AI View - October 2026

Welcome to AI View, Simmons & Simmons’ fortnightly round-up of key AI legislative, regulatory, and policy updates from around the world.

Our next AI x Dispute Resolution webinar on Thursday 5 November will examine the evidential challenges emerging in AI-related disputes. We’ll look at establishing liability, working with expert witnesses and technical evidence, and the practical strategies litigators should consider when navigating disputes involving AI.

Sign up here.

This edition brings you:

1. Law Commission proposes extending product liability law to AI systems

2. UK Financial Conduct Authority publishes good and poor practice examples for AI use in financial services

3. Financial Stability Board calls for closer monitoring of autonomous AI by financial institutions

4. Singapore launches testing kit for agentic AI safety and reliability

5. European Commission opens consultation on procedural rules for EU AI Act enforcement

6. New Zealand’s Reserve Bank and Financial Markets Authority warn firms of frontier AI cyber threats and concentration risks

7. Dutch data protection authority establishes new AI oversight directorate

8. New York City bill proposes chatbot safety assessments and privacy safeguards

1. Law Commission proposes extending product liability law to AI systems

On 8 October 2026, the Law Commission published a consultation paper setting out provisional proposals for reform of the product liability regime under Part 1 of the Consumer Protection Act 1987 (the CPA) in England and Wales. The paper considers how the existing strict liability framework should be modernised to address digital products and emerging technologies, including AI.

The proposals would broaden the scope of the CPA by treating software and AI systems as products in their own right, whether embedded in physical goods, downloaded or accessed remotely, and by potentially exposing developers, as producers of software or AI products, and other participants in digital supply chains to liability under the regime. Key proposals include:

• extending the definitions of “product” and “supply” to cover software, AI systems and digitally supplied products, including certain products supplied without direct monetary charge;
• expanding the categories of potentially liable persons to include developers, fulfilment service providers, certain online marketplaces and UK authorised representatives;
• introducing a clearer framework for assessing whether a product is defective and measures to address evidential difficulties in technically complex cases;
• introducing a new framework for compensation for psychiatric harm and allowing compensation for the destruction or corruption of data; and
• resetting the ten-year long-stop period where a product undergoes a substantial modification and extending it to 25 years in cases involving latent harm.

If implemented, the proposals could expose AI developers and other participants in digital supply chains to strict liability for harm caused by defective AI systems, without a claimant having to establish fault. Responsibility could continue after a system’s initial supply where a producer retains control through software updates, upgrades or other modifications.

The consultation closes on 14 January 2027. The Law Commission will consider responses before publishing its final recommendations for reform. Any change to the CPA would ultimately require legislative action.

Read the consultation paper here.

2. UK Financial Conduct Authority publishes good and poor practice examples for AI use in financial services

On 19 October 2026, the UK Financial Conduct Authority (FCA) published examples of good practice and areas for improvement in the use of AI by financial services firms.

The publication sets out how firms can safely and responsibly deploy AI-supported tools. The FCA’s observations focus on three themes: (i) consumer outcomes; (ii) accountability and governance; and (iii) operational resilience. The examples do not create new regulatory requirements or prescribe a single governance model, but illustrate practices observed through the FCA’s industry engagement, supervisory work and AI Lab initiatives.

The FCA’s examples of good practice include:

• Choosing where AI should support, automate or abstain: firms considered which tasks could be supported or automated by AI, which should remain staff-led, and when an AI tool should abstain, redirect or escalate a matter to a person. Firms also introduced proportionate technical checks and continuous monitoring, rather than relying solely on human review of AI outputs.
• Testing outcomes across consumer groups: firms tested for unfair or unjustified differences across relevant consumer groups and scenarios. They considered the data and variables used, compared outcomes and error rates, and adjusted data, thresholds or controls where issues were identified.
• Establishing governance and accountability from the outset: firms introduced structured challenge, testing and sign-off before deployment, involving relevant business, risk and control functions. Some established multidisciplinary AI boards or ethics panels, or adapted existing governance frameworks with clear senior management responsibility for individual AI use cases.
• Building operational resilience into AI deployment: firms stress-tested AI tools before deployment, mapped dependencies on external models and providers, and developed fallback and exit arrangements. Some designed their AI architecture to work with different providers and required advance notice of significant changes to third-party models.

The FCA also identified areas for improvement, including developing AI tools without first establishing that they would improve consumer outcomes, introducing governance only after deployment, delegating responsibility for AI development to technical teams without sufficient oversight, and relying excessively on staff to oversee AI outputs without having an established governance framework.

