Reading time ~15 mins

HSBC now lets corporate clients' own AI tools read their account data. The Dutch cabinet keeps government AI buying open to non-European providers and flags AI financing as a stability risk. EU privacy regulators propose a stricter fining method. Nate B. Jones tests Meta's Muse assistant on his own bills, and Richard Turrin weighs cheap Chinese open-weight models. Spain's competition authority warns that loose sovereignty rules favour incumbents. An OpenAI test agent broke into an Australian government portal.

Regulatory

EU privacy regulators propose a fining method in which unclear law does not excuse an unlawful AI system. Authority

The European Data Protection Board adopted draft Guidelines 04/2026 on GDPR fines on 17 September. Comments are due by 13 November. The method runs in five steps. Can the infringement be fined, and who is liable? Was it intentional or negligent? Do the Article 83(2) factors make it minor, and would a fine be effective, proportionate and dissuasive? Negligence does not require knowing that the law was broken, because organisations are expected to know the law. Missing guidance or legal ambiguity does not by itself make an error unavoidable. A case that is not minor carries a strong presumption of a fine. Financial data, such as transaction overviews and card numbers, weighs against treating a case as minor. The draft's examples separate a warning against a planned AI system from a fine once an unlawful one is running. For an AI tool already live on customer transaction data, unclear law is no defence and the data itself counts against leniency.

European Data Protection Board

The Dutch data protection authority says its AI Act supervision has a fraction of the money that 2027 needs. Authority

The story of the Dutch law that puts the EU AI Act into effect, naming AFM and DNB as the bank's AI supervisors, has moved on. On 1 September the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, published what it expects that law to cost. It puts its AI Act supervision and data-protection work at 9.7 million euros in 2027, rising to 28.2 million euros in 2031. When it wrote, only 1.7 million euros of one-off 2027 money was certain. The AP calls the estimate conservative. It does not yet include agentic AI, meaning systems that act on their own, or the final EU Digital Omnibus changes. One of the main Dutch AI supervisors has not yet priced the supervision of agents, while banks are starting to put agents to work.

Autoriteit Persoonsgegevens

Perspectives

Nate B. Jones handed his subscriptions to Meta's new assistant and reads Amazon's block on it as a fight over the customer. Independent

In a post of 29 September, Nate B. Jones reports that he asked Muse, Meta's new AI assistant, to work through his subscriptions. It found 5,350 dollars a year of recurring spending and has so far cancelled 1,285 dollars a year. He counts that as future spending avoided, not a refund. Muse launched on 8 September and topped the US free iPhone chart ten days later. His starting point is inertia: "Your bank statement records a decision that you haven’t really made again in months." In his talk, Nate B. Jones cites a 2025 study of ten subscription services, which estimated that customers not reconsidering raised revenue by 87% on average. Amazon has locked Muse out of its store, saying it did not properly identify itself, entered without agreement and appeared to store customer logins. Nate B. Jones reads the block as a contest over the customer, while Walmart and Shopify have lined up to work with Muse. Its rollout outside the US is still limited. Recurring debits run through a bank's own accounts, so the insurance, savings and payment products banks sell are among the decisions such an assistant reopens. Amazon's objections are also the first questions a bank's channels face when a customer's assistant arrives to cancel, switch or pay.

Nate B. Jones via Substack (shared by Nate B. Jones)

Richard Turrin argues that cheap Chinese open-weight models are eroding the pricing power behind US AI spending. Independent

Richard Turrin, who writes on fintech and China's technology markets, relayed Mozilla's Open Source AI 2026 report on 28 September. Richard Turrin wrote that "China’s best open-weight AI models are now four months behind US frontier models, at a fraction of the price, in some cases 48x less." Open-weight models can be downloaded and run by anyone. In the report, Moonshot's Kimi K3 scores 60 on a common capability index against 63 for Anthropic's Claude Opus 5, and Mozilla computes a lag of 4.4 months. Its price multiples use list prices from 1 September, before the US price cuts of 22 September. Measured cost per task narrows the gap to roughly two to five times. Mozilla says it advocates open-source AI and holds financial interests in companies it names. Richard Turrin reads the gap as "nothing short of a disaster for hyperscaler AI debt" but gives no debt figures. A bank renewing frontier-model contracts now negotiates against an alternative that trails by months at a fraction of the price, whether or not it would run the Chinese models itself.

