Reading time ~15 mins

Google cannot rule out that its newest model, now sold to businesses, has reached its own critical level for cyberattacks, while US polls find no rise in cyber harm to households. BBVA and Amex work on how a customer's AI agent proves what it may buy, and HSBC argues agents should move information before money. DZ BANK tests a know-your-customer agent, and EIOPA says chatbots that recommend insurance may be selling it.

Regulatory

More than 90 signers of the EU code on labelling AI content have formed two task forces to apply it. Authority

On 6 August this brief reported that about 190 organisations had signed the EU's code for marking and labelling AI-generated content, with implementation task forces due in September. A European Commission page updated on 12 October says that on 30 September more than 90 signatories set up two task forces, chaired by the AI Office, the Commission body that oversees the AI Act. The first, for providers of AI systems and detection tools, works on machine-readable marks that can be detected across providers. The second brings together deployers, the organisations that use AI systems, on the code's rules for labelling deepfakes and AI-written texts. Its agenda covers wider use of the EU icon for AI content, an audio version, a clickable second layer behind the icon, and common ways to say how AI was involved. A working group on sector practices for disclosing deepfakes and published text starts in October or November, and groups on the second layer and an audio signal follow in January 2027. Experts and stakeholders may ask the AI Office by email to take part. Signing the code is voluntary. The labelling duty it puts into practice, in Article 50 of the AI Act, can reach a bank that publishes deepfakes or AI-written text on matters of public interest. The page names no sector, so which sectors end up with a written disclosure practice depends on who takes part.

European Commission

The EU insurance supervisor says an AI chatbot that recommends insurance may count as selling it. Authority

EIOPA, the EU's insurance and pensions supervisor, published an article on 16 September on AI, digital platforms and the future of insurance distribution, written for the Eurofi policy forum. It reports that questions have reached EIOPA on whether chatbots that collect personal data, filter products or give recommendations are carrying out insurance distribution under the Insurance Distribution Directive. If they are, the firm that deploys or provides the chatbot may need to meet the directive's rules on registration, customer information and conduct. A chatbot that only gives general explanations may fall outside those rules, while one that helps a customer choose a product may fall within them. EIOPA also warns that the design of a digital journey can steer customers towards products that pay the seller more, and suggests supervision may need to follow the whole customer journey rather than single products. The article is a supervisor's view on an open question, not guidance or a rule. For a bank that sells insurance in its app, that line runs through its own assistant. On EIOPA's reading, the directive's duties begin where the assistant stops explaining and starts recommending, and they fall on the bank or on the vendor behind the chatbot.

European Insurance and Occupational Pensions Authority

Perspectives

HSBC's payments service head argues that banks should let AI agents move information before they move money. Advisory

Michael Abbott, a banking adviser, picked out on 12 October what he sees as one of the most practical AI ideas from Sibos, the banking conference held this year in Miami. He was drawing on a Fintech Times report of 7 October by Mark Walker. Melissa Tuozzolo, who runs the global service organisation for HSBC's payments business, argues that agents should exchange information between banks before they move money between them. Her first use is the 3 to 5% of payments that end up in an investigation, resolved by bank-to-bank agents over Swift's network and standards. Agent-initiated payments, where the risk is much higher, would follow only once the industry trusts that step. The article reports that HSBC began 18 months ago with basic efficiency tools that raised productivity by 10 to 15%, by HSBC's own account. It has since handed one role, payments triage, entirely to an AI agent. At a Google Cloud roundtable, BNY, BNP Paribas, Deutsche Bank and Citi described the same pattern for agents in production. Agents do the work, fixed rules check it, and people keep the judgement. The Fintech Times says its article was drafted by its AI editorial assistant and then edited. Michael Abbott writes: "Start where the risk is lower and the friction is real." Tonight's payments items show that the rules for agents that pay are still open. Tuozzolo's sequence gives payments operations a first use for agents that does not depend on those rules, because the agents move information and no money.

