Supervision gets audibly louder – the pace forces discipline

Highlight

Supervision gets audibly louder – the pace forces discipline.

Within 48 hours in May, the Bank of England (BoE), the Financial Conduct Authority (FCA) and His Majesty's Treasury issued a joint statement on frontier-AI cyber risk on 15 May, followed by ECB Executive Board member Frank Elderson, BaFin President Mark Branson and the Banco de España with near-identical warnings. No new rulebook, no new standard – but a precisely coordinated shift in what counts as an appropriate response speed.

In parallel, the supplier side is accelerating its enterprise rollout: Google launched Gemini 3.5 on 15 May with an explicit focus on agentic execution, followed two days later by Antigravity 2.0 and the multimodal Gemini Omni. OpenAI institutionalised its distribution by launching DeployCo as a dedicated enterprise frontier-AI organisation, and announced GPT-5.5-Cyber as a specialised model for verified defenders inside the Trusted Access for Cyber programme. The market is visibly shifting from demos to distribution – and both movements meet at exactly one point.

The Basel Committee on Banking Supervision (BCBS) closed the ring on 20 May: frontier-AI models can help banks and supervisors identify cyber vulnerabilities – but their potentially malicious use may materially change the speed and scale of cyber incidents. Anyone who does not now run the Digital Operational Resilience Act (DORA) and the EU AI Act as a single programme has forfeited the only advantage a soft signal still offers: preparation time.

LinkedIn Featured

Frontier AI and Cyber Resilience: Why a British statement without a new rulebook matters for German banks

On 15 May 2026 the Bank of England, the FCA and HM Treasury bundle existing expectations on cyber resilience in the face of frontier-AI risks. No new law, but a precisely placed signal in an international supervisory space that is more tightly coordinated than the formal separation of jurisdictions suggests. For German institutions the substance is already covered through DORA and the EU AI Act – the required response speed is not. (Article in German)

Full article: Frontier AI and Cyber Resilience →

Agentic AI

tools, skills & what's trending

Google Update: Gemini 3.5 and Antigravity 2.0 – Google moves into the agent offensive

Google DeepMind launched Gemini 3.5 on 15 May with an explicit focus on „frontier intelligence with action". Antigravity 2.0 and the multimodal Gemini Omni followed two days later. The common denominator: agentic workflows that should no longer just reason but execute directly. With this Google positions itself in the enterprise stack squarely against Claude Opus and GPT-5.5 – not via the best benchmark, but via the deepest tool integration with Workspace, Vertex AI and the growing Antigravity IDE family.

OpenAI News: DeployCo and GPT-5.5-Cyber – distribution becomes the product

On 11 May OpenAI launched DeployCo, a dedicated deployment organisation for enterprise frontier AI. Four days earlier, GPT-5.5-Cyber was announced as a specialised model for verified defenders inside the Trusted Access for Cyber programme, in parallel with a partnership with Dell for hybrid and on-premise Codex deployments. The pattern of the past two weeks: fewer model updates, more distribution structures, more vertical specialisation. The market is shifting from demos to distribution – and cyber is the first verticalised model line.

Open Source: Qwen3.7-Max and Needle – frontier becomes smaller, faster, cheaper

Alibaba's Qwen3.7-Max redefines the agent frontier at the top end, while a 26-million parameter model called Needle distils Gemini tool calling far enough to run locally. Simon Willison sums up the past six months concisely: the middle of the field is catching up at a surprising speed, and the question of what counts as „frontier" now shifts in quarters, not years. For banks with sovereignty and latency requirements, distillation is becoming a strategic architecture decision – not a research curiosity.

Banking & Regulation

what really matters now

Basel Committee addresses frontier AI and cyber directly

At its meeting on 19 and 20 May, the Basel Committee on Banking Supervision approved a range-of-practices report on Information and Communication Technology (ICT) risk management and took an explicit position on frontier AI: the models could support banks and supervisors in identifying vulnerabilities – but their potentially malicious use may materially change the speed and scale of cyber incidents. In parallel, the targeted reviews on cryptoasset exposures and liquidity risk principles were taken forward. This is the first convergence at global level on the question UK supervisors had raised five days earlier – and a signal that frontier-AI cyber will land in the next BCBS consultation wave.

Lagarde separates function from instrument – the stablecoin question returns to monetary theory

In her speech on 8 May, ECB President Christine Lagarde argued that stablecoins as an instrument do not automatically perform the function of money. She pushes the European debate back to the question of what constitutes money – and rhetorically lays the foundation for defending the digital euro against the growing US uptake of stablecoins. Treasury teams in European banks that prioritise stablecoin use cases should read the regulatory posture as a leading indicator, not as background noise. The ECB also published its report on European financial integration in the same week – documenting improvement despite persistent fragmentation.

Signal & Noise

what your time is worth

• The last six months in LLMs in five minutes – simonwillison.net
  Probably the most honest concise briefing on the state of the LLM world – and a useful reality check before someone says „frontier" again.
• Isabel Schnabel: The quiet erosion of central bank independence – ECB speech, 7 May 2026
  Schnabel addresses without theatrics what is shifting in supervisory politics. Mandatory reading for anyone who thinks about risk governance beyond the daily news cycle.
• Basel Committee: Press release on the 19/20 May 2026 meeting – Bank for International Settlements
  Anyone who owns ICT risk inside a bank should have read the primary source before the next supervisory dialogue. In particular the passages on cryptoasset exposures and liquidity risk principles.
• A new personal finance experience in ChatGPT – OpenAI
  ChatGPT directly connects to financial accounts for the first time – US Pro only for now, but a preview of what European retail-banking teams will see in 18 months. Underestimating the migration pressure means catching up later.
• Agents need control flow, not more prompts – bsuh.bearblog.dev
  A practical engineering view on agent architectures: anyone building multi-agent systems should stop polishing prompts – and start designing workflows.

„Security is a process, not a product."