Your AI business case now depends on which side of one date it lands. EnterpriseSG has confirmed that EDG, MRA and PSG cease on 29 September 2026, and that business grant support runs through the EDGE Grant from 30 September. EDGE covers 8 business areas and over 100 activities under one application, with a total cap per year shared across everything you claim. - Work in progress is safe. EnterpriseSG says ongoing submissions and projects continue to be processed and claimed. - The cap is annual and shared. It covers all activities together and refreshes on 1 April each year, so sequencing matters. - You pay first. Support is disbursed on a reimbursement basis once the activity is done and paid in full. - Automation and digitalisation is one area. Most AI projects will sit there, alongside business strategy and innovation. Decide this week which side of the date your project files on.

Your integration layer decides what AI you can deploy, not your model choice. IDC surveyed 358 IT managers and leaders in January and found that just 7.8% have reached a fully optimised architecture. The largest group, 36.6%, sits at the point to point stage, and 13.8% are at the lowest stage of all. IDC scores maturity across strategy, people and technology. - Point to point is a ceiling. Every new tool means another bespoke connection, and the count grows faster than the tool list. - Strategy and technology come first. IDC found the strongest performers invest there before people and skills. - Maturity is measurable. Score yourself on the three dimensions before you buy anything that needs to read your data. - Most of the field is behind. Being average here means you cannot yet support the automation you are being sold. Fix the plumbing while the pitch decks are still arriving.

Both failures happen on ordinary project days, not during a cyber attack. The PDPC has published an advisory drawn from its own investigation findings, and it names two common lapses behind recent breaches. The first is migration. The second is detection. Section 24 of the PDPA already requires reasonable security arrangements for personal data in your possession or under your control. - Migrations break quietly. A mismatch between old and new fields can post statements to the wrong customers. - Test environments leak. PDPC asks you to keep them offline and to check no credentials or personal data are left behind. - Run VAPT before go live. Vulnerability assessment and penetration testing belongs before launch and after any change. - Nobody watches the database. Without alerts on bulk downloads, a breach using stolen credentials can run for months. Both lapses are cheap to close and expensive to discover later.

Four items this week, and three of them arrive with a date. The week ran from help you can book today, through a deadline you cannot avoid, to where the returns and the costs actually sit. - Free help with a real name. National programmes are funding phishing simulations and tabletop exercises for SMEs, in a year when most organisations reported an incident. - A deadline with your name on it. Invoice data has to reach the tax authority through a network, and your phase depends on the size of your supplies. - A map of where returns land. Productivity gains concentrate in structured work with countable output and thin out where judgement dominates. - A price that expires. One frontier model's introductory rate ends at the turn of the year, and its strongest security variant is not for sale at any price. Book the free exercise first. It is the only one that closes this quarter.

Two things moved this month. One is a price, one is a gate. Google released Gemini 3.8 Flash on 2 September at $0.75 per million input tokens and $3.75 per million output tokens, an introductory rate that expires on 31 December 2026 and rises to $1.50 and $7.50 the next day. The stronger variant, Gemini 3.8 Flash Cyber, is released only to trusted defenders through the new Fairwind Program. - Budget the step up now. The 2027 rate is double today's, so any forecast built on current pricing understates next year. - Capability is rationed by role. Fairwind prioritises government authorities, critical infrastructure operators and software maintainers. - The gap is measurable. Google reports its Chrome team getting 2.6 times more correct patches from the cyber variant than from much larger commercial models. - There is a reason for the gate. Anthropic's September threat report describes AI closing the gap between lone operators and state backed teams. Check which model your vendor actually calls, then check what it costs in January.