AI Pulse Daily Brief | 2026-10-21
Reading time ~14 mins
Dutch MPs tell the cabinet to resist an EU plan to ease AI training on personal data. The AFM's chair says three Dutch regulators are jointly weighing finance's reliance on a few technology providers, and Bruegel warns that Chinese open-weight models leave every upgrade with China. UWV counts 13% fewer Dutch customer-contact jobs, and OpenAI claims a leap in COBOL migration on its own tests. Oliver Wyman finds staff hiding their AI skill, and a Turing paper warns that agreeing agents can be one judgement repeated.
Regulatory
Dutch MPs told the cabinet to resist an EU presidency plan to treat AI training on personal data as a legitimate interest. Authority
On 8 October the Tweede Kamer adopted motion 21 501-33 no. 1251 by MPs Kathmann and Dassen. It was tabled on 6 October in a debate ahead of an informal meeting of EU telecom ministers on 12 and 13 October. The motion notes that the Irish presidency of the EU Council proposes to classify training AI models on EU citizens' personal data as a legitimate interest. Under the GDPR, a legitimate interest is a legal ground that lets a firm process personal data without consent, after weighing it against the person's rights. The motion says the change would mainly favour large US technology companies. It asks the cabinet to keep the GDPR from being weakened, so that such training stays possible only under conditions. It also asks the cabinet to seek like-minded member states in the Council. On 21 September this brief reported the cabinet's answer that the privacy part of the Digital Omnibus, the Commission's package to simplify EU digital rules, had no Council mandate. A motion sets no legal duty, and the presidency text is a negotiating draft. For a bank that trains or fine-tunes models on customer data, the legal ground stays today's GDPR balancing test. The Dutch government now has a parliamentary instruction to defend it in Brussels.
Tweede Kamer der Staten-Generaal
Perspectives
Oliver Wyman finds staff hide their AI skill and move work around AI rules that feel too strict Advisory
Oliver Wyman Forum, the research arm of the consultancy Oliver Wyman, published The Reality Check, its AI Agenda report for 2026. The report prints no release date, and its latest survey wave closed in August. Tony Moroney, who writes on digital change in financial services, shared it on LinkedIn on 19 October and relayed its five headline findings without a view of his own. The report draws on about 25,000 responses to two waves of the firm's Global Voices survey in 15 markets. It adds a survey of 415 chief executives run with the New York Stock Exchange and a survey of 200 chief executives and technology leaders. The UK, France, Germany, Italy and Spain are among the markets; the Netherlands is not. The report calls its results self-reported and descriptive. Its headline claim, that AI shows up everywhere in a company except the profit and loss account, is one readers have had from EY and others. The new part is measured data on how staff behave around AI.
The first finding is concealment. In the August wave, 62% of people who use AI daily at work said they had downplayed how good they are with it. They did so to avoid extra work, scrutiny or looking replaceable. Among all workplace AI users the share was 52%. Of employed respondents, 68% would give up part of their salary to work for a company that guaranteed never to replace people with AI, and 47% would give up 10% or more. Asked what should happen if AI doubled their team's output, staff rank fewer people last. Asked what will happen, they rank it first. Executives expect pay rises where front-line staff expect layoffs. Only 8% of workplace AI users report a company-wide standard for what happens to the time AI saves.
The second finding is that rules push work out of sight when the approved route is worse than the workaround. Where staff feel their company's AI approach is too strict, 63% use AI tools the employer has not approved. Of the same group, 53% have used personal devices or accounts to get around restrictions. Where the approach feels about right, the shares are 38% and 28%. Users of unapproved AI give practical reasons. The approved tools were worse than free ones for 35%, approval took too long for 27%, tools were unavailable for 17%, and 11% did not know what was approved. The comparison is descriptive, so it shows an association rather than proof that strict rules cause the workarounds. Half of workplace AI users have entered sensitive work information into an AI tool. Those with clear guidance were more than twice as likely to have done so as those with no policy, 59% against 26%. Oliver Wyman reads this as a sign that useful AI needs real work context, so policy has to say how that context is used safely.
Two further measures bear on control. Users report spending 22 minutes on average checking, correcting or redoing output for every hour of AI-assisted work. Yet only 17% always verify important AI information elsewhere, and 42% say wrong AI information caused a real problem in the past year. The report concludes that a person reviewing every case cannot be the operating model. It proposes limits set in advance, automatic monitoring and escalation of unclear or high-stakes cases to people. On dependence, 55% of respondents who can see their company's AI spending expect at least moderate disruption if the main provider were unavailable for a month. Only 35% say their company has put the ability to switch providers in place. Among technology leaders, 10% have a signed statement of which data and assets they keep if a supplier raises prices or withdraws a model. Half estimate 21 to 60 engineer-days to swap the main model on their main use case.