The Fintech Times (Shared by Michael Abbott)

Nate B. Jones asks whether AI grows more uneven as it improves, so its best results say less about the rest. Independent

In a Substack post of 13 October, Nate B. Jones, an independent AI commentator, asks whether AI could get dramatically smarter and more uneven at once, with the gaps between its abilities widening. His starting point is OpenAI's release, as he describes it, of more than 700 mathematical research manuscripts from an internal model that remains unreleased. He calls it an example of narrow superintelligence, extraordinary performance in particular kinds of work. The common inference is that a model which advances mathematics should also become a better engineer. Nate B. Jones writes: "But it makes the question urgent, because the inference from a mathematical breakthrough to broad competence is doing a great deal of work in the public story about AI." His proposed mechanism is training feedback. Where useful feedback is cheap and plentiful, each attempt teaches more, so those abilities may keep pulling ahead, and the weaker ones could improve substantially yet fall further behind. His evidence is one model that rebuilt a program of roughly 16,000 lines from its behaviour alone, yet produced an unusable result when asked to customise a library for METR, an AI evaluation group. He concedes that models are improving broadly, and says broad improvement and convergence are different claims. He would change his mind on seeing a system that notices, unprompted, when a requirement conflicts with the purpose of the project. For subscribers, his post adds why the same model succeeded at one task and failed at the other. If he is right, a model's best published result, such as tonight's Gemini scores, is a weaker guide to how it handles a bank's own work. The check he names is one a pilot can run.

Nate B. Jones (Substack)

A practitioner argues that AI labs' embedded engineers leave customers knowing the product rather than their own workflow. Corporate

In a CIO.com column published on 12 October, practitioner Praveen Jonnala takes aim at the forward-deployed engineers that OpenAI, Anthropic and Microsoft send into customer firms to build AI systems on site. He grants that they can get pilots into production. His objection is about where the learning ends up. The vendor's engineers learn the customer's workflow, while the customer learns the vendor's product, so the next use case needs the vendor again. His example is a supply-chain forecasting project whose accuracy improved by double digits without changing cash or inventory decisions. He says the lasting gains came when the company's own operators redesigned the workflow, and he proposes building a group of domain experts inside the customer who can find and scale the next use cases. It rests on his own experience. It names two costs a vendor-led pilot does not show. A project can pass on model accuracy and leave unchanged the decisions it was meant to improve, and the knowledge of how the work was rebuilt leaves with the vendor's team.

CIO.com

Netherlands & Sovereignty

Councils, a hospital and a health insurer around Groningen report longer AI-written objections that slow their handling. Media

Binnenlands Bestuur, the Dutch trade magazine for public administration, reported on 13 October that Dutch organisations are receiving more objections, complaints and information requests written with AI. They include the municipalities of Groningen, Westerkwartier and Het Hogeland, the University Medical Center Groningen and the health insurer Menzis. The account draws on regional media reports. Officials describe longer and more legalistic letters that cite irrelevant or invented legal references. Checking those references takes extra review time and in some cases delays the response. The article gives no case counts, so the scale is unknown, although several unrelated organisations in one region describe the same pattern. Menzis is the closest to a bank on the list, an insurer handling its customers' complaints rather than a public body handling objections. A bank's complaints and dispute teams also work to fixed response times, and a letter citing rules that do not exist still has to be checked and answered within them.

Binnenlands Bestuur

Industry & competition

BBVA helps design a protocol for customers' AI agents, and Amex proposes a record of what the customer approved. Corporate

Three items this week address how a customer's AI agent proves whom it acts for and what it may do, and who pays when it gets that wrong. BBVA said on 13 October that it is the first European bank to join the design of the Personal Agent Protocol. The initiative is led by Meta and by Sierra, a firm that builds AI customer-service agents. The protocol would identify an agent and the person it represents, and carry the permissions that person grants, whether the agent reaches a business through its website, its systems or another agent. Nothing is live yet. The same day TechCrunch reported that American Express has proposed an Intent Intelligence Framework. A customer's instructions and limits for a purchase are captured, then approved after the customer logs in. They become a token the agent uses to obtain a payment credential, so the card number is never exposed. Amex says it has not yet seen more disputes and is discussing the design with payment partners.

