Weeknote #41-43: Slow down

Acharn, Loch Tay.

A condensed post following a much-needed 10-day break. This involved hanging out with the kids at home, taking things deliberately slowly and escaping northwards to the shores of Loch Tay.

Writing weeknotes through this year have been an effort to work in the open. They help me reflect on what happening in my role and digest other people's writing and thinking. I'm considering changing the format to make them quicker to write and do a deeper dive into specific areas – maybe one day they will surface the same wisdom-nuggets as Matt Ballantine's Weeknote Machine.

What happened this week?

The PHP Shell incident kicked off when I was on holiday, but the team responded quickly and only a few websites were affected. Despite the media-driven hype, we're bound to follow the official guidance and there's no doubt CVE's are on the rise – see this useful graph. It's hard to unpack how AI is changing the hacking landscape, but I found this list of practical observations useful, especially the impact on IT resource:

"The IT security department is working overtime, and the budget must be increased if the department is to keep up. And yes: Paying for security is a hassle: You don't get any new features - and maybe even lose some."

It was great to host a lunchtime seminar on Thursday with Sam Illingworth presenting the thinking behind his book Slow AI, with expert chairing and facilitation from John Fitzgerald. Sam's presentation was perfectly pitched, including setting out key tests for deciding when and how to use AI:

Is the task bounded?
Is a human in the lead?
Does the thinking stay yours?

I also enjoyed John's definition of "slop grenades", the underbaked and over-polished communications from managers (this 'no AI slop' site includes a reminder to own your output before you hit send). There's been some positive feedback and it could be the start of a regular series from the Library exploring literacies and critical thinking.

We continue to assess where we are with AI as an organisation, taking some time to pause for reflection and surface gaps around resources, governance and communications. The Careful Industries playbook for using AI voice transcription landed at just the right time as we ponder deploying similar tools. Sam Illingworth also provided a warning on the real-world risks of using AI tools to feed decision-making around asylum interviews.

This week I also had a catch up with the Scottish Cyber Coordination Centre (SC3) on cyber support. It was a helpful discussion as we assess detection and monitoring set-ups, response retainers and options around cyber insurance.

Collaborative decision-making is proving tricky at the moment between teams who are short of time and head space. Ash Mann's piece on who decides and how was a helpful reminder to name the type of decision and the role you want people to play.

AI in the cultural sector

Multiple reports and surveys are circulating on attitudes to AI in the cultural sector:

The 2026 Library Futures Survey Results surfaces points of tension and Jane Friedman sets out why Librarians are the canaries in the coalmine.
Jocelyn Burnham has produce a useful summary of the UNESCO Report on the use of AI in Museums, alongside tracking how attitudes are shifting in her briefing, 'What 400 cultural workers have told me about AI'.
OneFurther have also published a round up of AI surveys in the culture sector.
The Creative Industries have launched an Ethical AI Charter, with some big hitters involved.
Lessons from three years of the FutureScot AI Challenge – The Library was a finalist in the inaugural year and there are consistent use cases and opportunities being surfaced.

Interesting things

Jeff Steward outlines the first set of major updates to the Harvard Art Museums AI website.
Edinburgh Council have reported AI-generated complaints are piling pressure on staff, and the London Archives have created a guide to instruct AI Assistants and Agents.
Robert Kenny, Lead engineer at Wellcome Collection, on keeping digital collections open in the face of large-scale bot crawling – "We want the route built for machines to stay open and separate from the pages built for people."
An updated Definition of Legacy IT from the Government Digital Service, centred on burden or risk rather than age, hosting model or technology type.
I'm sorry, but you can't build a culture – TL;DR shifting organisational culture takes time and effort across multiple fronts (h/t Ash Mann).
The British Library's plans to create co-working space from existing reading rooms sparked a lot of feedback.