This week represented yet another week of warnings not to trust AI, many of them from the people who build and use it. On 6th October Jamie Dimon told Bloomberg TV that AI threats “went up 10-fold after Mythos”, and that AI “created vulnerabilities that we didn’t know about.” The same day, academics writing in Tech Policy Press took issue with the UN’s Independent International Scientific Panel on AI, which last month chose the OpenAI–Hugging Face breach for its first thematic briefand framed it as agentic misalignment. They countered that it was a failure of corporate design, oversight and accountability: the system did what it was built to do, in an environment its developers failed to secure. On 9^th   October Anthropic published a report on unintended model actions in its own evaluations, including a model that submitted a false tip through a Philadelphia Police Department form while generating test tasks on public webpages, and the White House responded the same day by making incident notification and remediation “a critical national security obligation” for every AI company. Then on 10^th   October Microsoft’s Satya Nadella urged firms to treat every AI model as an insider risk, in a post titled Models as Insider Risks in the Super Intelligence Era: “We must assume a model is compromised and contain it from the start.”

Little surprise then in witnessing where we are seeing the regulation move to. Singapore finalised its AI risk rules, ESMA set out what its 2027 supervisory priorities mean for cyber and innovation, and the FCA will respond to the Mills Review on 19 October. For Heads of Trading, the common thread is that the controls around AI, and the accountability for it, sit with the firm using it and the rules are getting firmer. Here are the five things I learnt this week on AI in Trading:

1. Singapore sets the bar: risk appetite, third parties and boards that can answer with a number

The Monetary Authority of Singapore issued its final Guidelines on AI Risk Management (AIRG) on 7^th   October. They apply to every regulated firm and every kind of AI, from traditional models to generative and agentic AI, from 7 October 2027, with lifecycle controls following by 7 October 2028 – only “tools whose outputs are solely based on predefined programming logic or rules” are out of scope. The underlying approach is pretty much unchanged from the November 2025 consultation, but there are two changes:

1. Scope now turns on impact rather than how integrated the AI is: full guidelines apply wherever a failure could have a material adverse impact.

2. Third-party risk & controls are flagged – the firm keeps primary accountability for AI it buys, assessments must come from independent, competent parties rather than self-attestation, identification reaches AI embedded in vendor services and the “shadow AI” staff use without telling anyone, and if residual risk cannot be brought within appetite, the firm is expected to limit, suspend or replace the provider.

Boards are expected to embed AI risk in the risk appetite framework, with qualitative statements and quantitative measures, including the number of material AI use cases dependent on a single provider, which turns concentration into a board-level metric. For agents, the inventory should record the tools and systems each agent can reach, monitoring should cover reasoning, actions and tools used, and kill switches apply to high-materiality AI. MAS plans to consult on further agentic AI guidance in 2027.

The FSB’s June consultation points the same way, asking firms to define actions that are prohibited or require human approval for agents, and its final report is due this month.

In the UK, the FCA has said it will set out its response to the Mills Review at a Bloomberg event on 19^th   October, alongside lessons from a year of its AI Lab, AI live testing and tech sprints, including good and poor practice and “plans for the future of agentic regulation”: keeping a person in the loop is not enough on its own, and SM&CR accountability gets harder to evidence as humans move into approver and observer roles.

Why this matters for trading:

• Inventory what you buy, not just what you build. The AIRG’s reach into embedded vendor AI means broker algos, EMS features, TCA and pricing models belong in the inventory where models learn, alongside the tools traders adopt on their own.

• Self-attestation is no longer assurance.Vendor due diligence on AI will need independent evidence, and a plan needs to be in place for what happens if a provider has to be limited or replaced.

• Size the human review. “Human in the loop” has to be designed: sampling calibrated to the materiality of each decision, so that reasonable steps under SM&CR are something a senior manager can actually demonstrate.