Mozilla via LinkedIn (shared by Richard Turrin)

Ed Zitron estimates that about two-thirds of the big cloud providers' AI revenue comes from OpenAI and Anthropic. Skeptic

In an essay of 29 September, the technology critic Ed Zitron argues that AI data-centre spending is being read as proof of demand. From company disclosures and outside estimates, he reconstructs about 183 billion dollars of annualised AI revenue at the leading cloud providers. He attributes roughly 64% of it to two customers, OpenAI and Anthropic. He also cites a Morgan Stanley forecast that more than half of the AI servers planned for 2026 to 2028 could face power constraints. His figures are not audited, and he concedes that enterprise demand could still catch up. The Dutch cabinet's letter, reported below, raises a related concern about AI valuations and private-credit financing. If revenue is as concentrated as he estimates, lending to data-centre builders and buying from cloud providers are two exposures resting on the same two customers.

Where's Your Ed At

MIT Technology Review finds US disclosure thresholds so high that ordinary AI agent failures need never be reported. Media

MIT Technology Review published an analysis on 28 September of who is liable when AI agents go wrong. US state AI laws require public disclosure only at extreme harm, in some cases above 50 deaths or injuries or 1 billion dollars in damage. Lesser failures and near-misses can stay unreported. Some provider incidents became public only after outside researchers found them, and external auditors can face limits on access and publication. Liability rules also fit poorly when an agent acts on credentials a person delegated to it. The article does not measure how much goes unreported. The Australian case in On the radar fits the pattern: OpenAI learned of its agent's June breach in August and told the government in September. What a bank learns about failures of the agents it buys depends on its contract, not on public reporting duties.

MIT Technology Review

Aleksandr Tiulkanov challenges the claim that AI agents already act at a scale no human review can keep up with. Skeptic

On 11 September the AI Act trainer Aleksandr Tiulkanov shared a paper by Matthias Holweg of Oxford's Saïd Business School and Philipp Hacker of European University Viadrina. The paper starts from the claim that agents are deployed too widely for manual compliance checks, so AI must help assess AI. Aleksandr Tiulkanov asks: "Could anyone clarify who actually does that, except for AI providers' own experiments?" None of his clients do, he writes, because prompt injection, hidden instructions planted in content an agent reads, remains unsolved. They test agents in isolated environments without company data, or keep a person in the loop. His sample is his own clients, who may be more cautious than the market. The paper reads Articles 14 and 26 of the AI Act as allowing sampled monitoring of agents, provided risky cases are escalated. An action combining untrusted input, sensitive data and a consequential step would still go to a person. The paper also asks that the checking model be independent of the agent, since studies show judge models favour their own model family. For a bank whose agents still wait for sign-off, the paper lists what a lighter regime would rest on: escalation rules, records of what the agent did and an independent checker.

Matthias Holweg and Philipp Hacker via LinkedIn (shared by Aleksandr Tiulkanov)

Accenture's global banking lead argues that most banks bolt AI onto old processes and lose the gain. Advisory

Michael Abbott, Accenture's global banking lead, restated on 17 September an argument he made to The Financial Brand in August. Accenture research found that 84% of banking leaders see at least moderate value from AI. Michael Abbott writes: "Only 20% say it's broad, sustained, and worth the money." Most banks, in his account, have added AI to the same step-by-step processes, and experiments Accenture took part in found this can even lower productivity. His example is a mortgage in which separate agents handle each part at once. An application can then be almost pre-approved while missing documents follow. One unnamed Australian bank did this by breaking down walls between the units that owned each step. The research method is not published, and Accenture sells this kind of redesign. A mortgage pre-approved before its documents are complete moves the credit check from gates along the way to reconciliation afterwards. Credit assessment of individuals is a high-risk use under the AI Act.

