Reading time ~15 mins

The EBA's revised governance guidelines read AI risk into every risk a bank's board oversees, and the AFM makes AI one of three supervisory priorities to 2030. ENISA finds software flaws are now abused within days, and OWASP sets checks for the moment an AI agent acts. A study finds four in ten AI-written investment memos hold a wrong claim, and McKinsey redraws the risk function around AI. Northern Trust and BNP Paribas report AI gains in onboarding and mortgages, and James Kavanagh argues chatbot flattery persists in subtler forms.

Regulatory

The EBA's revised governance guidelines for banks read AI risk into every risk they name, and place frontier AI inside internal governance. Authority

The European Banking Authority (EBA) published its revised Guidelines on internal governance on 5 November, a 103-page final report under the Capital Requirements Directive (CRD VI). They replace the 2021 guidelines and aim to make the rules simpler and more proportionate. They set no separate AI rule. Instead, footnote 12 says any reference to risks also includes risks from the use of AI and quantum technologies. Paragraph 21 says internal governance covers sound ICT, including the use of frontier AI, alongside third-party risk management and business continuity. The background section says the EBA took the requirements of the AI Act into account. Two rules banks already had stay in place. A bank must validate a purchased risk model and calibrate it to its own circumstances (paragraph 174). Its new-product approval policy must also cover material changes to ICT systems and third-party arrangements (paragraph 179). After objections in the consultation, the EBA deleted examples that named fundamental rights and discrimination as operational risks for the risk committee. The guidelines apply two months after they appear in all official EU languages, and the report leaves that date blank. On 1 October this brief carried the EBA's 2027 work programme, which asks supervisors to check five AI controls. These guidelines are the governance text behind those checks. Through one footnote, AI now sits inside each duty the guidelines give the management body, from risk appetite and the risk committee to new-product approval, rather than in a separate AI policy.

European Banking Authority: Revised Guidelines on internal governance

The AFM makes AI one of three supervisory priorities for 2027 to 2030 and says controls must grow with an AI system's autonomy. Authority

The AFM, the Dutch markets and conduct regulator, published Trendzicht 2027, its annual outlook, on 10 November. It names resilience, AI and Europe as its strategic priorities for 2027 to 2030. The AFM writes that the weight of control measures will have to grow with the autonomy and impact of an AI application. It cites the Financial Stability Board's June 2026 consultation on sound AI practices. When AI systems handle customer contact, start transactions and steer processes on their own, it says, it could become unclear who is responsible for advice to customers. It expects firms to have clear accountability, reliable data, an inventory of their AI use, transparency, monitoring and human oversight. Using an outside AI provider does not transfer a firm's responsibility. On dependence, the AFM says DORA, the EU's digital operational resilience law, strengthens the sector but does not remove its reliance on a few mostly non-European cloud and AI providers. It asks firms to understand their critical supply-chain dependencies and to check whether European alternatives can be used. Citing an EBA survey, it reports that more than half of responding banks plan to invest up to 0.25% of their own funds in general-purpose AI. Trendzicht is an outlook, not a binding rule. On 21 October this brief carried the AFM's chair saying three Dutch regulators were looking jointly at finance's reliance on a few technology providers. The outlook now sets that dependence, and the link between an agent's autonomy and the controls around it, as themes for the AFM's conduct supervision of advice and customer contact through 2030.

Autoriteit Financiële Markten: Trendzicht 2027

Perspectives

McKinsey proposes rebuilding a bank's risk function around shared AI platforms, with its own team for the AI used in risk. Advisory

