DISCOVER

    GOVERNANCE

    OCT 18, 2026

    BY H.B. HAYES

    The Desk — 04

    Your voice bot may have changed models on Wednesday. Five more stories that change your support queue this month.

    THE DESK — 04 · SIX STORIES · ABOUT SIX MINUTES

    Two things in your support stack could have changed this week without anyone on your team deciding. A voice model swapped itself in behind a "latest" label, and Meta rewrote the terms businesses accept by staying on its products, then took one word back out.

    Six stories passed this week, one more than usual.

    01 — Colorado is deciding which chatbots its new law covers. Comments close in eight days.

    What happened. On 6 October, the Colorado Department of Law released interim draft rules for two AI laws, the ADMT Act and the Chatbot Safety Act. Both take effect 1 January 2027. Comments close at 11:59 p.m. MST on 26 October. The chatbot law requires operators of public-facing conversational AI to disclose that users are talking to AI, estimate their ages, and report each year to the Attorney General. The draft also proposes exemptions, including for narrow, task-based tools.

    What it means. If Colorado residents use your support bot, its coverage is being decided now. If you think an order-status bot shouldn't carry age estimation and annual reports, say so on the comment form. Whether you're exempt is a question for your counsel.

    Where it doesn't apply. Staff-only tools behind a login are out. So are tools that only summarize, draft or route work for a person to review.

    02 — Your voice bot may have changed models on Wednesday. Nobody on your team shipped anything.

    What happened. On 14 October, xAI released Grok Voice 3.0 at $0.08 a minute, the same as version 2.0. Bots set to grok-voice-latest moved to it automatically. On Artificial Analysis's τ-Voice test of support calls, it completed 71.6% of tasks, against 56.5% for version 2.0. xAI also says Starlink resolves roughly 70% of its 20,000 daily calls with no human involved. That's xAI's own number about a SpaceX business.

    What it means. The alias is the story, not the model. A bot pointed at "latest" can change behavior with no release on your side, and a better score still means different answers. If you run voice AI, ask which model string each bot calls. If it's an alias, pin a version or retest every time it moves.

    Where it doesn't apply. If you don't run Grok, nothing changed for you this week. Every vendor's "latest" alias carries the same risk.

    03 — Customers trust the bot twice as much when they can see the way out.

    What happened. On 14 October, Five9 published a survey of 3,000 consumers in the US, UK and Germany, run with Hanover Research. 55% said they trust AI to resolve their issue when a clear route to a person is available. Without one, 26% do. In Australia, 70% of the more than 1,000 people Choice surveyed said businesses shouldn't be trusted to use AI however they see fit, AAP reported.

    What it means. Five9 sells contact-center software, so these are a vendor's numbers. Hiding the exit may lift your containment rate. By this survey, it also cuts trust in the bot from 55% to 26%. If your AI path has no visible route to a person, add one before you add another use case.

    Where it doesn't apply. More than a third of Five9's respondents said AI can handle password resets and order status on its own. If that's all your bot does, the exit matters less.

    04 — Your customers' AI agents are reaching your support desk. The biggest new one doesn't say what it is.

    What happened. On 13 October, Zendesk published the Open Service Directory, a draft spec and public directory that helps personal AI assistants find a brand's official support. On 15 October, DataDome reported that Meta's Muse agentic browser sent 29.1 million requests between 22 September and 3 October without identifying itself as an AI agent. In a sample, 8.9% of them touched forms, logins, payments, account creation or carts.

    What it means. Muse doesn't announce itself. DataDome's figures are its own and unaudited, and it sells the fix. Plan for the unannounced agent first. List what anyone can do through your forms and chat without a person, then decide which actions need a verified login or a human.

    Where it doesn't apply. If your forms can't change an order or move money, your exposure is small. The directory can wait. Futurum's analyst notes that assistant makers haven't committed to using it.

    05 — The FTC wants AI labs' incident records, and the marketing that went with them.

    What happened. On 14 October, the FTC sent civil investigative demands to OpenAI and Anthropic, Axios reported. Each runs more than 50 pages and asks for documents on security incidents, safeguards, marketing materials and privacy policies. A demand isn't a finding that either company broke the law.

    What it means. The FTC is asking whether what AI companies said about safety matched what happened. If a vendor sold you on accuracy or safety figures, file that deck with the contract. If your bot tells customers how your AI works, check that it's true. What to keep is a question for your counsel.

    Where it doesn't apply. The demands target model makers, not the companies using their models. Nothing here asks a support team to act this month.

    06 — Meta wrote AI training into the terms businesses accept by staying. Then it took the word out.

    What happened. Meta's new commercial terms take effect on 30 October. Businesses running Facebook, Messenger, Instagram or WhatsApp accounts accept them by continuing to use those products. As first published, the terms let Meta crawl websites "associated with" those accounts and use the content to train its products, Nieman Lab reported on 15 October. After publishers and lawyers objected, Meta had removed the training language by 17 October. Meta says the crawling covers only its ads and business products, and sites can still block it with robots.txt.

    What it means. If you support customers on WhatsApp or Messenger, your company accepts new terms by doing nothing, and your help center is likely one of the sites in scope. If nobody owns the terms for your support channels, give that job to someone.

    Where it doesn't apply. No Meta business account, no change. If your help center is fully public anyway, the practical change is small.

    Worth knowing, not worth your Monday

    At least eight states sued OpenAI under consumer protection laws. Michigan, 38 other states and DC filed in Character.AI's bankruptcy case over user privacy and safety. OpenAI added four June incidents to its public disclosures page, which now lists 19. The White House AI task force adopted its charter and started a 120-day risk report.

    It's real news. None of it changes what your queue does this month.

    One thing to do this week

    List every place AI touches your customers: chat, voice, email drafts, help center search. Next to each, write the exact model it calls and whether it's pinned or set to "latest."

    If you can fill every row in under an hour, you'll know what changed this week. If you have to ask a vendor, that's the finding.

    Sources

    — H.B.

    The Desk is original writing from Copious. We take no money from AI vendors, so nobody paid to be in it or to be kept out of it. If I got something wrong, tell me at hello@copious.app. I'll fix it and say so.

    Next edition: Sunday, 25 October 2026.

    Copious takes no money from AI vendors. Nothing here is placement.