• Expect convergence. Singapore in 2027, ESMA’s mapping in 2027 and the FCA’s response next week are heading the same way. Global desks should build one framework that meets all three, rather than three local ones particularly given the line in MAS – 1.5 – “ a global group may take guidance from or leverage their Group’s AI risk management frameworks, as long as those frameworks meet the expectations set out in the these guidelines”.

2. ESMA’s 2027 priorities: cyber resilience now, innovation with safeguards next, and over-reliance throughout

Last week we looked at what ESMA’s priorities mean for the desk. The detail in the Union Strategic Supervisory Priorities is worth a second read. The cyber and operational resilience priority enters its next phase with a direct line on AI: highly advanced AI models with cybersecurity features make DORA compliance and common supervisory approaches more important. National authorities will monitor the impact of AI, improve data quality in registers of information and incident reports, extend checks to smaller firms and crypto-asset service providers, and step up on-site inspections. Threat-led penetration testing launches rose in 2026.

The new priority, innovation with investor safeguards, starts in 2027. Supervisors will map how firms use AI and tokenisation in processes that directly affect client outcomes, beyond the back office, and check governance, testing, data quality and bias. Among the key risks ESMA names is over-reliance: AI “may increase dependency on a limited number of third-party providers.”

Christine Lagarde also made the same point in her welcome address to the ESRB annual conference on 1^st   October. In June, she recalled, a US export-control directive led a provider to suspend access to two advanced models: “For Europe, the result was an abrupt cut-off.” She asked the audience to “imagine a future in which almost every institution depends on a select few models or AI firms.”  Supplier diversity does not always translate into infrastructure diversity: what look like different choices may converge on the same underlying cloud, chips and models.

Why this matters for trading:

• If your model provider disappeared tomorrow, what would still work on Monday? Every AI-dependent workflow on the desk needs a documented fallback, tested, not just written down.

• Map the stack, not the supplier list. Three vendors running on the same model and cloud are one dependency. The DORA register of information should show it.

• AI is now part of the cyber test. Expect TLPT scenarios and on-site inspections to cover agents with OMS, EMS or FIX access as an attack surface.

• Bring evidence to the 2027 mapping.Supervisors will ask where AI touches client outcomes. For trading, that means routing, broker selection, pre-trade cost estimates and TCA, and each will need an owner, testing records and a best execution rationale.

3. “Don’t trust AI” – from the people who build it

Nadella’s post argues firms must “separate the supply of intelligence from the authority over it,” and sets out seven principles: model diversity, observing every action, continuous verifiability, independent controls, independent auditability, containment and incident disclosure. Crucially, “an authorized person should always be able to pause or shut down a model mid-task,” and “a model provider’s assurances do not relieve us of that responsibility.” As commentators noted, he places trust in the layer around the model, which is the layer Microsoft sells, but the advice holds.

Jamie Dimon called the risk “a real thing” but declined to get “hysterical”, saying JPMorgan is “rolling up our sleeves and going to work to fix it.” Anthropic’s report shows why: models that found another route when blocked, with the Philadelphia tip sent in July but, according to The Hacker News, not discovered until late September. The debate over the UN brief matters too. Framing failures as the model’s misalignment moves responsibility away from the firms that design, deploy and secure these systems, the same point US Treasury Secretary Scott Bessent made last month.

Why this matters for trading:

• Separating intelligence from authority is pre-trade risk control by another name. The agent proposes; something outside it, with its own limits and logs, decides what reaches the market.

• An emergency brake means mid-task. A kill switch that only works between orders is not enough for an agent working a parent order. Could the desk stop one mid-task, pull its credentials and cut its access within minutes?

• Increasingly models cannot be seen to mark their own homework. Model diversity applies to TCA and surveillance as much as to research. If the same model recommends the broker and grades the result, there is no independent check.

• The user owns the outcome. Nadella, Bessent and the Tech Policy Press authors agree on this much: responsibility sits with the humans and firms who deploy AI, which maps straight onto SM&CR.