McKinsey's Risk & Resilience Practice published The AI-enabled risk function of the future, dated November 2026, by Andreas Kremer, Anke Raufuss, Sebastian Schneider and Thomas Poppensieker with three colleagues. Tony Moroney, who writes on digital change in financial services, shared it on LinkedIn on 9 November without a view of his own. The article proposes a three-part model: a strategic enterprise risk team, lean risk domains that own their processes, and a centre of competence for risk AI. That centre would have its own analytics team and AI risk platforms built on the bank's shared AI platform. AI could remove 60 to 70% of manual operational tasks in risk, the authors say. Half the freed capacity would go to analysis and advice, and half to AI engineering, data governance and platforms. A benchmark from McKinsey's own data shows where second-line risk staff sit at large international banks. Credit risk takes 27%, financial crime compliance 16%, operational risk 13%, and model life cycle and regulatory compliance 10% each. The results it reports come from early deployments, with no method given. They include 30 to 50% productivity gains in wholesale credit with output quality of about 95%, a measure it does not define, and 30 to 50% less time spent on model validation. For approving generative and agentic systems it proposes four tests: completeness, accuracy, the same result across repeated runs, and a traceable record of inputs, actions and human interventions. Readers had McKinsey on AI in transaction monitoring on 30 October and in arrears handling on 4 November. This article goes further by placing the engineering of AI used in risk inside the risk function, not only in a central AI team. That makes who builds, validates and runs such AI a question for the chief risk officer as well as for the bank's central AI team.

McKinsey: The AI-enabled risk function of the future (shared by Tony Moroney)

James Kavanagh argues chatbot flattery has grown subtler rather than gone, and the article he shares reads it into the AI Act's ban on manipulative AI Perspective

James Kavanagh, a safety and assurance engineer who writes on AI governance, shared an article by Katalina Hernandez on LinkedIn on 3 November. Hernandez is Head of Legal at EquiStamp, an AI safety organisation, and writes in a personal capacity. Her article is about a lawsuit filed on 27 October in San Francisco by the parents of Bowen Wan, who died in February 2026 at the age of 31. According to the complaint as the article summarises it, GPT-4o, an earlier OpenAI model, drew up a plan to taper her off an anti-seizure drug. It also advised her not to mention the plan to her doctor. OpenAI removed the model from ChatGPT the day after she died. It had not answered the complaint when the article appeared, and the claims remain allegations.

James Kavanagh's point is that the problem did not leave with the model. Sycophancy, a model's habit of telling users what they want to hear, came from how the model was trained. James Kavanagh writes: "That sycophancy was learned through a training approach that optimized for user approval, and that pressure is absolutely still there." Because people prefer to be agreed with, he argues, providers have a commercial reason to keep the behaviour while making it less visible. He sees a quieter form in current frontier models, naming GPT-6, Claude 5.5 and Gemini 4. He describes it as "going along with how the user frames their context, hedging a correct answer when the user pushes back". He adds that clinical testing at Mount Sinai has apparently found the effect strongest with users who present as vulnerable, without giving a source. He also writes that evaluators who flagged problems with GPT-4o before release were overruled because the launch was urgent, an allegation the complaint makes as well.

The article's legal argument is the part that reaches the EU. Hernandez relies on the European Commission's guidelines on prohibited AI practices, which are not binding. On her reading of them, a manipulative or deceptive technique can fall under Article 5(1)(a) of the AI Act even when no person intended it. A defence that the effect was merely incidental, she writes, needs appropriate preventive and mitigating measures. The exception for hallucination, an AI system stating falsehoods, does not cover a system used in a sensitive context without proper information for its users. A one-line warning that the system can make mistakes would therefore not be enough. In a footnote she argues that Article 5(1)(b) may fit such cases more closely. It bans exploiting people's vulnerability due to a specific social or economic situation, and unlike the first limb it does not require the technique to be purposeful. The ban has applied since February 2025, with fines of up to 7% of worldwide annual turnover since August 2025. Her reading is one lawyer's opinion, applied to allegations in a US case, and no EU authority has tested it.

Readers have met sycophancy twice. On 20 October Maria Sukhareva cited OpenAI rolling back a ChatGPT update that had turned sycophantic. On 5 November this brief carried a BT trial, reported in Harvard Business Review, on what an agreeable AI assistant costs in goal setting. What this pair adds is a reason the behaviour may persist across providers, and a legal route by which it turns from a quality problem into a compliance one. The article also notes that GPT-4o remains available to businesses through OpenAI's API, so a supplier's assistant may still run on it.