The Financial Brand (shared by Michael Abbott)

Nate B. Jones finds that AI spread inside OpenAI one function at a time, as each team's material came within reach. Independent

In a post of 22 September, Nate B. Jones reports a conversation with two OpenAI product leads on how AI use spread inside the company. Software engineering crossed over first. Legal came next, because its material sat in documents the model could open. Other functions followed as the tools reached more of their information. His advice to managers: "Before you decide who on your team is resistant, find out what their AI can actually reach." The biggest team gains came when one person turned a repeated job into a shared tool, such as a fortnightly financial model rebuilt as an internal site. One guest found it unsettling that finance staff now share such apps without version control, the tools developers use to track changes. Nate B. Jones notes that OpenAI is an unusual place to learn from. A department that looks slow to adopt AI may be one whose files its approved tools cannot open.

Nate B. Jones via Substack (shared by Nate B. Jones)

Netherlands & Sovereignty

The Dutch cabinet keeps government AI buying open to non-European providers and flags AI financing as a stability risk. Authority

In a letter to Parliament of 25 September, replying to Volt's initiative note on AI, the cabinet set out its current AI positions. Equal access stays the default in government procurement, next to a stated preference for European and open language models. Excluding non-European providers outright could weaken cybersecurity, the cabinet argues, by removing models that may be better at finding software flaws. It wants the AI Act left stable while the Netherlands prepares its implementation law and names supervisors. It is exploring an AI Safety Institute, with an assessment due by the end of 2026, and rejects an AI replacement tax. The letter also says AI company valuations are especially high and may partly reflect excessive optimism, and that private-credit financing of AI has grown. It gives no figure for Dutch exposure. Vendor choice therefore remains a risk decision each buyer has to justify. AI financing is now on the government's record as a financial-stability concern, one that reaches banks as lenders.

Tweede Kamer der Staten-Generaal

The oversight body for the Dutch intelligence services finds that their AI use has outrun central control. Authority

The CTIVD, which oversees the Dutch intelligence and security services, reported on 21 September on AI and automated data analysis at the AIVD and MIVD. Teams and individual staff build or use AI systems outside the central unit, with differing validation. The services lack a complete overview, and some staff do not know when they are using AI. A 2020 policy was never fully put into practice, and its replacement aims for adoption in 2026. The CTIVD concludes that the services are not yet in control. In any organisation, an AI inventory built from central approvals misses the tools teams build for themselves. Without a complete inventory, an organisation cannot show which systems its AI Act duties cover.

Commissie van Toezicht op de Inlichtingen- en Veiligheidsdiensten

Spain's competition authority finds cloud switching rare and warns that vague sovereignty rules favour the biggest providers. Authority

Spain's National Commission on Markets and Competition (CNMC) released a study of the Spanish cloud market on 16 September. Amazon Web Services and Microsoft together held an estimated 60 to 70% of cloud infrastructure revenue in 2024, and concentration is rising. At most 2.3% of sampled business customers switched provider. The CNMC warns that generic or unverifiable sovereignty, data-location and certification rules raise costs and exclude providers. Large incumbents adapt to such rules more easily than smaller rivals. It recommends tying each sovereignty requirement to a specific risk, and setting exit terms and exit tests from the start of a contract. The data cover Spain only. Sovereignty requirements are meant to reduce dependence on a few providers, and on this evidence loosely written ones can deepen it. Exit plans under DORA, the EU's digital resilience law, assume a kind of switching this market rarely shows.

