gshc2020.com

Now that last Friday's deadline passed without any formal offers, the Blues have told Fernandez's camp that the player is not for sale in this transfer window.

But, as last summer's Isak saga showed, it is rarely that simple. The Sweden striker finally clinched his British record transfer move to Liverpool on transfer deadline day after weeks of Newcastle United insisting he was not for sale.

Twelve months on, the Fernandez uncertainty is not going away.

Manchester City, managed by Fernandez's former Chelsea boss Enzo Maresca, are still keen to sign the 25-year-old and believe the London club still want to do a deal.

City, who are also in advanced talks about a £85m deal for Morocco midfielder Ayyoub Bouaddi, want to bolster their midfield after Rodri agreed a move to Barcelona and Bernardo Silva left when his contract expired.

They have already signed midfielder Elliot Anderson for a club-record £116m from Nottingham Forest, winger Jeremy Monga from Leicester City for £12.5m and goalkeeper Geronimo Rulli from Marseille for £1.7m.

If Fernandez and Bouaddi join, it means Maresca will likely to have overseen a total spend of more than £330m.

A chunk of that outlay will be funded by the sales of Rodri and James Trafford as well as the likely departures of Tijjani Reijnders and Savinho. The exits of Silva, John Stones and Nathan Ake have reduced the wage bill too.

Reports from Spain suggest Chelsea remain privately open to selling Fernandez and that the club have appointed high-profile agent Jorge Mendes, who also represents winger Pedro Neto, to resolve the situation.

Fernandez tried and failed to secure a move to Real Madrid earlier in the summer - despite the club later denying any interest - and the situation is further complicated by his relationship with Chelsea's fans.

There were audible jeers when he came on in Saturday's 3-1 friendly win over Real Sociedad, although others responded with cheers. There was a similar mixed reaction every time he touched the ball.

Chelsea remain confident the midfielder can be reintegrated back into the squad and made a show of intent by giving him the captain's armband when he replaced Reece James last weekend.

However doubt remains over whether Fernandez will stay, and there is concern about the disruption such a late transfer would create, not least if new manager Xabi Alonso wanted to recruit a replacement.

There are echoes of last summer's Isak story, with Newcastle appearing to take a strong stance and rejecting an initial £110m offer despite widespread knowledge that he was training away from the club with his former side Real Sociedad.

It continued throughout the summer and only came to a conclusion when Liverpool announced the deal two-and-a-half hours after the transfer window closed.

The Magpies had already signed attacking reinforcements, bringing in Nick Woltemade from Stuttgart for a club-record fee of £69m and Yoane Wissa from Brentford for £55m. Neither signing performed as hoped though, and Newcastle endured a disappointing season.

Alonso has used a 3-4-2-1 system in pre-season and it has been successful. It largely mirrors the set-up he used when guiding Bayer Leverkusen to an historic league and cup double in 2024.

Moises Caicedo and James were the midfield pair at Stamford Bridge on Saturday, with Jordan Henderson sidelined by injury.

Romeo Lavia came off the bench, with Valentin Barco and Dario Essugo remaining unused substitutes.

Chelsea are well stocked in midfield, especially in a season without European football, and could cope in terms of numbers without signing a replacement for Fernandez if he left.

In fact, they know they need to move on a significant amount of players before the window closes.

However, earlier this summer they made a £64m bid for Bournemouth's Alex Scott and were reportedly offered Arsenal midfielder Myles Lewis-Skelly. They have also been linked with Crystal Palace's Adam Wharton and Monaco's Lamine Camara.

Bournemouth say Scott is not for sale at any price and it's also understood that Lewis-Skelly, who set up the first goal in the Community Shield win over City, is keen to remain at Arsenal.