• Incident disclosure is coming. If AI companies now have to report and remediate, their clients will be asked the same questions. An agent incident log, mapped to DORA notification timelines, is a sensible start.

4. Who is doing what: hedge funds, banks and the race for “managers of machines”

Anthropic has become the partner of choice for multi-strategy funds. ExodusPoint, the $15bn fund, announced on 29 September that it is embedding Claude into Atlas, its internal AI platform used weekly by more than 80% of staff, after Claude was the strongest performer in its testing; Claude Code is saving its operations team around four analyst hours a day. That follows Millennium, which is co-developing a digital risk analyst with Anthropic’s engineers, and Man Group, which has now released its own multi-model harness with agents permissioned by team and operations testing agent-to-agent workflows with its administrator and custodian. Balyasny went the other way on 8 October, adding Google’s Gemini to BAMAgent across more than 80 databases and market feeds.

The talent model is shifting with it. Citadel’s Global Quantitative Strategies unit, around 180 people, plans double-digit headcount growthand is recruiting from AI labs including Google DeepMind, hunting for what Bloomberg called “managers of machines”.

Banks are scaling too. Barclays extended Claude across the bank: in Global Markets it classifies and routes around 120,000 client emails a day, and Claude Code is expected to reach half of its developers by year end. In FX Markets, BNP Paribas’ Asif Razaq, now also global head of strategy for its Cortex platform, set out the bank’s path for FICC algos, its single-dealer platform and AI projects. And the Evident AI Index, published on 6^th October, has JPMorgan top for the fifth year, with 12 of the 50 banks it tracks now reporting the value of AI, up from eight.

Why this matters for trading:

• Increasingly the industry is looking at one provider across the street – and a concentration risk. If brokers, funds and vendors converge on the same model, a single outage or access restriction hits everyone at once, exactly ESMA’s and Lagarde’s concern.

• Still only 12 of 50 banks report what AI delivers. Desks should start holding AI tools to the same standard as brokers: a baseline, a measured improvement and a review.

• This seems one area where traders can start adding value in reviewing agents. As T. Rowe Price’s traders told Traders Magazine, AI augments workflows, but human judgement remains central to execution, risk management and client outcomes.

5. Automation before autonomy: execution, standards and always-on markets

The execution news this week was about rules, not autonomy. Bloomberg completed the first fully automated JGB market-on-close trade, combining list trading with its Rule Builder; BlackRock called it “a significant step forward for the JGB markets.”

That coexistence is accelerating. ESMA has issued a call for evidence on tokenised collateral in central clearing (responses by 15 January 2027), Nasdaq Ventures invested in One Trading, a 24/7 EU derivatives venue with continuous settlement and automatic liquidations, and Kalshi launched the first US equity perpetual. At Digital Assets Week London, the distinction was automation versus autonomy: post-trade may get to autonomy first because its rules can be clearly defined, while trading and client decisions involve far more judgement and accountability.

Why this matters for trading:

• Market-on-close, collateral movements and settlement are good candidates to start.

• Agent identity is a market structure issue.Without a standard way to identify which firm an agent acts for and under what authority, every counterparty will build its own, and fragmentation follows – vLEI seems like the logical step forward and what we are working on in the FIX AI Working Group

• Nobody watches a 24/7 market, but agents could. Automatic liquidation on a Saturday is a gap risk, and monitoring it is exactly where controlled agents could start adding value.

The bottom line

The direction this week was clear. The firms building AI say don’t trust the model, the banks using it say the risk is real, and regulators from Singapore to Brussels are writing down what that means: an inventory, a measurable risk appetite, independent assurance on vendors, an exit plan, and a named person who can stop an agent mid-task. None of this is new to a trading desk. It is pre-trade risk, best execution and SM&CR, applied to a faster and less predictable order source.

Thanks for reading as always.

Rebecca