Read the FCA’s statement here.

3. Financial Stability Board calls for closer monitoring of autonomous AI by financial institutions

On 15 October 2026, the Financial Stability Board (FSB) published its final report on responsible adoption of AI by financial institutions. The report presents 12 sound practices intended to help financial institutions realise the benefits of AI while identifying and managing risks throughout the AI lifecycle.

The FSB notes that AI can improve efficiency, customer service and risk management, but may also amplify existing risks or create new ones, including risks relating to system performance, consumer protection and market conduct, data governance, cybersecurity and agentic AI. The sound practices are intended to be applied proportionately according to an institution’s size, complexity, risk profile and use of AI in critical functions.

The sound practices address the following areas:

• Organisation-wide governance: boards and senior management should align AI adoption with the institution’s business model, strategy and risk appetite, establish clear responsibilities and incorporate AI risks into their risk-management frameworks.

• Lifecycle risk management: institutions should assess the materiality and risk of AI use cases throughout their lifecycle. The framework covers data governance, explainability and transparency, performance testing and ongoing monitoring.

• Human oversight of autonomous systems: oversight should reflect each use case’s materiality, risk, autonomy, complexity and explainability. For agentic AI, controls include defined permissions, human approval triggers, activity logs, testing, monitoring and mechanisms to pause, restrict or terminate an agent’s access or operations.

• Cyber and technology risks: institutions should adapt existing cyber and information and communication technology controls to address AI-related threats. This may include incorporating AI scenarios into testing exercises and applying identity and access controls to AI agents.

• Third-party dependencies: institutions should conduct due diligence on AI providers and address oversight, audit rights, data use, service continuity and termination in contracts. They should also monitor AI supply chain dependencies.

Read the FSB’s report here.

4. Singapore launches testing kit for agentic AI safety and reliability

On 14 October 2026, Singapore’s Infocomm Media Development Authority (IMDA) announced three initiatives intended to strengthen the safety and resilience of AI:

• Starter Kit for Testing Agentic Systems for Safety and Reliability: this practical guidance sets out a four-stage approach covering risk identification, the design of realistic and robust tests, test execution and log analysis, and continuous monitoring and re-testing. It also addresses testing an agent’s reasoning and actions, selecting agent-specific metrics and adapting testing where organisations or third-party testers have limited visibility into a system.
• AI Tester Accreditation Programme (AI TAP): the AI Verify Foundation has launched the AI TAP to assess third-party AI testing providers against technical, operational and financial criteria.
• Frontier AI Resilience and Security Taskforce (FAIRS): IMDA has established FAIRS, bringing together specialists from telecommunications, media, cybersecurity and AI to improve responses to AI-accelerated threats, strengthen the resilience of critical networks and systems, and share intelligence on emerging attack techniques.

The initiatives respond to new risks arising as AI systems become more autonomous and increasingly capable of reasoning, acting on behalf of users, accessing sensitive data and changing their operating environments. They are intended to provide organisations with practical testing guidance, improve confidence in independent AI assurance services and strengthen Singapore’s cyber defences.

The Agentic Testing Starter Kit will be updated as practices develop and feedback is received. FAIRS is expected to publish practical guidelines and good practices during the first half of 2027.

Read the full statement here.

5. European Commission opens consultation on procedural rules for EU AI Act enforcement

On 12 October 2026, the European Commission opened a consultation, running until 9 November 2026, on a draft implementing regulation setting out how it will investigate and penalise providers of certain AI systems under the EU AI Act.

As a recap, Article 75(1) of the AI Act provides that the Commission, acting through the AI Office, has the exclusive power to investigate and enforce against providers of:

(i) AI systems based on a GPAI model developed by the same provider (subject to limited exceptions); and

(ii) AI systems integrated into designated very large online platforms (VLOPS) or very large online search engines (VLOSEs)

The Digital Omnibus, which entered into force in July 2026, introduced several new articles laying down the rules on what happens where the AI Office suspects a breach (including the fines it can impose and the protections a provider receives whilst under investigation). Those articles set out the framework, but provide that the Commission may adopt implementing acts concerning certain practical arrangements (Art 75d(3)), of which this draft regulation is one. Of note, it adopts a similar approach to the earlier implementing regulation covering the AI Office’s powers to investigate and fine GPAI model providers (2026/1755), which we covered in an earlier AI View article.

In short, the draft regulation covers: (i) how an operator under investigation can access the Commission’s case file, (ii) the process for identifying, protecting and disclosing confidential information, (iii) how limitation periods for imposing fines and for enforcing penalty decisions will work in practice, and (iv) the process for procedural mechanics, for example, how documents are submitted to and received from the Commission.