Whether Chelsea resist City's interest and fully reintegrate Fernandez to the squad or whether they sell the midfielder is likely to be one of the themes of the final two weeks of the transfer window. %!s()

These incidents point to a larger shift: AI agents are becoming a new identity class with privileged access, but most organizations are still governing them as if they were conventional users or service accounts.​

The EU AI Act's high-risk compliance obligations, while originally set to apply on August 2, 2026, will take effect in December 2027. ​The SEC is tightening rules around AI-driven decision-making. NIST is launching new standards for autonomous agents.

Still, most CISOs today are managing three overlapping identity problems simultaneously. You're handling human identity debt with dormant accounts, over-privileged users and legacy access from years ago. You're building governance for non-human service accounts and APIs numbering in the tens of thousands, and now you're deploying AI agents into production that need access to sensitive systems with no unified framework to control them.

To stay ahead of both attackers and regulators, organizations need to understand this isn't a sequential problem.

Three Identity Layers, One Broken System​

Every enterprise now operates across three distinct identity layers. Each one expands the attack surface, and weakness in any one of them can undermine the others.

Layer 1: Human identity

This includes dormant accounts, users with permissions from five jobs ago and excessive privileged access that nobody cleaned up because the business kept moving. This problem alone has historically been a nightmare to manage at scale.

Layer 2: Non-Human Identities

The second layer includes service accounts, API credentials and container identities. These likely number in the tens of thousands across your infrastructure. Most were never formally provisioned. Only 21% of organizations report having a matured program in place to govern agents.​

Layer 3: AI Agents

These are deployed now. They operate 24/7, spawn sub-agents dynamically, request permissions thousands of times per day and can chain together actions across dozens of systems in minutes. Unlike humans or service accounts, agents don't follow predictable workflows.

The problem is that your IAM system may be treating all three as separate challenges.

The Immediate Operational Crisis

Organizations are deploying agents to summarize documents, automate workflows and assist analysts without a clear framework for controlling their access. CISOs are asking questions their tools can't answer: Which AI agents have access to production data? What's the blast radius if an agent is compromised? Did that agent's access actually expire when the project ended? Can you revoke an agent's access instantly if it starts behaving strangely?

The standard approach—forcing agents into existing IAM systems—fails because agent access control operates on fundamentally different rules. Agents request permissions differently. They operate on sub-second cycles. They don't follow human workflows, and they can exploit access faster than humans can recognize the pattern.​

I've seen this firsthand. In one financial services organization, an AI agent deployed to research vendor risk accumulated access to procurement systems, vendor databases and internal communications within a matter of months. Much of that access wasn't formally provisioned; it emerged as the agent became embedded in day-to-day workflows. By the time leaders recognized how much access it had accumulated, revoking it without disrupting operations had become a significant challenge. This is where most enterprises are right now.

What Organizations Should Do​

I recommend building separate governance frameworks for agents instead of forcing them into human-centric workflows. Implement unified visibility across all three identity types so you can see which humans, service accounts and agents have access to critical systems in a single pane, not three separate reports.

Automate remediation. When you detect excessive access, policy violations or suspicious behavior, revoke access instantly across humans, service accounts and agents alike: no ticket, no approval cycle and no delay.

Most importantly, build continuous verification. When an agent requests permission to access a database, your system should check in real time: Is this agent supposed to exist? Does it have a valid deployment? Is the permission appropriate for its use case? Should this access be revoked?

If you're a CISO managing agents in production, here's what you should do—not sequentially, but in parallel:

• Audit your agent deployments and identify your agent access "blast radius." For your highest-risk agents, trace what systems they touch.

• Build separate governance for agents. Don't try to force agent access control into your existing IAM system. Design a parallel framework that treats agents as policy-driven, time-bound and continuously monitored.

• Implement detection and instant revocation. You need the ability to detect when an agent behaves outside expected parameters and revoke access immediately, mid-workflow if necessary. This is nonnegotiable for production agents.

• Fix human and non-human layers in parallel. Don't postpone cleaning up dormant accounts, and don't let that become an excuse to delay agent governance. Both need to happen simultaneously.

