Weekly AI Governance Brief: 19–25 October 2026
Bringing you the latest developments in the AI Governance world.
EU AI Office establishes information-request mechanism for fundamental-rights authorities
On 20 October, the European Commission published a dedicated channel through which national fundamental-rights authorities can request information and documentation from the AI Office. The mechanism implements Article 77 of the AI Act, which provides national authorities responsible for protecting fundamental rights with access to information necessary for carrying out their statutory responsibilities.
The new channel applies where the AI Office acts as the market surveillance authority for AI systems under its exclusive competence. This includes certain AI systems based on general-purpose AI models where the model and system are developed by the same provider or business group. It also covers AI systems integrated into designated very large online platforms or search engines, subject to the applicable statutory conditions.
National authorities can submit requests in any official EU language. Requests must identify the requesting authority and explain why the information is necessary for fulfilling its mandate. Where a request concerns testing of a high-risk AI system, the authority must also explain why information already obtained is insufficient.
The AI Office will examine whether the request falls within Article 77 and its supervisory remit. Where necessary, it may obtain relevant documentation from the AI-system provider. The process will be handled confidentially.
Why this matters
The development makes an existing AI Act cooperation mechanism operational. The AI Act divides supervisory responsibilities between the Commission and national authorities. This structure requires arrangements through which institutions can obtain information relevant to their respective mandates. The new channel addresses that requirement where the AI Office holds exclusive market-surveillance competence.
It is particularly relevant to fundamental-rights authorities examining potential discrimination or other rights-related concerns involving AI systems supervised centrally by the Commission. The mechanism does not introduce new substantive obligations for providers. Its significance lies in establishing a defined process for regulatory information-sharing and cooperation.
AI Office clarifies its approach to independent evaluations of systemic-risk models
On 21 October, the European Commission published an AI Office report concerning the qualifications and independence of external evaluators of general-purpose AI models with systemic risk. The report follows a technical workshop held in July, during which the AI Office presented a proposed system for assessing external evaluators.
The newly published document records stakeholder feedback and explains the Office's current approach to determining whether evaluators possess the necessary expertise and independence. The involvement of external evaluators is an important component of systemic-risk assessment under Article 55(1)(b) of the AI Act and the accompanying General-Purpose AI Code of Practice. The AI Office identifies technical competence as a central requirement. Evaluators should possess relevant domain expertise and the capabilities necessary to assess the systemic risks associated with advanced AI models.
Independence is another significant consideration. The Office's approach examines whether evaluators are sufficiently independent from the model provider's managerial, financial and operational influence. The report also discusses stakeholder feedback concerning the proposed scoring methodology, including questions about how financial and management independence should be assessed. The Commission states that the report reflects the AI Office's current views, which may evolve as evaluation practices develop.
Why this matters
The publication provides additional clarity on the institutional standards surrounding external evaluation of advanced AI models. The credibility of an evaluation depends not only on the methods used but also on the competence and independence of the organisation conducting it. The AI Office's proposed scoring approach addresses both considerations. For providers of general-purpose AI models with systemic risk, the report is relevant to the selection and assessment of external evaluation partners. It is also relevant to specialist evaluation organisations seeking to understand the criteria considered important by the European supervisor. The report does not establish a final binding accreditation system. It nevertheless provides a more detailed account of the AI Office's current interpretation of evaluator qualifications and independence.
SEC establishes new examination priorities for AI use in financial services
On 23 October, the U.S. Securities and Exchange Commission published its fiscal 2027 examination priorities. The document identifies advanced AI technologies as an area of supervisory attention across regulated financial institutions. The SEC uses the term super intelligence in the publication, reflecting the terminology adopted by the federal administration. The Division of Examinations states that regulated firms are increasingly incorporating these technologies into investment analysis, customer management and other operational processes.
The examination programme addresses both the risks associated with using AI and the threats created by AI-enabled cyberattacks. The Division will assess how firms prepare for threats involving AI-generated phishing messages and synthetic voice or video used in social engineering. It will also examine policies and procedures governing AI use within regulated activities.
These include fraud prevention, anti-money-laundering compliance and trading functions. Automated investment services receive particular attention. Examiners will assess whether representations concerning automated tools are fair and accurate, whether operational controls correspond to disclosures made to investors and whether algorithmic recommendations are consistent with investors' profiles or stated strategies. The priorities also address information-security obligations under Regulation S-P and identity-theft prevention under Regulation S-ID.
The SEC identifies emerging technologies as relevant to these existing requirements, including where AI creates new methods of obtaining customer information or compromising accounts. The examination priorities do not introduce new legislation or additional legal obligations. They identify areas in which SEC staff intend to concentrate supervisory resources during fiscal 2027.
Why this matters
The publication provides a concrete account of how the SEC intends to assess AI-related risks within its existing regulatory framework. Rather than establishing a separate AI compliance regime, the examination programme incorporates AI into established supervisory responsibilities concerning investor protection and operational resilience. The treatment of automated investment services is particularly relevant.
