivery carts long before a humanoid nurse. And homes last, as Part I said: your kitchen is a harder environment than a car plant. The first home humanoid costs $20,000 and comes with a remote pilot. The test for any robot pitch is on the slide: how constrained is the environment, how repetitive is the task, and what happens when it fails?

Before judging humanoids, look at the autonomy that already works, because it shows what the finish line looks like and how long the race is. Amazon announced its one-millionth deployed robot in July 2025, across more than 300 facilities. Nearly all are wheeled drive units and fixed arms, operating behind fences or in marked zones, on flat floors, doing the same motion thousands of times a day; the company also announced a model to route them more efficiently. It took a decade and a half from the Kiva acquisition to get there. Waymo is the same story on the street. Paid robotaxi rides went from about 50,000 a week in May 2024 to about 500,000 a week by March 2026, on a fleet that TechCrunch put at roughly 4,000 vehicles in 15 US cities by September 2026. The safety figures are Waymo’s own, and the company is careful about them: over 271 million rider-only miles through June 2026, it reports 95% fewer serious-injury crashes, 82% fewer airbag-deployment crashes and 93% fewer pedestrian injury crashes than the human benchmark on the same surface streets, while noting that retrospective results do not by themselves prove a system is “safe enough,” and regulators are investigating incidents including vehicles passing stopped school buses. Read both together. Working autonomy is a decade of one city at a time, mapped streets, fenced floors and a narrow task, with a remote human available. It is not a keynote and it is not general. Humanoids, by that measure, are at about year two, and the companies on the board that behave like Amazon and Waymo, one site, one job, published counts, are the ones to take seriously.

Everything Part III said about leashes applies to a robot, with the volume turned up. The model judges what is in front of it, how to grasp it, which motion comes next and when to stop and ask, because it has dropped something, is stuck, or is unsure. Code and physics do the rest: motor control and balance at hundreds of updates a second, force and speed limits, people-detection stops and zone fences, and a log of every action and every human intervention. A human owns the safety case, written against a standard; in industrial settings that is ISO 10218, whose 2025 edition absorbed the collaborative-robot technical specification ISO/TS 15066 and added functional-safety and cybersecurity requirements. Mention is enough here; the point is that the leash on a robot is a document an engineer signs, not a paragraph in a prompt. A human also owns the teleoperation takeovers, and disclosing them. And a human, or rather an organisation, owns the liability when the crate is dropped: the operator, not the robot, exactly as Air Canada learned about its chatbot in Part III. The three failure rows follow. A demo that looks autonomous and is not: ask who was on the controller and how many interventions per hour; a vendor who will not answer has answered. A robot doing something nobody permitted: the permission lives in the controller’s limits, not in the instruction, which is Replit with legs. And the line Part I put bluntly, that war and logistics do not wait for your feelings. Autonomous systems are a procurement category in defence and logistics today, and the sober version of that observation is that the same questions apply there, what is it allowed to touch and who is accountable when it fails, and that the answers are being set by law and policy now, not by demo reels. It belongs in the room as a fact, not a thrill.

Three stories, one from each half of the deck and one that joins them. Arup, in early 2024, is the deepfake story that should end every “our people would notice” conversation. An employee in the Hong Kong office joined a video call in which the chief financial officer and several colleagues were all synthetic, built from footage any large firm has online, and made fifteen transfers totalling about US$25 million to five accounts. The fraud was discovered the old way, by asking head office. Arup confirmed to the Financial Times that false voices and images were used. The lesson is process: call back on a known number, two people on money, and treat secrecy as the signal. Bartz v. Anthropic is the copyright story with a price on it. In June 2025 Judge Alsup ruled that training on books Anthropic had bought and scanned was fair use, and that downloading millions of pirated copies was not. The pirated-copies class, about 482,000 works, settled for $1.5 billion, approved finally in July 2026. The lesson for a buyer of AI tools is that where the training data came from is the live legal question, and it is a fair one to put to a vendor. Tesla’s “We, Robot” event in October 2024 is the physical-AI story. Optimus units served drinks and chatted. Afterwards an Optimus engineer acknowledged on X that they were “human assisted to some extent.” Two years later, starting production, Tesla says the AI still needs substantial work before open-ended tasks. Teleoperation is not the sin; Mercedes and 1X disclose theirs. Concealing it is. The question that joins all three stories is the one this series keeps asking: who, or what, actually did this, and who checked?

Five things, none of which needs a budget. A disclosure rule in one paragraph: label anything a customer would be annoyed to discover, require written consent for any real face or voice, use the quadrant from section three to decide, put it in the brand guide and attach content credentials to what you publish, because from August 2026 the EU requires most of this anyway. Call-back on a known number: every instruction to pay, to change bank details or to share credentials that arrives by call, video or message is confirmed by phoning a number already in your directory, never one supplied in the message, with no exception for seniority or urgency. Two people on money: above a threshold you choose and write down, two named people approve, and the phrase “confidential, do not involve finance” is the trigger to involve finance. A code word: for the leadership team and, separately, for your own family, because the FBI’s 2025 figures include millions lost to cloned relatives in distress; a clone copies a voice and cannot copy a shared secret, as the Ferrari executive demonstrated with a question about a book. And the constrained-environment test for any robot pitch: how constrained is the environment, how repetitive is the task, what happens when it fails, and who was on the controller in the demo. A vendor who cannot answer those four has told you where they are on the ladder. The closing line is the whole deck. The generative-media half is already in use, by your marketing team and by the people trying to defraud it. The physical-AI half is mostly not ready for an ordinary business yet. Both reward exactly the same thing, which is a process someone wrote down.

Three details for the curious. First, most products do not run diffusion on pixels at all. An encoder compresses the image into a much smaller latent grid, diffusion runs in that compressed space, and a decoder expands the result back to pixels. This is what made the method cheap enough to be a product rather than a paper, and it is part of why fine text and small details suffer: the compression discards exactly the detail that spelling needs. Second, conditioning and guidance. Your caption is converted into an embedding, the same kind of meaningful numbers Part IV described, and fed into every denoising step. “Classifier-free guidance” runs the model twice at each step, once with the caption and once without, and pushes the prediction in the direction the caption moved it. A higher guidance scale produces more literal, less varied images and, past a point, more artefacts; it is the dial behind many products’ “prompt adherence” sliders. Third, why it cannot spell or count. The model learns the statistics of what images look like, including what text and hands tend to look like, in a compressed space, from captions that almost never say “exactly four wheels.” Nothing in the loop enforces a constraint; it only makes things more probable. Newer models add text-rendering tricks and planning passes and get much better, and the structure is unchanged, which is why the deck treated these as properties rather than bugs. The pseudo-code shows one sampling loop in spirit. Audio and video run the same loop over spectrogram or frame latents; the newer “flow-matching” family changes the mathematics of the step-back, not the picture. The original paper is Ho, Jain and Abbeel, 2020.