Reading time ~15 mins

EU science advisers publish their frontier-AI recommendations, and Singapore's central bank finalises AI risk rules that put reliance on a single provider into the board's risk appetite. Dutch banks face overlapping AI reviews, and a planned Rotterdam AI data centre signs its first customer. Danske Bank lets every employee build agents, Standard Chartered says a quarter of its former roles are automated, and Plaid runs a transaction-history model in live credit products. Tony Moroney argues for a coherence check across mortgage agents, and OWASP's evidence-weighted list moves over-empowered agents to third.

Regulatory

The EU's AI science advisers have published their recommendations, including closer scrutiny of training methods that make models harder to monitor. Authority

Yesterday this brief reported that EU supervisors had drawn up questions for the makers of models involved in recent loss-of-control incidents, while the advisers' recommendations were still unpublished. A European Commission article of 12 October now lists them. The chair of the Scientific Panel on AI, Seán Ó hÉigeartaigh, and its vice-chair put four recommendations to Executive Vice-President Henna Virkkunen. They went to the AI Office as well, the EU body that supervises the makers of the largest models. The first is to govern the risk from internal models, those still in development or in use for testing. The second is stronger EU capacity to detect, evaluate and investigate such incidents, for example through a task force. The third is an international initiative for information sharing, common requirements for frontier AI developers and joint crisis response. The fourth is closer scrutiny of training techniques and model designs that reduce monitorability, meaning how well people can observe what a model is doing. The Commission confirms that the AI Office has already received serious-incident reports and asked the companies about their security practices, and it will now send requests that combine the panel's questions with its own. The article still names no incident, model or company, and the advice creates no new duty for a bank. The fourth point is the one that reaches banks. Some controls on AI agents work by reading the model's written reasoning to catch an unwanted action before it happens. The EU's advisers now say that newer training methods can make that reasoning harder to observe, and their advice points supervision at the model makers, not at the banks that deploy the models.

European Commission

Singapore's central bank has finalised its AI risk rules for financial firms, with board limits on reliance on a single AI provider. Authority

The Monetary Authority of Singapore (MAS), the city-state's central bank and financial supervisor, issued its final Guidelines on Artificial Intelligence Risk Management on 7 October. They take effect on 7 October 2027. Firms must meet the oversight and inventory sections, 3 and 4, from that date, and the life-cycle controls and staff capability sections, 5 and 6, by 7 October 2028. The rules cover generative AI and AI agents and apply in proportion to risk. Low-impact uses checked by people need only basic governance, such as an accountable senior manager, an approved tool list and staff training. MAS's examples include drafting customer emails, summarising meeting notes and internal chatbots that help staff find policies. For everything else MAS is specific. The board must write AI risk into its risk appetite, with measures such as the number of material AI uses that depend on a single provider. A designated control function decides what counts as AI, and the inventory must include AI inside bought software that is not sold as AI. Each use gets a materiality rating on impact, complexity and reliance, and reliance covers how much autonomy the system has. Firms stay accountable for bought AI and should test it on their own data. MAS also asks them to consider contract terms that oblige a vendor to report when it adds or updates AI, and a right to audit. For agents it lists the tools each one can reach, its guardrails, and monitoring of its reasoning and actions, the visibility the EU's advisers warn newer training methods can reduce. High-impact uses need independent validation before launch and regular tests of any kill switch, an emergency stop. A group's own framework counts only if it meets these expectations, and local management stays accountable. Tony Moroney shared the document on 7 October, listing its four headline expectations without further comment. On 1 October this brief carried Singapore's framework for AI agents, which is voluntary guidance from a different agency. These are a bank supervisor's final expectations, and they reach a European bank through any Singapore branch or subsidiary. They turn dependence on a few model providers into a number the board sets a limit on.