A Payments Dive analysis of 9 October explains why such a record matters. Under US consumer payment rules it is unclear who bears the loss when a customer lets software use their card but disputes whether a particular purchase stayed within that permission. The card schemes' zero-liability promises do not settle it either. The author argues that the uncertainty could push issuers to limit credential sharing, add identity checks or decline such payments. Those rules are American, and the article does not discuss EU payment law, under which a payment counts as authorised when the payer has consented to it. On 9 October this brief reported that Mastercard lists proof of intent and limits on authority in its own agent trust framework. An issuer settling a disputed agent purchase needs evidence of what the customer actually allowed, and card networks, a card issuer and a group led by Meta are each designing that evidence their own way.

BBVA | TechCrunch | Payments Dive

Ant International puts a money-back guarantee behind payments its AI agents make in error. Vendor

On 15 September this brief reported that Ant International, the Singapore-based international arm of China's Ant Group, was rolling out its Agentic Mobile Protocol with wallets and card acquirers. The protocol is its system for payments that AI agents make. Richard Turrin, a fintech commentator based in Shanghai, wrote on 1 October about a part readers have not had, AgentSafePay, a money-back guarantee on payments made through the protocol. His article says it was produced in partnership with Ant International. The guarantee targets errors specific to agents, such as a model inventing facts or an agent drifting from the customer's instructions during a multi-step task, like booking a 500-dollar hotel against a 300-dollar budget. Richard Turrin writes: "If the agent gets it wrong, the user gets their money back." Ant's own releases are less consistent. On 11 September Ant described a guarantee for merchants, and on 18 September a full guarantee against losses from misread intent or from hidden instructions planted in content. Who can claim is therefore not clear from Ant's material. Its first acquirers, the firms that process card payments for merchants, include Adyen and Worldline. While the rules on such losses remain open, a provider-funded guarantee is one answer already on offer. A promise like this can set what customers expect from agent payments before any EU rule allocates the loss.

Richard Turrin via LinkedIn (By Richard Turrin)

DZ BANK is testing an AI agent that drafts who owns a corporate customer, with a source behind every statement. Corporate

DZ BANK, the central institution of Germany's cooperative banks, published an interview on 13 October with Florian Mielke, head of its AI Office. He describes an agent the bank is testing in know-your-customer checks, the process banks use to verify who a customer is. The agent reads commercial-register extracts, shareholder lists and organisation charts, checks the information for plausibility and produces an overview of who holds a stake in whom. Every statement points to its source. Experts review the result, add what is missing and make the decision, and the more complex the case, the more they do. DZ BANK chose this step because documents go in and an ownership structure comes out, which makes the agent's reliability easy to measure. Mielke says accuracy has to reach a reliable level and stay there, and warns that adding agents to existing processes can automate their weaknesses. Go-live is planned for the coming months, and the bank gives no accuracy figure. On 23 September this brief carried Deutsche Bank putting agents into live source-of-wealth checks in Asia. DZ BANK adds a cooperative group's design for the step before any judgement, in which the agent drafts, every claim is tied to a document, and an expert decides. That division is what a supervisor can test, and the accuracy the bank requires before go-live is the part not yet public.

DZ BANK

Research

KPMG's survey of 2,131 leaders finds that firms earning returns from AI rarely depend on one model provider. Advisory

KPMG's Global AI Pulse for the third quarter, AI at scale: Accountability, resilience and economics, surveyed 2,131 senior leaders in 20 countries, the Netherlands among them, between 23 July and 26 August. Tony Moroney shared it on 6 October. KPMG compares organisations by maturity. Of the 268 still experimenting, 19% rely mainly on one global model provider and 29% on a small number. Among the 208 reporting established returns, the shares are 6% and 8%. Overall, 55% run a formal control layer between AI models and business use, rising to 86% of the established group. 61% review AI costs when approving a project, but only 12% consistently weigh value against cost across the organisation, against 48% of the established group. 72% give model sovereignty a formal role in decisions, though KPMG did not define the term for respondents. The figures are self-reported, KPMG reads quarter-to-quarter changes as direction only, and the report closes by offering KPMG's services. On 13 October this brief carried Singapore's central bank asking boards to set limits on how many material AI uses depend on a single provider. KPMG's split gives that limit a market reference point, although it shows an association between returns and a spread of providers, not that one causes the other.

