Daily AI brief · May 5, 2026
Microsoft's Agent 365 Now Live, Power Apps MCP Ships Today
OpenAI's GPT-5.5 rolls out to Business/Enterprise, Microsoft's Agent 365 and Power Apps MCP Server go GA, Colorado's AI law looms 56 days out, and open-weight models from China hit frontier quality at a third of the cost — a lot moved this week.
1. OpenAI GPT-5.5 Goes Live for Business & Enterprise — With Tighter Cyber Controls *(OpenAI / Releasebot)*
GPT-5.5 is now rolling out to Plus, Pro, Business, and Enterprise users in ChatGPT and Codex; GPT-5.5 Pro is available to Pro, Business, and Enterprise tiers.
The headline capability gain is agentic:
GPT-5.5 shipped with major gains in agentic coding, computer use, and knowledge work.
On the security side,
OpenAI designed tighter controls around higher-risk activity, sensitive cyber requests, and added protections for repeated misuse
— and
individual members of Trusted Access for Cyber accessing the most capable models will be required to enable Advanced Account Security beginning June 1, 2026.
What it means for SMBs / MSPs: If your clients are on Business or Enterprise SKUs, GPT-5.5 access is live today — run a fast internal evaluation on your most time-consuming agentic workflow before recommending an upgrade.
2. Microsoft Agent 365 and Power Apps MCP Server Are Now Generally Available *(Microsoft / LevelUpM365)*
Microsoft 365 E7 brings together Microsoft 365 E5, Microsoft Entra Suite, Microsoft 365 Copilot, and Microsoft Agent 365 as the control plane to govern and scale agents.
On the app side,
the Agent feed with Power Apps MCP Server became generally available on May 4, 2026, giving users a dedicated experience to supervise agent activity directly inside their business apps.
For SharePoint specifically,
AI in SharePoint can now generate code to translate intent into reliable workflows, and automated document generation from SharePoint forms is live via new Power Automate actions.
What it means for SMBs / MSPs: Agent 365 is now the official IT control plane for governing every agent your clients deploy — if you're selling Copilot, you now have a concrete governance story to lead with. Start positioning the M365 E7 upgrade conversation now.
3. Colorado AI Act Compliance Deadline: 56 Days Out *(Wilson Sonsini / OST Agency)*
On June 30, 2026, Colorado's Senate Bill 24-205 takes effect — the first comprehensive state-level AI law in the U.S. If your business develops or deploys a "high-risk AI system" influencing consequential decisions about Colorado consumers (employment, housing, credit, healthcare, education, insurance), you are covered. Violations carry penalties of up to $20,000 each, enforced by the Colorado Attorney General.
The exposure path most businesses miss:
your SaaS vendor integrates an AI model, your HR platform uses a hiring screen built by a third-party provider — your compliance automatically inherits their compliance obligations the moment their system touches your data.
What it means for SMBs / MSPs: Any client using AI-assisted hiring, lending, or insurance tools who serves Colorado customers needs a written risk assessment in hand before June 30 — that's a billable engagement today.
4. Four Chinese Open-Weight Models Hit Frontier Coding Quality at Sub-$1/M Tokens *(Air Street Press / MindStudio)*
Four Chinese labs released open-weight coding models inside a 12-day window — Z.ai's GLM-5.1, MiniMax M2.7, Moonshot's Kimi K2.6, and DeepSeek V4 — all landing at roughly the same capability ceiling on agentic engineering at meaningfully lower inference cost than the Western frontier. None costs more than a third of Claude Opus 4.7.
For local deployment,
Gemma 4 31B and Mistral Small 4 are the most practical options for local, hardware-constrained deployments.
What it means for SMBs / MSPs: If a client's AI cost is the blocker, self-hosted or API-accessed open-weight models are now a legitimate production option — not a compromise.
5. Only 1 in 10 SMBs Give Staff AI Security Training — Regulators Are Watching *(MoneySuperMarket / ResultSense)*
A survey of 250 UK sole traders and SMBs finds only 10% currently provide staff with AI security training. 44% of small business owners worry that using AI without proper safeguards exposes them to cyber threats; one in five say they would feel unprepared if targeted by a cyber-attack.
The gap is not just a UK problem:
entering client data or protected health information into a public AI tool is a compliance violation in most regulated industries.
What it means for SMBs / MSPs: A 30-minute AI acceptable use training is a fast, high-ROI deliverable — and with the Colorado deadline approaching, it doubles as compliance documentation.
Power Apps Agent Feed (Microsoft — GA as of May 4)
The agent feed in model-driven apps is generally available in May 2026. It gives business users a dedicated space to see, review, and guide agent activity as it happens — within the app, not in a separate monitoring tool. Makers control the approval threshold: low-risk actions complete quietly in the background; higher-impact actions like sending emails surface as explicit approvals.
- Who it's for: MSP techs and AI champions who already have clients on Power Apps / Dynamics 365
- How long a first test takes: 30–45 minutes to configure a model-driven app and watch an existing agent run through the feed
- First step: Open your sandbox Power Apps environment → go to the model-driven app → enable Agent Feed under Settings → run a test Copilot Studio agent and observe the approval queue in real time
Hold a 30-minute AI acceptable use session with your staff this week. Only 10% of small businesses surveyed give staff AI security training, and entering client data or protected health information into a public AI tool is a compliance violation in most regulated industries. Cover which tools are approved and what never goes into them. Keep a note of who attended.
*For MSPs:* Agent 365 gives clients one place to approve, audit and shut down agents, which helps with Colorado's June 30 deadline.
Don't lead client conversations with GPT-5.5's benchmark scores. The model is real and capable, but
the model you picked three months ago may already be outdated
— and so will GPT-5.5. Selling on model version numbers trains clients to re-evaluate every six weeks. Sell on the workflow outcome and the governance layer around it instead.
The AI governance layer is becoming the real product. The simultaneous GA of Microsoft Agent 365, the Power Apps MCP Server, and Copilot's new DSPM security tooling — combined with the Colorado law deadline — signals that the market is transitioning from "deploy AI features" to "govern AI systems."
As organizations digitize more processes, their agents become more capable — and the question becomes how to keep humans in the loop at the right moments.
The MSPs and AI champions who build a repeatable AI governance audit practice right now — policy template, access control review, agent inventory — will be significantly ahead when clients inevitably ask "are we compliant?" Watch for this to be the default opening question in every new AI conversation by Q3.