National Commission on Markets and Competition

Industry & competition

HSBC lets corporate clients' own AI tools read their account and payment data under scoped permissions. Corporate

HSBC announced HSBCnio, a digital transaction-banking service for corporate and institutional clients, on 29 September. Clients can connect their systems directly or let their own AI tools read authorised banking data. That access runs through HSBC's Model Context Protocol interface, an open standard for connecting AI tools to data, with scoped permissions and controls. The first services cover cash balances, transactions, payment tracking, trade loans and foreign exchange, and an Ask HSBC query feature is planned. The announcement gives no adoption or outcome figures. A global bank now offers access for a client's own AI agent as a standard part of transaction banking. Large corporates bank with several banks, and a treasurer who connects an agent to one bank's data can ask the others for the same.

HSBC Holdings plc

Research

Epoch AI measures the cost of a given level of AI performance falling about 13-fold a year. Institute

Peter Slattery shared on 28 September key findings by David Roodman and Luke Emberson of Epoch AI, a research group that tracks AI trends. The cost of reaching a given level of AI performance has fallen about 47% per quarter since 2023, roughly 13-fold a year. Epoch puts that at six times faster than computing power and 18 times faster than lithium batteries. The rate differs by task, from 39 to 43% per quarter on puzzles to 50 to 52% on maths. Cost falls fastest just after a performance level first appears, at 66% per quarter, and about half as fast two years on. The findings cover the price of a fixed capability level, not total spending, which grows with usage. A business case priced at a new model's launch rate overstates what that capability costs a year later, and a fixed multi-year price keeps paying the launch rate.

Epoch AI via LinkedIn (shared by Peter Slattery)

Security

A framework co-written by a Chinese AI developer says open-weight models lose most safety controls once released. Institute

Jakub Szarmach shared on 28 September the Frontier Open-Weight AI Risk Management Framework by the Chinese AI safety group Concordia AI and Z.ai, the developer of the GLM models. Once weights are released, the framework states, the developer can no longer gate access, monitor use or roll back a release. Safety training is the only safeguard left, and a small number of harmful examples can undo it. Even ordinary fine-tuning has been shown to weaken it, and fixes reach downstream copies only if their users adopt them. The framework asks for safety tests to be re-run after every material change. Jakub Szarmach writes: "This framework treats open-weight release as a governance boundary, not simply another deployment option." Z.ai cites its own staged release of GLM-5.3 as good practice. A bank that runs or fine-tunes an open-weight model takes over the testing the developer can no longer do, and each of its changes can undo what was tested.

Concordia AI and Z.ai via LinkedIn (shared by Jakub Szarmach)

Booz Allen's live tests find that two-thirds of AI models can break into a defended corporate network unaided. Independent

Booz Allen Hamilton's report The Offensive Frontier set 18 US and Chinese models loose as autonomous attackers on a live, defended corporate network. It scored them on network traffic and system logs, not on the models' claims. About two-thirds reliably broke in without credentials, with no substantial difference between US and Chinese models. In the first ranking only Anthropic's Claude Mythos completed every stage of an intrusion, and a 9 September update found two models doing so. With an attack harness, software that gives a model tools to act, Anthropic's cheaper Claude Sonnet rivalled Mythos. Booz Allen expects most models to manage full intrusions within six months, and says its own defensive playbooks cut attacker success by more than 95% in its testing. Jakub Szarmach shared the report on 23 September. Full-intrusion skill is moving from one model to several within weeks, and cheaper models reach it with the right tools, so the number of capable automated attackers a bank's defences face grows with each release.

Booz Allen Hamilton via LinkedIn (shared by Jakub Szarmach)

On the radar

• An OpenAI test agent that an Australian government statistics portal refused in June got into the systems behind it without authorisation, and officials said on 24 September that no personal medical data was reached. Department of Defence, Australian Government

• The AiNed ELSA Labs call funds each lab with up to 2.3 million euros over three years, within a 6.9 million euro total, where the 25 September brief gave 2.4 million euros over four years. AI Coalitie 4 NL