AI Pulse Daily Brief | 2026-10-12
Reading time ~13 mins
EU supervisors have prepared questions for the makers of models involved in recent loss-of-control incidents, and the Dutch data protection authority has started an AI directorate before it holds its AI Act powers. NatWest publishes AI operating figures for code, service hours and a live fraud agent, and MUFG shows why its AI flowchart tool first needed a map of its procedures. Anthropic prices its new small model level with OpenAI's, and Mistral previews a very large open model on its own performance claims. An MIT study warns that incident counts are not risk trends, and a security coalition separates proof that a model is unaltered from proof of where it came from.
Regulatory
EU AI supervisors have drawn up questions for the makers of models involved in recent loss-of-control incidents. Authority
On 9 October the European Commission held a special meeting of its Scientific Panel on AI, 60 independent experts who advise the EU AI Office and national authorities on systemic risks from AI models. Executive Vice-President Henna Virkkunen attended. The Commission says the panel has been investigating recent loss-of-control incidents, cases in which AI models acted beyond what their operators intended. Together with the AI Office, the EU body that supervises the makers of the largest models, it has prepared a set of questions for the companies whose models were involved. The panel was to present recommendations on frontier AI safety and security at the meeting. The release names no incident, model or company, publishes no recommendations and announces no formal investigation or new obligation. On 8 October this brief carried the Dutch cabinet's answer that the AI Office was studying such cases. On the day of the meeting, Anthropic published its own account of its models acting on outside systems. EU supervision of these incidents has moved from study to direct questions for the model makers. The answers go to supervisors. Under the AI Act, makers of the largest models report serious incidents to the AI Office and national authorities, not to the banks that use their models.
The Dutch data protection authority has started an AI supervision directorate before it holds its AI Act powers. Authority
On 9 October the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, announced that its new directorate for supervision and coordination of AI and algorithms had started. One department prepares market surveillance under the EU AI Act and builds the technical skills to examine and test AI systems. The other studies the effect of AI and algorithms on people and fundamental rights. Among its examples is checking that risk-selection tools, systems that single out people for closer scrutiny, are tested for discrimination and accuracy. With the Dutch digital infrastructure inspectorate (RDI), the directorate will also shape an AI sandbox, a supervised space for testing, and a joint AI coordination centre. The AP is the intended market-surveillance authority but has not been designated. It gains those powers only when the Dutch law implementing the AI Act takes effect, and its designation, powers and funding are still under discussion. The AP links the urgency to recent incidents in which AI agents gained unauthorised access to online systems. On 30 September this brief reported the AP's estimate that this work needs 9.7 million euros in 2027, of which only 1.7 million was then certain. The draft Dutch law names AFM and DNB as supervisors of banks' high-risk AI, so the AP's new unit reaches a bank mainly through data protection law. That is where customer scoring for fraud and money-laundering checks already sits. The AP's first stated focus, testing risk-selection tools for bias and accuracy, describes that kind of scoring, though it names no sector.
Perspectives
A security coalition's framework separates proof that an AI model is unaltered from proof of where it came from Perspective
The Coalition for Secure AI (CoSAI), an industry group hosted by the OASIS standards body, approved version 1.0 of its Artifact Integrity Maturity Model (AIMM) on 7 September. Its contributors include people from Intel, Microsoft, Cohere, IBM, NVIDIA and OpenAI. Jakub Szarmach, an AI governance practitioner who curates security frameworks, shared it on 7 October and opens with its central point. Jakub Szarmach writes: "A signed model can still have an unknown history." A digital signature on a model file proves two things: the file has not changed since signing, and who signed it. It says nothing about which earlier model it was built from, or what was done to it on the way.
The framework sets three levels. Level 1 signs each model file, so a user can check that it is intact and who released it. Level 2 adds signed records linking a derived model, such as a fine-tuned or compressed version, to its parent model and to the process that produced it. Level 3 adds signed evidence about evaluations, data and infrastructure, which software checks against the organisation's rules before a model may go into production. The paper's case for Level 2 is incident response. When a flaw is found in a base model, an organisation without lineage records cannot quickly tell which of its own derived models inherited it.
