AI accountability, enforcement and agent boundaries
Financial institutions remain accountable for third-party AI. Regulators want evidence; incident disclosures show why authority must be enforced outside the model.
Richard E. Davis · JD · CISSP · CISA · CRISC · AAISM · ITIL
01 · Supervisory guidelines · Published October 7, 2026
MAS: inventories and third-party AI accountability
Context at a glance
Organization / source
MAS — Monetary Authority of Singapore, Singapore’s central bank and integrated financial regulator.
Applicable sector
Singapore-regulated financial institutions, including banking, payments, capital markets and insurance; useful comparative governance material for US non-bank financial institutions.
Jurisdiction / authority
Singapore. Direct supervisory relevance depends on MAS-regulated operations; for a US-only institution this is a benchmark, not a new US legal obligation.
Why selected
Selected because the guidance connects AI inventories, board accountability, third-party assurance and lifecycle controls to financial-sector supervision. Singapore’s international financial-centre role and institutional standing add context to that selection; the substantive control requirements are the principal reason to read it.
Acronyms & key terms
AI — Artificial intelligence
MAS — Monetary Authority of Singapore
FI — Financial institution
NBFI — Non-bank financial institution
AML/CFT — Anti-money laundering / countering the financing of terrorism
FATF — Financial Action Task Force
APG — Asia/Pacific Group on Money Laundering
CPI — Corruption Perceptions Index
Why Singapore is a useful comparison
Singapore is an international financial centre with substantial cross-border financial activity. Transparency International’s 2025 Corruption Perceptions Index gives Singapore 84/100 and ranks it third of 182 countries and territories. The index measures perceived public-sector corruption; it does not certify individual institutions or their due diligence.
The FATF/APG 2026 evaluation recognizes a competent, coordinated financial-crime regime and generally proactive international cooperation, while identifying gaps in consistent risk-based results. That combination makes Singapore useful for comparative financial-sector governance. It does not prove that its AI controls are effective or make MAS guidance binding elsewhere.
MAS sets risk-proportionate expectations for AI inventories, board and senior-management oversight, lifecycle controls and supplier assurance. Institutions remain accountable when third parties provide the AI. Sections 3–4 apply from October 7, 2027; Sections 5–6 by October 7, 2028. MAS intends to consult further on agentic AI in 2027.
Why it matters: Boards need a clear risk appetite and accountable owners. Counsel and compliance should assess Singapore applicability; these supervisory expectations are not a universal US requirement.
This week: Map one embedded or vendor AI service to its business owner, risk tier, data, tools and monitoring. Document assurance gaps, compensating controls and a practical suspension or replacement path.
European Commission AI Office, EU Member State national competent authorities and the EDPS — European Data Protection Supervisor — share AI Act enforcement responsibilities.
Applicable sector
AI model and system providers, deployers and relevant financial-sector AI use cases, including institutions headquartered outside Europe when the Act’s scope reaches their activities.
Jurisdiction / authority
European Union. Applicability turns on the actor, use case and territorial scope; US headquarters alone neither establishes nor excludes coverage.
Why selected
Selected to connect the AI Act’s requirements to the authority that can request evidence, investigate and require correction. This helps counsel and technical owners prepare a defensible response rather than treating the Act as a generic global checklist.
Acronyms & key terms
EU — European Union
GPAI — General-purpose artificial intelligence
EDPS — European Data Protection Supervisor
AI Office — European Commission office overseeing specified AI Act responsibilities
The Commission describes enforcement shared among the AI Office, national competent authorities and the European Data Protection Supervisor. The AI Office supervises GPAI providers and specified systems; its powers include information requests, evaluations and corrective measures. The explainer does not replace the legislation.
Why it matters: Counsel and compliance need an applicability decision tied to the actual entity, provider/deployer role and AI use. CIOs and CISOs must be able to produce the corresponding technical evidence.
This week: Record the relevant authority and applicable duties for one EU-facing workflow. Connect the inventory to retained tests, supplier records, incident escalation and a response owner. Verify applicable dates against the current legal text.
03 · Security analysis · Published October 8 · Coverage July–September 2026
Q3 exploit roundup: reachability is not permission
Context at a glance
Organization / source
OWASP — Open Worldwide Application Security Project — is a security community, not a regulator. This roundup is hosted by its Gen AI Security Project and states that it is not an official OWASP publication.
Applicable sector
Organizations using generative or tool-enabled AI; especially financial services, where agents can reach sensitive data, accounts and transaction workflows.
Jurisdiction / authority
Global technical relevance. The cases span different systems and organizations; inclusion does not create a legal duty in any particular country.
Why selected
Selected because the reported failure modes make independent authorization, credential scoping, memory integrity and containment testable. Related campaign components must not be mistaken for independent attacks or used to estimate incident prevalence.
Acronyms & key terms
OWASP — Open Worldwide Application Security Project
GenAI — Generative artificial intelligence
CVE — Common Vulnerabilities and Exposures identifier
SIEM — Security information and event management
MCP — Model Context Protocol
An OWASP Gen AI Security Project-hosted roundup examines containment failures, credential abuse, tool misuse and prompt or memory manipulation. It describes selected disclosures rather than a complete incident census and says it is not an official OWASP publication. Connected campaign components should not be counted as independent attacks.
Why it matters: CISOs need enforced target scope, isolated credentials and evidence of actual actions. Boards should ask whether containment still works when an agent searches for a workaround.
This week: In an authorized isolated test, deny a tool, introduce an unapproved destination and test a hostile memory instruction. Confirm the action gate blocks the attempt and that SIEM records identify the agent, policy decision and response.
For one material agent workflow, produce its inventory entry, authority boundary, supplier assurance, denied-action test and preserved evidence. Assign an owner to each unresolved gap.
Publication edition: October 9, 2026. Summaries refreshed against linked sources on October 12, 2026. Leadership actions are editorial recommendations; applicability depends on the institution and use case.
Our selection standard: Each item identifies the source, sector, jurisdiction and practical assurance question. Foreign rules are distinguished from useful benchmarks; vendor claims and research are distinguished from law. Acronyms are expanded so that readers can judge relevance before acting.