Europe & Americas: UK Finance AI Gaps, Agent Unit Plans, Data Centre Policy; NIST Identity Tenets, EU Model Reviews

On 26 October 2026, the Bank of England (BoE) and the Financial Conduct Authority (FCA) published Artificial intelligence in UK financial services – 2026, updating the evidence on financial institutions’ AI use, governance controls and supplier dependencies.

The authorities’ survey report presents aggregate findings from participating firms and introduces no new uniform compliance requirements. It finds that 94% of respondents have firmwide AI policies, principles or standards. For data risk management, pre-deployment review, human approval and vendor due diligence are each reported by more than 90% of respondents, but ongoing monitoring, leakage testing and periodic review or recertification are each reported by only around half. For high-materiality third-party AI systems, 81% of respondents rely on vendor assurance and contractual arrangements, while only 24% report having deep knowledge of those systems.

For banks, insurers, asset managers and their AI service providers, we recommend first checking who continues to validate system performance, manage vendor updates and decide on suspension or rollback after deployment approval. Credit, anti-fraud and customer service applications can use risk-based metrics for erroneous outputs, data leakage and customer impacts, with clear responsibilities and authority for reviewing and acting on alerts. When integrating external models, include version-change notifications, testing on representative business data, cooperation with anomaly investigations and rollback support in procurement requirements, and rehearse alternative workflows for critical service outages. These are deployment recommendations based on the survey’s findings; controls adopted by respondents should not be treated as uniform regulatory requirements.

The authorities’ previous survey, published on 21 November 2024, had already highlighted limited understanding of third-party models and supply dependency risks. The 2026 report shows that third-party systems’ share of high-materiality AI systems has risen from 35% to 53%. The latest survey received responses from 196 firms, of which 105 completed the full questionnaire. Most metrics draw on the full questionnaire and are calculated using valid responses to each question. The results can therefore help identify control weaknesses, but cannot directly establish adoption rates or the scale of gaps across the entire UK financial sector. Comparisons over time must also account for changes in samples and question definitions.

On 28 October 2026, HM Treasury published Budget 2026, proposing £40 million to establish a National Agentic Security Unit and develop dedicated capabilities for responding to rogue agentic systems.

The Treasury’s Budget document proposes connecting the detection, investigation and response to rogue agentic systems with ongoing monitoring and operational response capabilities. This is a funding and national capability-building arrangement. The Budget does not yet specify the unit’s full organisational remit, launch date, business contact channels or investigative procedures, and introduces no uniform agent incident reporting deadline through this measure. Enterprises should read it as a signal that the government is building dedicated response capabilities; specific cooperation requirements await further documents.

For enterprises deploying agents with network access, code execution, payment or infrastructure operations functions, we recommend turning incident plans into workable procedures for promptly revoking permissions, blocking further actions and preserving evidence. Before deployment, establish who assesses abnormal repeated calls, approval bypasses and propagation across systems, and who can revoke credentials, isolate execution environments or switch to manual workflows. Exercises should check whether shutdown actions also cover delegated subtasks and downstream tools. Link task objectives, model versions, authorisation scopes, call traces and response outcomes in incident records, while procurement contracts allocate supplier responsibilities for emergency response, evidence provision and recovery support. These are preparation recommendations; external notification remains subject to applicable existing rules.

On 12 October 2026, the UK government had already announced work on responding to serious agent incidents and identifying and reporting incidents and near misses. The Budget now specifies funding and a proposed dedicated unit. It also reiterates the additional AI Security Institute funding and national cyber defence programme announced on 24 October; these should not be counted again as new measures this week. Further developments to verify include the unit’s operational responsibilities, its division of duties with existing cybersecurity bodies, and arrangements for enterprise participation in exercises and provision of incident material. The Budget alone does not establish that these mechanisms are already operational.

On 28 October 2026, HM Treasury published The Data Centre Covenant, setting out five policy tests for data centre development and conditions for strategic projects to qualify for additional government support.

The Treasury’s policy paper encourages all data centres to meet the tests and makes them a condition for strategic data centres to qualify for additional government support. Its central mechanism is to link support such as faster access to power and planning coordination to energy cost contributions, community investment, environmental performance, local industrial contributions, and security and resilience. It calls for strategic projects to report annually on energy, water use, efficiency and related performance, plan for disruption with critical suppliers and participate in exercises on prioritising essential services. The government will separately define strategic data centres and additional criteria.