The SEC's focus extends beyond whether firms accurately describe their use of AI. It also concerns whether algorithmic outputs and operational controls remain consistent with existing investor-protection requirements. The cybersecurity provisions similarly connect AI-enabled threats with established expectations for information security and incident preparedness. The development therefore illustrates how AI governance is being incorporated into routine financial supervision through specific examination priorities.
UK establishes dedicated AI biosecurity institution
On 24 October, the UK government announced the establishment of the AI Biosecurity Lab as part of a new National AI Biosecurity Initiative. The Lab is intended to operate as an independent non-profit organisation focused on strengthening preparedness for biological threats. The initiative combines public funding with commitments from frontier-AI developers. The government has committed £100 million to the Lab, alongside up to £200 million in private-sector commitments.
The Lab's initial activities will focus on using advanced AI capabilities to improve the detection of biological threats and accelerate the development of medical countermeasures. The government also intends the institution to strengthen technical capabilities relevant to understanding and responding to biological risks associated with increasingly capable AI systems. The Lab will work with public-sector biosecurity organisations and private-sector research partners. Its proposed structure includes a scientific advisory committee drawing on external expertise.
The initiative also establishes cooperation with the Medicines and Healthcare products Regulatory Agency concerning preparedness for health emergencies and the regulation of AI-designed medicines. The announcement does not introduce new compliance obligations for frontier-model developers.
Why this matters
The development creates a dedicated institutional mechanism for addressing the relationship between advanced AI capabilities and biological security. Its significance lies in the establishment of technical capacity and formal cooperation arrangements rather than the introduction of a new regulatory instrument. The Lab is intended to operate with organisational independence while maintaining close relationships with government agencies.
This structure reflects an approach in which specialised institutions contribute technical expertise to broader public-sector risk management. The planned cooperation with the MHRA also connects the initiative with an existing regulatory authority responsible for medicines and medical devices.
UK regulator identifies hidden AI-related investment concentration risks
On 22 October, The Pensions Regulator published new guidance addressing the investment risks associated with growing exposure to AI-related economic activity. The regulator observes that AI investment increasingly affects companies operating across several sectors. As a result, pension schemes may have greater exposure to common AI-related risks than conventional asset-allocation categories initially suggest.
The guidance identifies potential dependencies across technology, infrastructure and other investments connected to AI development. These relationships may create concentration risks even where portfolios appear diversified. The regulator therefore asks trustees to consider aggregate exposure across their entire investment portfolios. It also emphasises the importance of scenario analysis.
Trustees are expected to examine how their portfolios might respond to severe but plausible market downturns, including circumstances in which correlations between investments change. The guidance addresses both passive and actively managed investment strategies. For passive investments, concentration may increase as the market value of AI-related companies rises. For actively managed portfolios, investments through multiple funds may obscure repeated holdings or exposure to similar underlying risks. The regulator also identifies the role of investment advisers and managers in assessing these exposures.
Why this matters
The guidance extends AI-related governance concerns into the management of financial exposure. Unlike regulatory frameworks concerned with the development or deployment of AI systems, this publication addresses the risks associated with financing AI-related economic activity. Its focus is on the responsibilities of pension trustees to understand investment concentration and assess portfolio resilience. The guidance provides practical supervisory expectations concerning scenario analysis and the assessment of indirect exposures. It also illustrates how AI-related developments can affect established governance responsibilities even where an organisation does not directly develop or deploy advanced AI systems.
Looking ahead
The developments of 19–25 October reflect the continued incorporation of AI governance into existing supervisory and institutional structures. Within the European Union, the AI Office has introduced a practical cooperation mechanism for fundamental-rights authorities and published further detail on its approach to independent evaluation of systemic-risk models.
In the United States, the SEC has identified specific AI-related risks within its financial-supervision programme. The UK developments address different dimensions of AI-related risk. The AI Biosecurity Lab establishes specialised institutional capacity, while The Pensions Regulator's guidance examines financial exposure arising from AI investment.
Across the reporting period, the emphasis is on the practical operation of governance arrangements and the application of existing institutional responsibilities to increasingly specific AI-related risks.
Sources
European Commission, AI Act information-request channel for national fundamental-rights authorities: https://digital-strategy.ec.europa.eu/en/miscellaneous/ai-act-request-channel-national-fundamental-rights-authorities
European Commission, report on qualification and independence requirements for external GPAI evaluators: https://digital-strategy.ec.europa.eu/en/library/requirements-qualified-independent-external-evaluators-general-purpose-ai-models
U.S. Securities and Exchange Commission, Fiscal Year 2027 Examination Priorities: https://www.sec.gov/files/2027-exam-priorities.pdf
U.S. Securities and Exchange Commission, Press Release 2026-109: https://www.sec.gov/newsroom/press-releases/2026-109-sec-announces-fiscal-year-2027-examination-priorities
UK Cabinet Office, announcement establishing the AI Biosecurity Lab: https://www.gov.uk/government/news/introducing-the-ai-biosecurity-lab
The Pensions Regulator, AI concentration risk guidance for trustees: https://www.thepensionsregulator.gov.uk/document-library/scheme-management-detailed-guidance/funding-and-investment-detailed-guidance/ai-concentration-risk-action-for-trustees