The report comes from a firm that sells AI strategy and implementation work, and it draws on client engagements of its own AI unit. That interest weighs on its prescriptions more than on its survey data. For a bank, the two new findings point at its own numbers. Adoption and productivity figures built on reported use can understate what the most capable staff do. A slow approved route can move customer data into personal accounts, where the bank's controls do not reach. Where an AI provider supports a critical function, the switching figures fall within the exit plans that DORA, the EU's digital resilience law for financial firms, already requires.
Oliver Wyman Forum via LinkedIn (By Tony Moroney)
A Turing Institute paper warns that AI agents agreeing with each other can be one judgement counted several times Institute
CETaS, the Centre for Emerging Technology and Security at the Alan Turing Institute, published a briefing paper by Rick Hennessy and Carolyn Ashurst. Its title is Behavioural Assurance of Agentic AI for Sensitive and High-Stakes Organisations, and its cover is dated September 2026. Peter Slattery, an MIT researcher who works on AI risk, shared it on LinkedIn on 19 October, quoting its summary and naming the authors without a view of his own. The paper deals with agents that fail while doing what they were asked. It leaves deliberate attacks on agents to security testing. It proposes eight failure modes. Five can show up within one agent's work. Three arise only when agents interact with each other or with people, and cannot be found by testing an agent on its own.
The most useful of those three for a bank is what the authors call pseudo-corroboration. Agreement between AI systems may reflect shared training data, design, benchmarks or later training rather than independent evidence. The paper's illustration is six agents built on one underlying model, whose agreement is one judgement counted six times. Where agents validate, supervise or review one another, checks that look independent can repeat the same assumptions at every stage. The authors conclude that real diversity matters more than the number of models deployed, and they count independent human judgement among the diverse approaches. Their worked example is a financial institution with three agents in procurement. The first wrongly classifies a supplier as low risk. The risk agent accepts that label, and the payment agent approves the payment.
The second new idea is the policy-invisible violation. An agent can act reasonably and within its authority yet still breach policy, because the information it needs is missing where it decides. The paper lists eight forms. In one, an agent told that spending over 500 pounds needs a senior manager's approval approves a 600 pound expense split across several invoices. In another, an agent shares data with an employee whose role has changed without the agent seeing the change. The problem moves from how the agent behaves to what information surrounds it.
On the human side the paper names eight failures, among them automation bias, meaningless review and responsibility laundering, where people cite the AI to justify a decision they wanted anyway. It warns that an agent's own logs and summaries can omit, rationalise or conceal what it did. Important actions therefore need checks that do not rest on the agent's own account. Three settings decide whether a failure turns into harm: what an agent can reach, what it may decide, and how far people rely on it. The authors stress that the evidence is limited and comes largely from laboratory work built to provoke bad behaviour. A follow-up report with practical assessment methods is due early in 2027.
Readers have had the case for testing the whole deployed system rather than the model from several sources this autumn. This paper turns it into a rule for which failures a test of one agent will miss. In a bank, the four-eyes principle, where a second person checks the first person's work, is the control most exposed once a second agent on a similar model takes the checker's seat. Payment approval and access decisions are where missing context does damage, because the facts an agent needs, such as linked invoices or a colleague's new role, often sit in other systems.
Alan Turing Institute via LinkedIn (By Peter Slattery)
Netherlands & Sovereignty
UWV counts 13% fewer Dutch customer-contact jobs and names AI chatbots as one of three causes. Authority
UWV, the Dutch employee insurance agency, published an analysis of the customer-contact job market on 13 October. On a CBS estimate, about 172,000 people now work in customer contact, down from almost 198,000 a few years ago. Vacancies fell 44% between the second quarters of 2023 and 2026, from about 6,500 to just over 3,600. Over the same period the number of jobseekers on unemployment benefit in the group rose 42%, to just over 3,500. UWV names three causes: demand returning to normal after the pandemic, some employers moving the work to lower-wage countries, and organisations using AI and chatbots for simple questions. It does not say how much each cause contributes. The steepest falls were in healthcare, business services and ICT rather than finance, and prospects remain reasonable in about half of the labour-market regions. These figures describe the market Dutch contact-centre staff would enter if chatbots take over more simple questions. They also show that the official count cannot yet separate AI from offshoring.