Monetary Authority of Singapore (Shared by Tony Moroney)

Perspectives

Tony Moroney argues that mortgage agents can each be right while the combined decision is wrong, and that lenders need a check before each step with consequences Perspective

Tony Moroney writes a newsletter on digital change in financial services. On 1 October Moroney published an essay on mortgages handled by several AI agents, prompted by a conversation with Phil Grady, cofounder of the start-up Sheaf Labs. The essay describes Sheaf's product, so part of it is a vendor's design reported by an adviser. Its starting point is the UK, where the Financial Conduct Authority used mortgages as a test case for open finance, because a mortgage decision depends on information many organisations hold over many years. Once specialist agents gather that evidence and act on it, Moroney argues, the unit of trust changes.

Moroney's example splits one mortgage across such agents. An affordability agent finds that the customer meets the lender's threshold. A product agent finds an eligible mortgage, a valuation agent values the property correctly, and a credit agent spots an adverse event in the customer's history. Each is right within its own frame, yet the action that follows may make no sense once the judgements are put together. Correct parts, Moroney argues, do not guarantee a coherent whole. Moroney cites a hypothetical from BCG in commercial lending, in which each agent's decision stays within tolerance while the pattern they add up to becomes a material risk. The governance question moves from whether each system worked to whether the overall decision still holds.

Moroney's answer is a rule called coherence before consequence. Before an automated system submits an application, runs a hard credit search, presents a recommendation or issues an offer, it should establish that the facts and judgements behind that step still agree. Sheaf's design puts a gate in front of those steps, with monitors that compare what each agent has declared. When claims contradict each other, the workflow pauses and goes to a person. Moroney keeps this apart from permissions. A secure runtime for agents answers whether an agent may do something at all. An agent can be fully authorised to submit a mortgage application, the essay notes, when the evidence behind it no longer hangs together.

The essay states its limits. Coherence is not truth, fairness, suitability or compliance, and it does not replace responsible-lending duties, model validation, human judgement or redress. Sheaf's machine-checked proofs cover only a narrow mathematical core. Moroney then widens the frame to a market where customers, brokers, lenders, valuers and credit agencies each run their own agents. Such a market may need a shared record of the facts relied on, what each agent concluded, where they disagreed and who authorised any exception, so a decision can be reconstructed and challenged. The essay reports no measured results.

On 1 October this brief carried Moroney's argument that checks placed at handoffs disappear when agents remove the handoffs. This essay says where one such check could sit again, at the step with consequences and before the agents act. Validating each agent on its own, the usual model-risk practice, would pass every part of the failure Moroney describes.

Tony Moroney via LinkedIn (By Tony Moroney)

OWASP's 2026 list of AI application risks, now weighted by incident evidence, moves over-empowered agents to third place Perspective

On 15 September this brief reported the 2026 edition of the Top 10 risks for AI applications from OWASP, the Open Worldwide Application Security Project, and noted that its ranking drew on recorded incidents. Jakub Szarmach, an AI governance practitioner who curates security frameworks, shared the full document on 6 October. It was written by OWASP's GenAI Security Project under project leads Steve Wilson and Rock Lambros, and it shows how far the evidence moved the list. Jakub Szarmach writes: "For the first time, OWASP tested practitioner judgement against thousands of real incidents." The project gathered 7,714 incidents from public vulnerability databases and an AI-harm database, and its classifiers sorted the 6,639 that carried enough detail. Jakub Szarmach writes: "Practitioner judgement still carries 75% of the final weighting, but incident data can move risks when perception and evidence diverge."

The letter from the project leads that opens the document is most useful where the vote and the record disagree. Prompt injection, hidden instructions that hijack a model, would fall out of the top ten on incident counts alone. The leads read that as a defence effect: teams fight it hard, so fewer clean attacks reach public databases, and it stays first. Misinformation runs the other way. Practitioners ranked it near the bottom and the incident record put it near the top, the widest gap in the harmful direction, so it rises from ninth to seventh. The leads explain that when a model's fluent, confident output drives a decision or a tool call, a wrong answer becomes a wrong action. The record shows this happens more often than practitioners assume.

