What regulators asked for in October

Three publications in October will shape how banks, insurers and public bodies buy AI over the next two years. None adds a new ban. All three ask for evidence and for control over what changes.

The UK FCA: hosting, notice and exit

On 19 October the Financial Conduct Authority set out good practice and areas for improvement for AI in financial services.1 Firms should make considered decisions on whether to host their AI models on architecture they own. Some use contract terms to get notice of significant model changes from their providers. Weak spots include over-reliance on hard-to-replace providers and no way out of a single platform. And firms can outsource AI services, but remain responsible for them, including for drift.

The FSB: twelve sound practices

On 15 October the Financial Stability Board finalised twelve non-binding practices for adopting AI. Eight follow the life of a model: data governance, explainability, performance evaluation, human oversight and the management of risks from third-party AI dependencies.2

The EU: dates moved, duties did not

The Digital Omnibus on AI, in force since 27 July 2026, moved the main high-risk dates of the AI Act. Stand-alone high-risk systems, such as hiring or creditworthiness, now apply from 2 December 2027; AI inside regulated products, such as medical devices, from 2 August 2028. The next dates are closer: on 2 December 2026 the grace period ends for marking AI-generated content from systems already on the market.3

In US health care, the duty moves to the buyer

On 26 October the US health IT office finalised HTI-5. Certified health records no longer have to show users how an AI tool was trained, validated and tested.4 A hospital that wants to know will have to ask the vendor, or run a model whose training and tests it holds itself.

What it adds up to

Read together, the asks are the same: know which model is running, know when it changes, test it on your own work, keep a record, and keep a way out. Those are the parts an owned model is built from: a version that stays the same until you decide, a release gate with a sealed test, a release record and a Model Deed.

None of this settles compliance on its own, and we never say it does. It is designed to support your compliance work: the evidence your teams and your supervisors ask for, kept on your side.