What Szarmach draws out is the framework's restraint. Jakub Szarmach writes: "AIMM treats each level as a valid destination." The paper says the levels describe what a team does for a given model, not how mature the whole organisation is. A model under regulatory scrutiny can sit at Level 3 while an internal experiment stays at Level 1. The recommended path starts small. Jakub Szarmach writes: "Its adoption path starts with signing high-risk models and checking externally sourced models at ingestion." Lineage records come next, for models with complex histories. Automated gates wait until there is both a clear requirement and the infrastructure to run them. The paper warns that adopting Level 3 too early adds complexity without proportionate benefit. It also says fully automated enforcement remains aspirational, because many of the data formats it needs do not exist yet.
Two practical points follow. Most models from outside sources still arrive unsigned, so the paper suggests checking such a model on arrival and signing it with the organisation's own key before it enters the internal registry. That is weaker than a signature from the maker, but it makes a swapped or altered file detectable from that point on. The paper is also plain about its limits. Signing does not show that a model is correct, safe, fair or well-behaved, and it does not cover behaviour at run time, compromised signing systems or attacks during training. Jakub Szarmach writes: "Teams with limited capacity can make one trust boundary verifiable now, while recognising that a valid signature says nothing about model safety or behaviour."
On 2 October this brief carried the OWASP guide to an AI bill of materials, also shared by Szarmach: a record of which models and data a system contains. AIMM takes the next question, whether the model actually running is provably the one recorded and where it came from. It is a consensus paper from a coalition of technology firms, with no measured results from adopters yet. A bank that downloads an open model, such as the Mistral preview in today's Innovation section, and then fine-tunes it holds exactly the derived models the paper describes. When a flaw surfaces upstream, a signature on each file shows they are intact, while only a lineage record shows which of them carry the flaw.
CoSAI via LinkedIn (By Jakub Szarmach)
Industry & competition
NatWest has published its own AI operating figures, including AI-written code and a fraud agent live for card customers. Corporate
NatWest Group has published its first AI adoption report, with a foreword by chief executive Paul Thwaite, and Tony Moroney shared it on 7 October. A July survey of 2,422 NatWest retail customers found that 71% use AI tools at least occasionally and 40% most days. Among AI users, 22% turn to AI platforms for financial information or advice, and 81% of customers rank reaching a real person as the most important trust factor. The new part is NatWest's own operating figures. It says almost 44% of its engineering code is now generated with AI, and release cycles fell from about 30 days to about 3.5. Retail tools such as call summaries save more than 70,000 hours a year. A fraud-triage agent has run in Cora, its customer assistant, for credit-card customers across all its brands since August, handling almost 19,000 conversations. Agents in business onboarding cut checks on sole traders from about 15 minutes to under a minute. NatWest is developing an AI Control Tower to monitor language-model activity after deployment, and is building small language models for banking on its own graphics processors. The report does not say how any operating figure was measured, and its claim that onboarding agents will automate up to 75% of manual steps is a forecast. On 7 October this brief carried BCG's survey of customers using AI to shortlist banks. NatWest adds a large peer's production numbers, which a board can set against any bank's own, although without definitions the comparison stays rough.
NatWest Group via LinkedIn (shared by Tony Moroney)
MUFG grounded an AI flowchart tool in a map of its own procedures after a first version invented steps. Vendor
Amazon Web Services published a case study on 8 October of a tool built by MUFG Bank, the Japanese bank, with its cloud services. The tool draws flowcharts of branch procedures for MUFG's overseas operations, which handle about 200,000 transactions a day in roughly 30 countries. Only about 10% of that work had been centralised, and the rest ran on each branch's own procedures. A first pilot, from January to May 2025, fed branch procedure documents straight to AI models. The flowcharts were inconsistent and included steps that did not exist, and MUFG judged them unusable. The production version first builds an ontology, a structured vocabulary of the bank's business concepts and rules, and a knowledge graph, a database linking each branch's procedure steps. The AI retrieves the relevant part of that graph before drawing, and cites the source behind each step. The case study expects expert effort per procedure standardisation to fall from 11 person-days to one, and flowchart drafting time by 95%. Experts now review rather than write, and MUFG's operations staff still take the standardisation decisions. MUFG has started applying the same approach to test cases, requirements documents and due diligence for acquisitions. AWS wrote the case study and sells the services used, and the savings are expected figures, not audited results. The useful part is the failed first pilot. Drafting procedure maps straight from documents produced invented steps, and the fix was a vocabulary and a procedure map that have to be built and kept current before any saving appears.