What's Coming Next

Agent sprawl is likely to become the default. By 2028, an average global Fortune 500 enterprise is projected to have over 150,000 agents in use, up from less than 15 in 2025​.​

The timeline to ensure compliance is getting shorter. Although the EU AI Act's high-risk requirements were extended to December 2027, organizations shouldn't treat that as a reason to postpone preparation. Building the governance, audit logging, documentation and oversight capabilities needed to support compliance takes time, and waiting until the deadline will leave many organizations scrambling.​​

AI-powered identity attacks are scaling, and attackers are weaponizing agents for autonomous cyber espionage. The blast radius of a compromised agent makes a compromised service account look tame.

The Decision Window

The enterprises that will be secure and compliant in the near future are building agent governance right now, in parallel with human and non-human identity work. Those that wait will face compressed timelines: agents already in production, exponential growth, regulatory pressure and an evolving threat landscape.​

The agents are already in production and the compliance requirements are coming. The question is whether you'll control them intentionally or discover you needed to at 2 a.m. on a Tuesday during an incident response.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

Einride will manage the Tesla Semis through its Saga AI fleet management platform that’s designed to give customers all the benefits of using electric trucks to carry freight without the financial and logistical burdens of owning them.

The company’s CEO Roozbeh Charli said this “deployment is yet another proof point that we can execute at the scale our customers demand.”

Scale is what this deal promises, if Tesla can deliver. The carmaker first revealed a concept of the Semi in 2017, and after numerous delays due to the Covid pandemic and global supply chain shortages, delivered the first batch to customers, including PepsiCo, five years later.

And it wasn’t until April 2026 that the first Semi rolled off the high-volume production line at Tesla’s factory in Nevada. Despite that recent milestone, the company has pulled back on promises to reach “volume production” in 2026. Tesla said in its second-quarter shareholder letter and earnings call that it is trying to increase battery production, specifically around the company’s 4680 cell, in order to start building the Tesla Semi (and the Cybercab) at scale. 

Einride, which went public in June, operates a fleet of about 200 of its own heavy-duty electric trucks for companies such as Heineken and PepsiCo. It has also developed autonomous pod-like trucks, which are noticeable for their cab-less design. The Saga AI platform pulls it all together, determining how those vehicles are used, routed, and charged.

The deal with Tesla is outsized in its potential for Einride. It will triple the size of Einride’s fleet while sweetening the company’s sales pitch for its Saga AI software. Einride said the Tesla Semis will be available to customers across North America, and would help extend its electric freight network to key corridors in California, Georgia, New Jersey and Texas. Einride is using a third party to finance the purchase.

Einride also expects the purchase to help convert about $800 million in “potential long-term annual recurring revenue under joint business plans with shippers” into actual revenue.

Founded a decade ago, Einride has spent years developing the various components of its business, from its software and electric trucks to the self-driving system in its cabless trucks. The company is now pushing to scale its business, an effort that has accelerated in 2026.

Einride in April struck a deal with Amazon to add 75 of its electric heavy duty trucks to the e-commerce giant’s Relay freight network, and provide charging infrastructure across five locations in the United States. The Swedish company also acquired EV charging company Flipturn in a bid to offer customers a full package of services, including electric trucks and the charging software needed to run them more efficiently and reliably.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Kirsten Korosec is a reporter and editor who has covered the future of transportation from EVs and autonomous vehicles to urban air mobility and in-car tech for more than a decade. She is currently the transportation editor at TechCrunch and co-host of TechCrunch’s Equity podcast. She is also co-founder and co-host of the podcast, “The Autonocast.” She previously wrote for Fortune, The Verge, Bloomberg, MIT Technology Review and CBS Interactive.

You can contact or verify outreach from Kirsten by emailing [email protected] or via encrypted message at kkorosec.07 on Signal.

View Bio %!s()