For data centre developers, we recommend incorporating grid connection commitments, resource-use data, local benefit plans and supply disruption contingencies into project feasibility assessments and delivery responsibilities. Enterprises procuring UK cloud services or AI compute should focus on whether compute capacity and power will be available on schedule, and how critical operations will be protected during disruption. Check actual operating locations, capacity delivery milestones, critical supplier dependencies, recovery arrangements and migration conditions, and agree on supplier provision of resource-use and resilience evidence. Eligibility for government support cannot replace verification of actual power delivery and service availability, and the policy cannot directly establish compliance for personal data or cross-border processing.

On 12 September 2024, the UK government designated data centres as Critical National Infrastructure, strengthening coordination and protection during major incidents. The Covenant now clarifies the relationship between development support and project commitments. It also proposes a ministerial coordination mechanism to accelerate power access and planning for strategic projects, but detailed eligibility criteria remain to be announced. Enterprises should track qualification criteria, support applications and methods for verifying commitments, assessing policy support, construction progress and production service availability separately.

On 27 October 2026, the US National Institute of Standards and Technology (NIST) published Design Tenets for Agent Identity Management Systems, proposing ten initial design tenets for enterprise and consumer-facing settings.

NIST’s official blog provides a reference for identity and access management design; it is not a final standard or a mandatory certification requirement. The ten tenets cover distinct identities, delegation chains, least privilege, short-lived and revocable authorisation, human review, task constraints, separation of policy from reasoning, deterministic access decisions, continuous monitoring and evidence preservation. Two key arrangements are that controls outside model reasoning determine which actions an agent is permitted to execute, and independent logging infrastructure retains append-only, tamper-evident records of identity, delegation and actions, preventing agents from modifying their own records.

For enterprises procuring or developing agent platforms, we recommend specifying permission acceptance criteria at the level of individual tasks and tool calls. Give agents identities distinguishable from human accounts, constrain authorisation by data scope, action type and validity period, and ensure that subagents receive no permissions beyond the delegated scope. Route high-impact actions to human review according to risk. Testing should cover prompt injection, authorisation expiring mid-task, credential revocation and continued subtask execution, confirming that the execution system can block unauthorised actions even when the model proposes them. For audit purposes, link the original delegation, permission decisions, tool calls and execution results, and check whether the agent can modify or delete those records.

The first post in NIST’s series, published on 27 August 2026, had already identified problems with sharing human credentials, long-lived tokens, broad permissions and excessive human approvals. The latest post organises these issues into ten design tenets intended to guide technical demonstrations at the National Cybersecurity Center of Excellence (NCCoE). NIST also notes that current standards and technology cannot immediately fulfil all tenets across every deployment model. Enterprises can use them to assess capability gaps and develop implementation roadmaps, requesting evidence of specific controls and tests during procurement rather than relying on broad claims of “NIST compliance”.

On 28 October 2026, the European Commission updated progress on information requests under the Artificial Intelligence Act (AI Act) at its regular press briefing, confirming that it was assessing safety and copyright submissions from model developers.

The Commission’s briefing reports progress in regulatory information gathering and announces no findings of infringement or penalties. Its spokesperson confirmed that requests covering more than 30 companies fall into two categories: model safety and security, and copyright. Submissions have been received for all requests whose response deadlines have expired; some deadlines have been extended, and most replies have been received and are being assessed. The briefing did not disclose company names, individual reasons for extensions, the full requests or a timetable for completing the assessment. It therefore does not establish that all companies have responded or passed a compliance review.

For general-purpose AI model providers, we recommend first establishing responsibilities based on model classification, market placement dates and applicable arrangements, then compiling consistent evidence linking model versions, training and testing records, safety evaluations, copyright policies and summaries of training content. Assign clear responsibilities for materials and response approvals across technical, legal and security teams. Enterprises integrating external models can use procurement reviews to request relevant capability and limitation information, update notifications and investigation cooperation arrangements, and assess alternatives if models become restricted or services change. Article 53 of the AI Act already sets out technical documentation, downstream information and copyright obligations. Their specific applicability and exemptions still require separate assessment; these obligations should not be transferred wholesale to ordinary purchasers.

At its briefing on 25 September 2026, the Commission had already confirmed receipt of replies to some requests whose deadlines had expired and the assessment of those replies. The latest update adds that most replies have been received and some deadlines extended; assessment did not begin this week. In law, Article 91 requires information requests to state their legal basis, purpose, required information and response deadline, but this briefing does not provide enough detail to verify each individual request. Further developments to check include publication of assessment findings, additional information requests or corrective measures. Receipt of a company’s reply does not itself mean that regulators have accepted its safety controls or copyright compliance.