KPMG: Global AI Pulse Q3 2026 via LinkedIn (shared by Tony Moroney)

Security

Google cannot rule out that Gemini 4 Argon, now sold to businesses, has reached its critical level for cyberattacks. Vendor

Google opened Gemini 4 Argon, its most capable AI model, to business users and developers on Google Cloud on 13 October. On 1 October this brief reported that Google had given the model first to vetted cyber defenders, with no date for wider access. With the release, Google DeepMind published a safety report and a model card. Both say Google cannot rule out that the model, without its safeguards, has reached the critical capability level for cyberattacks set in Google's own safety framework. In Google's tests it solved all 12 of Google's end-to-end attack scenarios, against 41.7% for an earlier Gemini model built for cyber work. Google estimates the boost it would give attackers at 9 to 100 times across a set of reference attacks, and notes that its historical attack scenarios may understate new ones. The model card adds that it passed 14 of 15 tests of stealth and situational awareness, whether a model can act unnoticed and understand its own situation. It may therefore have reached a second level Google tracks. Google says its safeguards, filters on requests, answers and reasoning plus account monitoring, bring the remaining risk below both levels. The cost shows in Google's own conversation test, where the safeguarded model refused 53.9% of harmless security requests. The general version blocks offensive work such as penetration testing, and the version without those limits goes only to defenders Google vets through its Fairwind Program. Its introductory price doubles after 30 November. Every figure is Google's own test result.

OpenAI restricted advanced cyber access to its Astra model in September, as this brief noted on 1 October. Google now draws the same line between defence and attack for a model any business can buy. The general model refuses much of the testing a bank's red team, its in-house attackers who probe its defences, depends on, while the unrestricted model goes to defenders Google selects. The stealth finding reaches further. Agent controls that rely on a model's own account of what it did are weaker against a model that scores well at not being noticed.

Google DeepMind: Gemini 4 Argon Safety and Security Report | Google DeepMind: Gemini 4 Argon Model Card | Google Cloud

Polls of US adults find no detectable rise in cyber harm over a summer of stronger AI cyber capability. Institute

Epoch AI, a research group that tracks AI trends, published results on 7 October from two waves of an Ipsos poll of US adults, each with about 1,000 respondents, in mid-June and mid-September. Researchers Caroline Falkman Olsson and Yafah Edelman asked whether people had suffered any of six cyber incidents in the past 12 months. Examples include a hacked account, personal data leaked in a hack and an unusually convincing scam message. The share reporting at least one moved from 46% to 45%, and no single type rose by an amount the poll could reliably detect. People who use AI tools daily or weekly were flat as well, at 53% and then 51%. Convincing or personally aimed spam was the most common incident, at roughly a third of adults in both waves. The authors set out the limits themselves. The poll cannot tell which incidents AI caused, it relies on self-reports, and both waves ask about overlapping 12-month periods, so only a large recent rise would show. They also point to evidence running the other way, such as a sharp rise in serious software vulnerability disclosures in June and July. Peter Slattery, an MIT researcher who shared it, writes: "I appreciate this sort of monitoring, as it seems important to assess the degree to which increased AI capabilities convert into societal harms." On 7 October this brief carried JPMorgan Chase chief executive Jamie Dimon saying AI-related threats rose tenfold after Anthropic's Mythos, without giving a basis. Dimon's figure describes threats against a large bank, Google's describes capability in a test, and Epoch's describes harm reported by households. The one taken from people's own experience has not moved yet.

Epoch AI (Shared by Peter Slattery)