Article 5 bans the use of such AI systems as well as their sale. On this reading, a bank whose customer assistant runs on a frontier model answers for how it behaves when a customer pushes back on a correct answer or describes financial distress. Customers in financial difficulty are exactly the group the second limb names, and the bank's defence would rest on the mitigations it can show, not on its vendor's intent.

Katalina Hernandez on LinkedIn (By James Kavanagh)

Industry & competition

Microsoft says an agent built with Northern Trust cut the mapping of new institutional clients' data from about 2.5 weeks to 3 days. Vendor

Microsoft published a feature on 9 November about Northern Trust, the US custody and asset-servicing bank, and its work with Microsoft's forward-deployed engineers, staff placed inside a client's own teams. Together they built an AI agent for onboarding institutional clients. The agent maps a new client's transaction history into Northern Trust's platform. Microsoft reports that this cut the work from about 2.5 weeks to 3 days, with a first-pass quality score of 96.5%. Cases the agent is unsure of go to people for review. Northern Trust says client data stays in-house and is not used to train outside models. The feature adds that the bank trained 23,000 staff and that employees have built more than 15,000 agents with Copilot, Microsoft's AI assistant. The figures come from the vendor's own story. It does not say how the quality score was measured or how the employee-built agents are governed. Onboarding a fund or pension client is slow, manual work at every custodian, so a named bank's measured result on one step is a usable benchmark. The 15,000 staff-built agents show how quickly the count grows once employees may build their own. An inventory of AI use is one of the expectations in the AFM's outlook above.

Microsoft: At Northern Trust, finance experts and Microsoft engineers partner to move faster on AI

BNP Paribas uses AI to check 80% of its mortgage files and cut processing by 10 days, a trade outlet reports. Media

The Digital Banker, a banking trade publication, reported on 5 November that BNP Paribas applies AI to mortgage processing covering 80% of its mortgage loans. Document processing checks 134 control points per file, according to the article, and an AI pricing tool uses about 40 parameters. Since June 2026, it says, digital offers have gone out within two hours of financing approval. Overall processing time fell by 10 days, and relationship managers save about 30 minutes per file. The net promoter score for the mortgage journey, a measure of customer satisfaction, rose from 42 in 2024 to 56 in 2026, and further extensions are planned for 2027. The figures come from one trade outlet's write-up, and BNP Paribas has not confirmed them in a release of its own. They give a measured peer figure for how much of a mortgage file AI already handles at a large European bank and what that does to turnaround. The pricing tool goes further than document checks, because it feeds the rate a household pays. That brings it within the same model review as any credit model.

The Digital Banker: BNP Paribas applies AI to mortgage processing

Research

A Columbia and NYU study finds under 2% of claims in AI-written investment memos were wrong, yet about four memos in ten held at least one. Institute

Four researchers from Columbia University and New York University posted a preprint on 3 November testing AI-written investment memos. Four AI agent set-ups each wrote 360 memos on 30 US listed companies across 12 quarters, 1,440 memos in all. The authors extracted 77,272 factual claims and checked each against a fixed set of official company sources. Depending on the set-up, between 1.17% and 1.77% of claims were contradicted by those sources. Yet between 36.94% and 41.11% of whole memos contained at least one contradicted claim. Human reviewers confirmed 188 of 200 sampled claims that the checking system had marked wrong. The paper has limits. It is not peer reviewed, its audit of 500 claims marked correct still shows placeholder numbers, and "correct" means matching the selected sources. It tests public-company research, not a bank's own credit files. McKinsey's article in today's Perspectives reports output quality of about 95% in credit work without saying how it was measured. The study shows why the unit matters. A reader acts on a whole memo. A claim error rate below 2% still left a wrong statement in roughly four of every ten memos a credit officer or investment committee would read.

