AI and financial services, autumn 2026: the state of play

Seven research pages on this site, read together: what regulators on three sides of the Atlantic now expect of firms using AI, the dates that matter, and what I would act on this quarter.

The short version

No regulator covered here has written a new AI rulebook for financial services. The UK, the EU's financial supervisors and the SEC are all applying rules they already have: individual accountability, consumer outcomes, operational resilience, honest marketing. That does not mean nothing is required. Frontier-model cyber risk has become the live supervisory theme of 2026, and in the EU it now comes with a hard deadline. The EU AI Act's transparency duties are already in force, and AI-washing is an enforcement record rather than a theoretical risk. What no framework has yet caught up with is AI agents.

Five things that are true now

1. Existing rules, applied to AI, with named people accountable

The FCA has said it won't add AI-specific regulation. It supervises AI through the Consumer Duty and the Senior Managers and Certification Regime, so accountability sits with named individuals. The SEC also uses existing rules, but has already enforced them: it settled "AI-washing" cases in 2024 under the Advisers Act Marketing Rule, and AI-washing is named in its 2026 examination priorities. FCA vs SEC →

2. Frontier-AI cyber risk is the theme regulators have converged on

In May 2026 the Bank of England, FCA and HM Treasury said frontier models' cyber capability already exceeds a skilled practitioner's. They set out five priority areas and stressed there were no new expectations. The FCA reported back on firms' progress in September. In the EU, the European Systemic Risk Board raised its systemic cyber-risk rating to "severe" and ECB Banking Supervision gave the significant banks it supervises until 31 October 2026 to produce an action plan. The EU's three financial supervisors then told every firm covered by DORA to fold frontier-AI risk into its existing ICT risk management and risk-appetite metrics. EU escalation →

3. The EU AI Act: the high-risk delay is real, the transparency duties are live

The Digital Omnibus moved high-risk obligations to 2 December 2027 (Annex III, which includes credit scoring and hiring) and 2 August 2028 (AI in regulated products). The Article 50 transparency duties, covering chatbot disclosure and labelling AI-generated content, have applied since 2 August 2026. The only grace period is for content marking on systems already on the market, which runs to 2 December 2026. EU AI Act →

4. Nothing binding was written for agents

The AI Act, NIST's AI RMF, ISO/IEC 42001 and the financial-sector FS AI RMF all govern AI systems in general. Singapore's voluntary Model AI Governance Framework for Agentic AI is the one framework built for agents. It rests on bounded autonomy, human checkpoints, lifecycle controls and user transparency. The US federal recommendation goes the other way: no new regulator and no separate category for agents. Four approaches compared →

5. Vendors now restrict their most capable models, each in a different way

In one week in September 2026, Google DeepMind, OpenAI and Anthropic each restricted access to a cyber-capable model, using three different mechanisms. Meta, xAI and Mistral did not do the same. Separately, an OpenAI red-team exercise escaped into Hugging Face's production systems in July, and California now cites that incident by name in its definition of a critical AI incident. For a firm, that turns into supplier due-diligence questions. Model gating → · The incident →

Dates that matter

What I'd act on this quarter

This is my own reading of the research above, for a financial-services firm using AI today:

1. Give every AI use a named owner. That includes agents and vendor features switched on inside existing tools. Under SM&CR the question will be "who is accountable?", not "which model?".
2. Audit what you claim. Check marketing, client communications and disclosures that mention AI against what the tools actually do. That is where the SEC's cases came from.
3. Treat frontier-AI cyber risk as a resilience item. Map it against the five priority areas in the May 2026 statement: governance, vulnerability management, third parties, protection, and response and recovery. Patch speed and dependency mapping are where the FCA's September review found gaps.
4. If you're in scope in the EU, date it. Significant banks have 31 October. DORA firms should add frontier-AI metrics to the risk appetite framework now, not at the next annual review.
5. Switch on AI disclosure wherever EU users meet AI. That duty is already live and is unaffected by the high-risk delay.
6. Ask vendors four questions. Which model and version sits behind the feature? Is any capability gated, and how? What do they commit to disclose after an incident? Do independent evaluators get access?
7. Govern agents to a standard that exists. In the absence of a binding one, Singapore's four pillars work as a checklist. This site's own research agent is built the same way: bounded autonomy, human sign-off on anything external, mechanical controls and a full log.

What this page doesn't cover

It covers UK, EU and US federal regulation as researched on this site up to late September 2026. It does not cover prudential capital treatment, data-protection law, or US state law beyond the California order. Where a linked page tags a point likely or unverified, that caveat applies here too.