The largest move is excessive agency, an AI system given more functions, permissions or autonomy than its task needs, which climbs from sixth to third. The document says the vote and the incidents agree that agent deployments are where the damage now lands. Its controls are concrete. Authorisation is checked in the application's own code rather than left to the model, tools run with the user's own permissions, and only reversible actions go through automatically. Its example is a service chatbot that may issue a refund as store credit on its own, while an external payout waits for a person. Cost exhaustion climbs four places to sixth. Reasoning steps, agent loops and tool calls can run up spending without any single request tripping a rate limit, so the document asks for hard spending caps and circuit breakers that stop an agent.

Szarmach stresses a boundary. Jakub Szarmach writes: "It also draws an important boundary: once the model becomes an actor with tools, memory and downstream consequences, teams should pair this list with the OWASP Agentic Top 10." The leads say neither list covers that ground alone. The list remains a consensus product. Three quarters of the weight is still a vote, and one year of incidents sorted by OWASP's own classifiers does not measure how often each failure occurs. Its store-credit example still draws the line OWASP now ranks third for an agent in a customer or payment process: whether it may act alone depends on whether the action can be undone.

OWASP GenAI Security Project via LinkedIn (By Jakub Szarmach)

Netherlands & Sovereignty

Dutch banks accept the AI Act's principles but say one model can face overlapping reviews by three supervisors, a study finds. Media

Bright, a Dutch technology news site, reported on 11 October on a study by Ace Company, an AI firm, based on conversations with Dutch banks including ING, Rabobank, ABN AMRO and ASN Bank. The banks do not object to AI rules, and the AI Act's principles, such as transparency and human oversight, match what they already consider important. The friction comes when several laws apply to one model at once. A consumer-credit model must meet existing banking supervision rules, the AI Act, the GDPR and DORA, the EU's rules on digital operational resilience. DNB, the AFM and the Autoriteit Persoonsgegevens, the Dutch data protection authority, each examine it from a different angle. Banks therefore go through several partly overlapping checks before the model can be used. Ace argues for closer alignment between laws and supervisors, so that one set of documents can serve several legal duties. According to Bright, DNB acknowledges the fragmentation, is streamlining its own process, and says a broader fix needs European action. Ace is itself an AI company, and the article gives no method and no bank-by-bank answers, so the size of the problem rests on the study. Yesterday this brief reported that the data protection authority has started an AI directorate before it holds its AI Act powers. The draft Dutch law names the AFM and DNB as supervisors of banks' high-risk AI. The study's example, credit scoring, is where all four regimes already meet. Who reviews what is still being settled in that law, and DNB is changing its own process now.

Bright

A planned AI data centre in Rotterdam has its first customer, the cloud company Nebius, but no permits or financing yet. Media

BNR reported on 12 October, citing the Financieele Dagblad, that Nebius, an Amsterdam-based AI cloud company, is the first customer for a planned AI data centre on the Maasvlakte, Rotterdam's port area. The developer is Volt, a data-centre firm that shares its name with a Dutch political party. Its Han de Groot told the FD that building is only possible once there is a customer to contract. The first phase, two buildings with 200 megawatts of capacity in total, needs about 7 billion euros raised in the market, and the cabinet has not invested. Nebius can cancel the agreement if the project is delayed, and Volt hopes to obtain its permits this year. Power is to come from offshore wind farms, and the site was chosen because it lies close to where that power comes ashore. Volt wants to reserve half the capacity for Dutch and European companies. De Groot says Nebius's presence gives firms a European alternative to American cloud providers, although which customers Nebius will serve is not yet known. The report gives no contract size, hardware or opening date. On 22 September this brief carried the AI factory planned in Groningen, a research facility. Rotterdam would be commercial capacity under a European provider, which is the kind of option a bank reducing its dependence on American clouds looks for. For now it is a plan with a customer that can walk away, no permits, and 7 billion euros still to raise.