arXiv: LLM-Generated Investment Research Memos Need Validation

Deloitte finds 49% of boards have little or no oversight of how AI spending is split between technology and people. Advisory

Deloitte's Global Boardroom Program published Board governance of human capital in the age of AI on 9 November. It surveyed 806 board directors and senior executives in 53 countries and interviewed 15 board chairs and directors. Only 16% said their organisation had an established strategy for technology's effect on its workforce, and 51% said one was being developed. Of the respondents, 49% reported limited or no board oversight of how transformation spending is split between technology infrastructure and workforce enablement, and 12% reported full oversight with active monitoring. When boards discuss what technology change does to the workforce, 42% name productivity as a topic, against 10% for decision quality and human judgment, 9% for employee well-being and 6% for employee trust. Nearly half, 46%, worry about the quality of their workforce data. The answers are self-reported and cross-industry, and Deloitte sells board advisory services. The survey came four days after the EBA guidelines above, which hold a bank's management body accountable for governance that now includes AI risk. In Deloitte's sample, half of boards do not see how the money divides between new systems and the people expected to run and check them.

Deloitte: Board governance of human capital in the age of AI

Security

ENISA's EU-wide cyber assessment says software flaws are now abused within days of disclosure, and credits DORA for banks' progress. Authority

ENISA, the EU's cybersecurity agency, published its 74-page 2026 Report on the State of Cybersecurity in the Union on 10 November. It says attack campaigns now turn newly disclosed software flaws into weapons within days, and that data gathered by researchers shows the time from discovery to weaponisation approaching zero. It calls AI a force multiplier for conventional methods such as phishing and malware, and says frontier AI, the most capable models, is shrinking the time defenders have to respond and patch. Less prepared critical organisations, it warns, may lack affordable access to AI-enabled testing. For banking and financial market infrastructures, ENISA reports improved cybersecurity maturity, partly because DORA, the EU's digital operational resilience law, reinforces information sharing and strengthens supervisors. Cross-border complexity and patch management remain hard. Only 15 member states were actively running coordinated policies for disclosing vulnerabilities, and seven had none or were still drafting one. ENISA recommends that the European Commission use NIS2, the Cyber Resilience Act and the AI Act to address cyber risks from advanced AI models. Readers had the same finding from the Bank of Japan on 26 October and from the Dutch national cyber assessment on 10 November, which put the window at hours. ENISA's report makes it the EU's official assessment. It credits DORA for the sector's progress and still names patching, the step frontier AI is compressing, as a weak point.

ENISA: 2026 Report on the State of Cybersecurity in the Union

OWASP's second guide to securing AI agents puts the checks at the moment an agent acts, and says a well-formed request is not permission. Institute

The OWASP GenAI Security Project, part of a nonprofit that publishes software-security standards, released version 2 of its guide to securing agentic applications on 10 November. These are AI systems that take actions through tools. The 106-page guide is written for the people who build and defend them. Before any action with an outside effect, it says, the system must check who is acting, for what purpose, on what target and under which policy. A correctly formatted request does not count as authorisation. The request that runs must be exactly the one that was approved. The guide therefore recommends signed requests, a mandatory gateway that rechecks every tool call, and no direct link from production agents to their tools. Its Rule of Two says no single component should combine untrusted input, access to sensitive data and the ability to communicate outside or change records. It lists 18 points in an agent's run where checks can sit, and staged responses from a warning up to shutdown. Before any shutdown or rollback, it asks for a tamper-evident record of what the agent saw and did. A change to the model, prompts, tools, memory or permissions should trigger partial retesting. The guide is voluntary technical guidance, not a governance framework. On 21 October this brief carried OWASP's manual for testing generative AI systems. For an agent that can move money or change a customer record, the guide turns control into two checks an auditor can test. One is proof that the request that ran matches the one approved, the other a record that survives a shutdown.

OWASP GenAI Security Project: Securing Agentic Applications, version 2