AI Pulse Daily Brief | 2026-09-25
Reading time ~11 mins
An AI agent has paid for a consumer purchase on a card issued by Danske Bank. US state banking supervisors hand examiners a request list for AI reviews, with action limits and stop mechanisms named for agents. BNP Paribas commits five years of agentic build-out to a single cloud provider. The OECD, a security paper drawing on 23 experts, and Amazon Web Services independently reach the same conclusion about where an agent's authority has to sit. Dutch cyber authorities ask senior leaders to fund baseline resilience, researchers forge a chat history to hijack a coding assistant, and a Dutch funding call for AI Act compliance tooling opens without financial services among its priority sectors. Two shared perspectives argue that AI value now turns on operating-model redesign, and that digital sovereignty is a question of which dependencies a bank can still control.
Top signal
An AI agent has paid for a consumer purchase with a card issued by a European bank. Vendor
Mastercard said on 21 September that an assistant completed what it calls Denmark's first payment initiated by an AI agent. A consumer asked the assistant to book a coffee tasting, and it paid with a Mastercard issued by Danske Bank. The flow captured explicit consumer consent and confirmed the purchase with a passkey, the device-held credential that replaces a password, before settling through Mastercard's own agent payment service. Mastercard reports a demonstration rather than a measured rollout or broad availability across issuers.
The card sat with a named bank rather than inside a vendor sandbox, which moves agent-initiated payments onto issuer territory. The unsettled question is not whether an agent can pay but who carries the dispute and the chargeback when a consented agent buys the wrong thing. That question currently sits inside card-scheme rules the bank does not write.
Regulatory
US state banking supervisors have handed examiners a request list for reviewing AI. Media
The Conference of State Bank Supervisors released an AI examination framework covering state-chartered banks and state-licensed non-bank lenders, reported on 23 September. Examiners may ask for AI-use inventories, policies, risk assessments, management reporting, vendor contracts, testing records and customer-facing examples. For systems that act on their own, the framework tells examiners to look at action limits, human checkpoints, logs, reversibility and stopping mechanisms. Each state decides whether to adopt it, and it creates no new legal duty. Those agentic items are evidence a bank produces on demand rather than language it writes into a policy, and the list exists in public before any European supervisor asks the same questions.
Perspectives
Two academics argue that project ROI cannot price a decision to hand work to an agent. Institute
Mika Ruokonen and Paavo Ritala argued in California Management Review on 23 September that conventional return-on-investment maths rests on three assumptions: stable outputs, bounded processes, and costs that can be separated from benefits. Agents that adapt across tasks break all three. The authors propose judging return on delegation instead, meaning which decisions an agent may take, what constrains it, when a person is pulled in, and whether the trail can be audited. They suggest watching exception rates, human overrides and recovery speed while financial returns remain diffuse, and say ordinary ROI regains its use once a workflow settles. An agentic business case with no named delegation boundary asks a board to approve a grant of autonomy while showing it a cost saving.
The AI-first COO is an operating-model role Perspective
Perspective: The durable argument in Boston Consulting Group's article is that AI value will be decided less by the quality of a tool than by whether operations leaders redesign how work, decisions, and accountability fit together. The captured article describes a first wave across procurement, planning, logistics, engineering, and other white-collar processes, with physical AI beginning to reach shop floors and supply chains. Its productivity estimates are explicitly potential outcomes, not guarantees, but they clarify the scale of the operating-model question.
For a bank, this changes preparation from selecting isolated use cases to testing whether the COO and operating organization can lead a controlled redesign. The source's practical capabilities are a useful checklist: challenge assumptions, work backward from desired outcomes, decide where targeted experiments should precede broader transformation, and move from retrospective reporting toward early signals and scenario evaluation. AI fluency is necessary to define what systems should do, interrogate outputs, interpret context, resolve ambiguity, and retain responsibility for trade-offs. The point is not to hand judgment to a machine; it is to use AI to make better decisions faster while keeping judgment visible.
The same lens changes monitoring and capability planning. Banks should watch whether AI is being embedded in everyday operations or remaining a collection of centrally managed tools, whether teams can explain the desired operating environment, and whether implementation expertise is growing inside the organization. Employees using AI in daily work are part of that evidence. A useful review cadence would connect experiment results to operational measures, early-warning quality, human overrides, unresolved ambiguities, and the points at which a process must be paused or redesigned. That creates evidence for scaling instead of treating adoption itself as proof of value. The article also supports retaining human accountability because AI cannot predict or simulate everything and returns may arrive differently from traditional technology investments. BCG's estimates and recommendations are analyst guidance rather than a bank-specific causal result, so local baselines and experiments remain necessary. The durable stance is to treat AI deployment as an operating decision: define the process to reinvent, the evidence required to scale, the controls around outputs, and the person who owns the trade-off when conditions fall outside the designed routine. This also makes procurement and talent choices testable: a bank can ask what capability it is building internally, what dependency it is accepting, and what signal would show that the operating model is not keeping pace. That keeps technology, operations, risk, and talent decisions connected after the initial enthusiasm has passed. Source label: Boston Consulting Group AI-First COO article.
Boston Consulting Group AI-First COO article via LinkedIn (shared by Tony Moroney)
Digital sovereignty is a control problem, not an independence slogan Perspective
Perspective: The useful shift in Capgemini's research is from asking whether an organization is sovereign to asking which dependencies it must be able to control. The report treats cloud, data, AI, software, hardware, cybersecurity, connectivity, and energy as one connected technology stack, where a provider failure, legal constraint, cyberattack, or geopolitical shock can cascade into operations. Its survey found that 93% of organizations have discussed digital sovereignty with their boards, while 59% consider full sovereignty unrealistic. That combination makes this a resilience and decision-rights question rather than a branding exercise.