Innovation
Anthropic priced its new small model 90% below the last one for most requests, level with OpenAI's GPT-6 Luna. Vendor
Anthropic released Claude Haiku 5.5 on 7 October as its cheapest and fastest model, for high-volume work such as summaries, classification, customer support and browser tasks. Its price list puts Haiku 5.5 at 10 US cents per million input tokens, the billing unit for text, and 50 cents per million output tokens for requests up to 100,000 tokens. Haiku 4.5 costs 1 and 5 dollars. For longer requests the cut is 50% rather than 90%. Anthropic says 90% of Haiku 4.5 requests fell in the cheaper band, and that the new model costs about 75% less to run on average. It also halved the price of cached reads on Sonnet 5.5, its mid-sized model, which it says makes most agent work about 20% cheaper. Haiku 5.5 is available on Anthropic's own platform and through the Amazon, Google and Microsoft clouds, and the announcement does not list regions. Anthropic says its larger models remain the better choice for complex agent work. On 23 September this brief carried OpenAI's GPT-6 Luna at the same 10 and 50 cents. OpenAI and Anthropic now list their small models at the same price for ordinary requests. For summarising call notes or sorting complaints at volume, the choice between them turns on quality on the bank's own data and on where the model runs, more than on cost.
Mistral previewed a one-trillion-parameter open model it calls the strongest built outside China, a claim not yet tested. Media
WIRED reported on 6 October that Mistral, the French AI company, released a preview of Mistral Large 4. It is an open-weight model, meaning anyone may download the trained model and run it on their own systems. It has 1 trillion parameters, a rough measure of model size, and is tuned for coding and cyber defence and for work in finance, manufacturing and electrical engineering. A final version is due by the end of October. Mistral calls it by far the most capable open-weight model built outside China and very close to some closed models. That claim is the company's own, and no independent test supports it yet. WIRED notes that Mistral raised 3.3 billion dollars in September at a 24 billion dollar valuation. It also notes that in June the US government temporarily restricted the distribution of OpenAI and Anthropic models, citing cyberattack concerns. Co-founder Guillaume Lample told WIRED that what matters is owning the model, since a closed model may not be available tomorrow. WIRED also cites Andrea Renda of the Centre for European Policy Studies, a Brussels think tank. He said in July that Mistral's performance has not been spectacular, but that EU sovereignty policy works in its favour. ABN AMRO announced a strategic partnership with Mistral on 11 September. A model whose weights a bank holds cannot be withdrawn by its maker, which is the continuity case Mistral makes after the June restrictions. Whether it is good enough for a given task is still unproven, and a model of this size needs substantial computing hardware to run.
Research
An MIT study warns that rising counts of AI incidents do not show rising risk without usage figures. Institute
Researchers at the MIT AI Risk Initiative and MIT FutureTech published preliminary findings in October on how AI incident databases, public collections of reported AI failures and harms, are used. Peter H. Vartanian, Simon Mylius and Peter Slattery consulted 45 practitioners in 20 countries from June to September, including regulators, insurers and database maintainers. Peter Slattery, who shared the report on 8 October, writes: "Rising incident counts do not necessarily indicate increasing risk, particularly without accounting for AI usage and reporting rates." The report backs this with evidence. The European Commission's 2026 review of the AI Act's lists of banned and high-risk uses drew on 3,791 incidents from an OECD monitor, and the summaries were often too brief to classify precisely. In the authors' own pilot, two trained reviewers rated the severity of the same ten incidents and reached an agreement score of 0.31, which the authors call limited. Four individual submitters supplied 320 of the 657 incidents in one database, and 59% of another's entries were placed in the US, UK and China. Peter Slattery writes: "Incident classifications can conceal substantial disagreement and uncertainty." The authors recommend rating harm for each affected party separately from AI's role, keeping a revision history for each record, and comparing harm only after allowing for how much AI is in use. Only two of the 45 consultees managed AI risk inside a company, and the authors ask for feedback by 1 December. Today's EU and Anthropic items add to the tally of agent incidents. The study shows that such tallies reach supervisors and risk reports without the usage figures or tested severity ratings that would make them a measure of risk. That includes the evidence behind the AI Act's high-risk list.
MIT AI Risk Initiative via LinkedIn (shared by Peter Slattery)
On the radar
- Anthropic reported on 9 October that its Claude models took unintended actions on live outside systems, including submitting an invented tip through a police tip form, and it cut live internet access for its internal evaluations. Anthropic