Edition 4 · 13 October 2026
AI Risk Reading
A regulator makes risk appetite decide what gets deployed, researchers warn against counting incidents, and the UK’s largest banks rehearse losing the cloud.
Monetary Authority of SingaporeGuidelines7 October 2026
The essential read
What is new
MAS has issued final guidelines that make a board’s AI risk appetite operational. Its examples of what an appetite framework might include are prohibited use categories, thresholds on the number or impact of AI incidents, and a count of material uses that depend on a single provider. A use case’s residual risk must be within appetite before it is deployed. A firm remains accountable for AI it buys and should limit, suspend or replace a service whose risk it can’t bring within appetite. It should also consider concentration on key AI providers, “whether direct or indirect”. The oversight expectations apply from October 2027; the life-cycle controls, including those for third-party AI, apply by October 2028.
Why a board should care
This is a concrete test of whether an appetite statement changes deployment decisions or only describes them.
Verdict: read Section 3 on board oversight, especially paragraph 3.4 and its footnote, and paragraphs 5.10 to 5.11 on third-party AI.
Peter H. Vartanian, Simon Mylius and Peter SlatteryMIT AI Risk Initiative8 October 2026
What is new
Interviews with 45 practitioners show why an incident count can mislead. Coverage is uneven, classifications conceal disagreement, and a rise in reports doesn’t establish a rise in risk per use.
Why a board should care
Incident data can inform challenge. Its provenance and its missing cases matter before it becomes a risk appetite measure, as MAS now suggests it might. These are preliminary findings, not a representative estimate of AI failure rates.
Verdict: read the five findings and the implications for deployers; skim the methods.
Paul KrugmanSubstack6 October 2026
What is new
Krugman argues that the AI buildout is already displacing other investment, through financing costs and competition for scarce physical resources. In June I asked whether the AI mega-IPOs would suck the oxygen out of the market for other firms seeking finance. Krugman reaches the same question through debt and investment rather than equity. It takes my valuation essays from “what does the price assume?” to “what else bears the cost while those returns are pursued?”
Why a board should care
It prompts a look at exposures outside AI firms, including borrowers affected by the cost of capital and energy. His charts show investment moving in different directions, but they do not, on their own, prove that AI is the main cause of higher long-term rates. Separately, the FSB Chair’s letter to the G20, published on 12 October, warns that a market reassessment of AI-related valuations could trigger a broader correction.
Verdict: read in full, with that causal claim in mind.
Bank of EnglandNews release9 October 2026
What is new
On 8 October, the 38 largest and most systemically important banks and market infrastructure operators rehearsed a global cloud services disruption. The Bank now expects firms to act on the exercise, and what they do in response is likely to become de facto best practice for the rest of the sector. In a related signal, the Basel Committee said on 1 October that frontier AI could amplify operational vulnerabilities, including correlated dependencies in the financial system. It will review whether its operational loss categories capture AI and cyber risk.
Why a board should care
It’s a practical reminder to test continuity across shared suppliers, including the cloud services that AI runs on. Firms outside the 38 will be measured against what they do. The release gives the scenario and the expectation, but no detailed findings.
Verdict: skim both.
This edition’s question
If a major AI provider came under financial strain while a shared cloud service was disrupted, which important services could we sustain, and what evidence supports that answer?