The AFM's chair says three Dutch regulators have been looking jointly at finance's reliance on a few technology providers. Authority
Laura van Geest, chair of the AFM, the Dutch markets regulator, gave a speech at a competition congress on 8 October, which the AFM published. She said cloud services, software and data infrastructure are concentrated among a few global providers, often outside Europe. She used to see strategic dependence mainly in terms of Russia and China, she said, and recent years showed that friendship is no automatic protection. In AI, she named access to data, computing power and talent as the factors that now decide competition. The AFM, De Nederlandsche Bank (DNB) and the ACM, the Dutch competition authority, have recently thought together about this, she said. Their starting point is the financial sector's growing dependence on a small number of technology providers. Each looks through its own lens: continuity of financial services for the AFM, stability for DNB and competition for the ACM. She defined strategic autonomy as keeping alternatives, not self-sufficiency, and announced no new measure. The speech sets no duty. It does show that a bank's reliance on one cloud or AI provider is now a shared question for three authorities, not only an outsourcing file for DNB.
Bruegel argues that firms using Chinese open-weight AI models still depend on China for every new version. Institute
Alicia García-Herrero of Bruegel, the Brussels economic think tank, published an analysis on 20 October of how China exports its AI. She describes a sequence. Open-weight models, which anyone may download and run, and hosted services are exportable now, while chips and the software around them may follow as Chinese production grows. A firm can keep running a model version whose weights were already released. Each improved version still depends on the Chinese developer choosing to release it. On 16 October China published draft rules to limit or ban the export of 23 types of advanced AI technology, including technology for language models, agents and computing clusters. Bruegel notes that technology already released openly need not be withdrawn. It cites about 170 terawatt-hours of Chinese data-centre electricity use in 2025, which supports cheap computing for export. Its advice to firms is to avoid relying on any single model and to plan for a switch. Yesterday's brief carried Maria Sukhareva's argument that an open-weight model gives a buyer control over where it runs. Bruegel marks the limit of that control. The weights a bank holds today stay usable, while the upgrade path sits with a developer whose government has just proposed export limits.
Bruegel: China's outbound AI strategy starts with models and governance and ends with chips
Innovation
OpenAI reports its newest coding model passed 87% of its own COBOL migration tests, up from 5% a generation earlier. Vendor
OpenAI published results on 19 October from an internal test of COBOL migration. COBOL is the decades-old programming language that still runs many bank mainframe systems. The test gives a model the requirements of a COBOL program, asks it to migrate the program without changing what it does, and grades the result with hidden tests. OpenAI reports that GPT-6.1 Sol passed 86.6% of tasks at low reasoning effort and 97.9% at high effort. GPT-5.6 Sol passed 5.4% at low effort. It also reports a cost 39% lower than an earlier high-effort run. The model is available through OpenAI's programming interface. Every figure comes from OpenAI's own test set, and no independent or bank result has been published. Moving mainframe code is one of the slowest and costliest parts of bank modernisation. A pass rate near these levels on real bank code would change the cost and duration assumptions behind those programmes. For now it is a vendor's claim about its own test.
Security
A university study finds that common AI agent benchmarks test only two to four of six ways prompt-injection text is built. Institute
Two researchers at the University of Southern California posted a study on 18 October that sorts prompt-injection text by how it is built. Prompt injection means hiding instructions in content an AI system reads, such as an email or a web page, to make it act against its user. The study, called PIAtlas, names six construction classes, among them imitating the formatting of system instructions, scrambling text to slip past filters, and social engineering. The authors labelled 8,663 examples drawn from a corpus of 444,498 attack instructions. Commonly used agent benchmarks cover only two to four of the six classes. In 4,000 examples from an adaptive contest, where attackers adjust to the defence, imitated formatting appeared in 76%, scrambling in 69% and social engineering in 67%. In curated test sets the shares were 35%, 5% and 29%. The authors say these are shares of public datasets, not real-world frequency, and the adaptive sample comes from one contest. They recommend that test results state which classes were covered. A passing score on prompt-injection tests may therefore cover much less of the threat than it appears to. That gap applies to any agent that reads email, documents or web pages on a bank's behalf.
OWASP published a 144-page manual for testing generative AI systems that tells testers to score filters and final answers separately. Institute
The OWASP GenAI Security Project, part of a nonprofit that publishes software-security standards, released version 1.0 of its GenAI Red Teaming Manual on 20 October. Red teaming means testing a system by attacking it the way an adversary would. The guide sets out eight phases, from planning and scoping to remediation, and covers models, connected tools, user identities and AI agents. It tells testers to turn legal and policy duties, from the EU AI Act to the GDPR, into tests that can be run. Citing a framework is not evidence of compliance. Coverage is to be tracked against the system's own threat model, access levels and interfaces, with untested and inconclusive cases recorded. Results for input filters and for the system's final output are to be scored and reported apart. A harmful request that passes the filter but gets a harmless answer counts as a filter failure, even though the output was safe. Together with the study above, the manual describes what a credible AI test report contains. A single blended pass rate, from a vendor or an internal team, falls short of it.