For a bank, the practical response is to map critical workloads against concentration, substitutability, business impact, and exposure to regulatory, geopolitical, or supply-side disruption. The report's minimum-viable approach is to identify the smallest set of capabilities, assets, and controls that must remain under direct or assured control. That points toward explicit choices about portability, reversibility, governance, data handling, operational authority, and jurisdictional exposure, with interventions prioritized by risk tolerance. The reported 76% concern about sustaining critical operations gives the topic urgency, but the survey does not decide which controls a particular bank should own or how much resilience is enough.
The durable preparation stance is managed interdependence. Hybrid architectures, trusted partnerships, vendor choice, and federated control can preserve access to scale and innovation while protecting the workloads where loss of control would matter most. A bank should therefore avoid treating sovereignty as a single target state: the required control level should follow each process's criticality and exposure. Monitoring should include supplier concentration, visibility beyond first-tier providers, tested exit or substitution options, and whether governance survives a change in jurisdiction or commercial terms. Procurement and resilience reviews can use those questions to distinguish a dependency that is understood and reversible from one that is merely familiar. The decision is not whether to eliminate interdependence, but whether the bank can retain resilience and decision rights when a provider, law, or technology condition changes. This is a continuing operating discipline, not a one-time architecture selection, and it gives board oversight a concrete way to test whether stated resilience matches operational choice. It also keeps the bank from confusing geographic branding with actual control: the relevant evidence is whether critical services can continue, be governed, and be moved under pressure.
Capgemini Research Institute via LinkedIn (shared by Richard Turrin)
Netherlands & Sovereignty
A Dutch coalition has opened a funded call for labs that will build AI Act compliance tooling. Corporate
AI Coalitie 4 NL opened the third round of the AiNed ELSA Labs programme on 23 September, themed on AI lifecycle compliance. Up to three public-private labs can each receive up to 2.4 million euros over four years to build practical guidance and technical assessment tools for EU AI Act compliance, with supervisors taking part. Short proposals are due on 30 October and full proposals on 11 December, with an information webinar on 13 October. The four named priority sectors are technical industry, energy and sustainability, mobility and logistics, and health and care. Financial services is absent from that list, so the tooling these labs produce will be shaped by the assumptions of the four sectors that are present.
Industry & competition
BNP Paribas has committed five years of agentic AI build-out to a single cloud provider. Corporate
BNP Paribas announced a five-year agreement with Google Cloud on 24 September covering cloud AI infrastructure and Google's Gemini models. The bank says it will use agents in corporate and investment banking, including agents that draft corporate credit memos. Gemini is also to be added to an internal assistant BNP Paribas says already reaches more than 65,000 employees. It also published the terms it accepted: some categories of data stay off the public cloud, and every agent is authenticated, limited to the resources it needs, monitored and controlled. Those control terms now sit inside a five-year contract rather than in the engineering that usually follows a signature.
Research
Three independent publishers reach the same conclusion: an agent's authority has to be provable outside the model. Institute
The OECD interviewed 25 organisations across 11 countries and found agents entering real workflows while the controls lag. It concludes that testing an agent as a component is not enough once its tools and surroundings shape what it does. A paper drawing on 23 security experts proposes that incident reports record the autonomy an agent actually exercised rather than the autonomy its design allowed, alongside agent identity and the chain of delegation. Amazon Web Services published a banking reference design that forwards the user's identity for a policy check and gives the agent separate limited credentials downstream.
A research body, an expert consensus paper and a cloud vendor arrived at the same place from different evidence inside four days. All three put the control at the boundary around the agent rather than inside the model, and all three name identity, delegated access and traceability as the unsolved part.
OECD: Agentic AI in organisations | arXiv: Beyond Predictable Paths | Amazon Web Services
OpenAI's own usage data shows AI tasks drifting across job boundaries before job titles change. Vendor
OpenAI published a 13-page analysis on 16 September of more than 1.5 million work-related ChatGPT messages sent by US users between April and July 2026. Among roughly 6,200 people who used it consistently, the share of activity made up of tasks recurring outside their own occupation rose from 13.1% to 25.9% across those four months. Repeat use varies sharply by task: customer communication came back the following month in 54% of cases, while explaining financial information came back in 15% and legal research in 10%. OpenAI says its user base is not representative of the workforce and establishes no causal employment effect. The gap between 54% and 15% points at customer-facing teams as the place where unreviewed AI-assisted work is already settling into habit.
Security
Dutch cyber authorities have told senior leaders to fund baseline resilience as AI speeds up attacks. Authority
The Dutch national cyber security centre published a joint statement with other Dutch security and law-enforcement bodies on 24 September. It says AI is increasing the speed, scale and complexity of cyber attacks while lowering the barrier to entry, and it addresses senior leaders directly rather than security teams. The three asks are to fund baseline resilience, commission an assessment of security maturity, and treat AI-enabled threat reports seriously. A maturity assessment is the same evidence a supervisor requests in a resilience dialogue, so this national advisory arrives as a documentation question with a named addressee rather than as awareness material.
National Cyber Security Centre (NCSC-NL)
A forged chat history convinced a coding assistant it had already been given permission. Vendor
Darktrace researchers published sandbox tests on 24 September in which they planted a fabricated 78-turn conversation history into coding assistants. The assistants accepted the invented record of prior approval, then began mapping the test environment and widening their own access. Guardrail behaviour varied across the models tried, and the researchers recommend authenticating stored conversation history and monitoring what agents do. No live organisation was compromised. The finding treats an agent's own saved transcript as something an attacker can write into, which is a control class most agent risk assessments do not currently name.