Following the consultation, the Commission will review the responses received and issue a further draft, which may reflect that feedback. Once adopted, the regulation will enter into force 20 days after its publication in the Official Journal of the European Union.

Read the draft implementing regulation in full here.

6. New Zealand’s Reserve Bank and Financial Markets Authority warn firms of frontier AI cyber threats and concentration risks

On 15 October 2026, the Reserve Bank of New Zealand (RBNZ) and Financial Markets Authority (FMA) set out their supervisory expectations for financial institutions managing cyber risks associated with frontier AI. The regulators describe these expectations as reflecting existing prudential, conduct, cyber and operational resilience obligations, rather than new regulatory requirements.

The key expectations include:

• Strengthening cyber fundamentals: firms should maintain effective identity and access management, asset lifecycle management and timely patching. They should accelerate risk-based vulnerability identification and remediation, while managing the operational risks of accelerated patching and addressing vulnerabilities in legacy or unsupported technology.
• Reviewing governance and risk management: firms should adopt a proportionate approach to AI-related risk, aligned with their strategy, risk appetite and operational resilience objectives. Boards and senior management should understand material AI risks and dependencies, maintain visibility over AI use and assign clear accountability.
• Managing third-party and concentration risk: firms should assess how third-party use of AI could affect their threat exposure, particularly where multiple institutions depend on a limited number of AI or cloud providers. This should include assessing supplier resilience, defining shared responsibilities and establishing contractual notification requirements for material changes, vulnerabilities and incidents.
• Preparing for incidents: firms should maintain response and recovery arrangements for AI-enabled attacks and disruptions. Testing should use severe but plausible scenarios, such as high-speed attacks or third-party outages, and examine whether manual workarounds, backups, failover and recovery arrangements remain effective.

These expectations mean that accountability for managing AI-related operational risk remains with the institution, including where technology or services are outsourced.

Read the RBNZ and FMA’s statement here.

7. Dutch data protection authority establishes new AI oversight directorate

On 9 October 2026, Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, announced the creation of a new AI/Algorithms Supervision and Coordination directorate (TCA). The directorate will form part of the AP’s preparations for supervising AI under the EU AI Act.

The TCA brings together the AP’s existing coordinating supervision of AI and algorithms, which it has carried out since 2023, with preparatory work for future AI market supervision. The AP is expected to act as a market surveillance authority under the AI Act in the Netherlands, but it has not yet been formally designated and will only acquire market surveillance powers once the Dutch AI Act implementing law, a draft of which was published in April 2026, is in force. The AP is expected to assume joint responsibility for market surveillance, alongside the State Inspectorate of Digital Infrastructure (RDI).

The AP is also working with the RDI on a regulatory sandbox, a controlled environment in which organisations can develop and test AI systems with regulator input and align them with the AI Act. The two authorities are also setting up a joint AI Coordination Centre.

Read the AP’s full statement here (in Dutch only).

8. New York City bill proposes chatbot safety assessments and privacy safeguards

On 8 October 2026, a bill introducing privacy, security and transparency requirements for chatbot providers was placed on the agenda of the New York City Council. Introduction 1118-2026 (the Bill), which would amend New York City’s administrative code, remains at committee stage and has not yet been enacted.

The Bill would apply to providers of AI models that generate text, audio, images or video in a manner that simulates interpersonal communication or conversation. It would regulate how providers collect, use, retain and disclose chatbot users’ information, while introducing transparency requirements and obligations to assess and mitigate risks of user harm.

The Bill’s principal requirements include:

• Data security and user access: chatbot providers would be required to maintain a comprehensive data security programme appropriate to the volume and nature of the personal and chat-log data they hold. Users would have a continuing right to obtain their retained chat logs in a downloadable format.
• Transparency: providers would need to notify users, before any output, that they are interacting with a chatbot rather than a person. Notices would need to be clear, accessible and in the same language as the interaction.
• Restrictions on data use: chatbots’ processing of personal data would be restricted for advertising, profiling and training, with additional protections for users under 18. Providers could not sell chat logs without affirmative consent and would generally need to delete them after ten years.
• Safety assessments: providers would need to assess chatbots each month for risks of harm to users, address identified risks, and publish information about those risks and mitigation measures.
• Professional advice: providers could not imply that chatbot content is provided or endorsed by, or equivalent to, advice from specific regulated professionals such as medical, legal or financial advisers.

Read the draft Bill here.