BNR Nieuwsradio

Industry & competition

Danske Bank lets every employee build AI agents in plain language, behind a test lab and an internal marketplace. Media

Ingeniøren, the Danish engineering weekly, reported on 8 October on AI City, Danske Bank's framework for building AI agents, software that carries out tasks on its own. Staff describe in plain language what an agent should do, and the system guides them through the build without coding. Most solutions on the bank's internal AI marketplace were created by employees rather than by IT. An AI Innovation Lab tests each proposal and asks for proof of value before it is shared there. Agents built this way come with the bank's security, guardrails and compliance features already in place. The platform runs on Amazon's cloud services for AI and has 50 interchangeable modules, so replacing one module centrally updates every agent that uses it. Chief AI officer Kasper Tjørntved Davidsen says the approach gives full traceability and helps the bank avoid shadow AI, unapproved tools staff use on their own. At a June hackathon with 700 staff, a customer adviser with no programming experience built five agents in two days. Davidsen estimates that the bank's Agent Developer Kit makes deployment ten times faster than building from scratch. Danske expects AI and other technologies to add about 2 billion Danish kroner, roughly 270 million euros, by 2028. It will raise yearly spending on technology, AI platforms and consultants from about 4 billion to 4.5 billion kroner. These are management targets, and the article gives no count of agents in production. A Nordic peer has chosen to let staff outside IT build agents, and keeps control through one test gate and shared modules rather than through limits on who may build.

Ingeniøren

Standard Chartered's chief executive says almost a quarter of its former roles are automated while its headcount rose. CxO voice

Bill Winters, group chief executive of Standard Chartered, told Singapore broadcaster CNA on 9 October that the bank has automated almost 25% of the roles it previously had, while its overall headcount has increased. Speaking at the Milken Institute Asia Summit, Winters said about 85% of employees whose roles were displaced by automation have been reskilled into other positions, and that the bank will keep investing in reskilling. Winters said roles that need human judgement or contact with people would remain important. Winters also called for stronger AI regulation and international cooperation, saying few industries have needed regulation more, and warned that criminals could use AI to break into security systems. The figures come from an interview. Winters gave no period and no definition of a role, so the 25% may include years of ordinary process automation, not only recent AI. Few bank chief executives put numbers on what automation has done to their workforce. Winters gives two, the share of roles automated and the share of displaced staff moved into new jobs, and presents success as automation without a smaller workforce. That puts a large peer's yardstick in public, one that boards and employee representatives at other banks can set against their own plans.

CNA

Innovation

Plaid now runs a model trained on transaction histories inside its live US credit and payment-risk products. Vendor

Plaid, the US firm that connects bank accounts to financial apps, said on 6 October that its sequential foundation model now runs inside three live products. A foundation model is a large AI model trained on broad data and then adapted to many tasks. Plaid's reads the order, timing and pattern of a person's transactions, instead of a summary of features that analysts define by hand. The products are LendScore Arc, a credit risk score, Signal, which predicts whether a bank transfer will bounce, and Cash Advance Index, which scores repayment risk on short-term cash advances. Existing users need no integration change. In early tests, Plaid reports 20% more approvals of subprime borrowers in LendScore Arc, 26% more risky payment value caught by Signal while declining 1% of payments, and 10% fewer dollars lost on cash advances. Plaid also addresses the usual objection to such models, that their scores are hard to explain. It traces each score back to the transactions that pushed it towards a decline, using a method called integrated gradients. It then turns them into ranked reason codes a lender can put in a rejection letter. These are the vendor's own results without published methods, and Plaid's data from many institutions may explain part of the gain. The post gives no pricing and no availability outside the US. Credit scoring of individuals is high-risk under the EU AI Act, and a lender must be able to tell a declined applicant why. Plaid's reason codes are its answer for this kind of model, described so far only by Plaid itself.

Plaid

On the radar

• Reuters reported on 8 October that CrowdStrike, with moderate confidence, links attacks on at least nine South Korean banks, one exposing about 25,000 Shinhan Bank customers, to a China-based attacker using an AI hacking agent and Anthropic's Claude Code. Reuters