Pillar 05 · Govern
A sober read on agentic AI inside regulated firms in 2026: what is genuinely in production, the governance patterns supervisors now expect, and where the frontier actually sits.
The Retail Investment Strategy turns advice decisions into records a supervisor can inspect. This is what to capture in suitability engines and advice logs, and why a best-interest challenge you cannot reconstruct is one you lose.
Disclosing a cyber incident as material under 8-K Item 1.05 or voluntarily under Item 8.01 is a governance decision with market and enforcement consequences. Here is what engineering data must inform it.
Under MiCA Article 78 best execution is an evidentiary exercise. A CASP that cannot reconstruct why an order routed as it did has failed the obligation, whatever its intent.
From 10 December 2026 Australian firms must disclose automated decision-making in their privacy policies. The disclosure is trivial; the inventory behind it is the real work. Start cataloguing your ADM systems now.
The Data (Use and Access) Act re-frames solely-automated decision rules under UK GDPR. The regime is different, not simply lighter, so rebuild logging, human-review and contestation to the new standard rather than retiring controls.
NIS2 places cyber accountability on named individuals through approval, oversight and training duties. Here is how to build the sign-off and training record that demonstrates the management body genuinely discharged its duty.
SEC Item 1.05 rarely fails on legal drafting. It fails at the seam between the security operations centre and the disclosure committee. Here is the wiring a board should demand.
OSFI E-21 turns operational resilience into a governance obligation. A briefing for Canadian FRFI boards and senior management on who owns tolerances, who signs off testing, and the evidence a supervisor will demand before 1 September 2026.
The revised Product Liability Directive treats software, firmware and AI as products under no-fault liability. National laws land by 9 December 2026 — here is what boards should provision for now.