Download this edition as PDF Email verification · about 30 seconds

We'll email a 6-digit access code. Enter it to open the Daily Market Scan PDF.

1. Lead story: the liability question goes on the record

On Wednesday, October 28, 2026, CFTC Chairman Michael S. Selig opened the agency's first Frontier Forum with a set of open questions about AI agents that trade on behalf of users. He stated that the views were his own, not the Commission's. VERIFIED C01 CITED C02

“Does the developer of that agent become subject to registration? Who is liable if the agent goes rogue?” — Chairman Michael S. Selig, Oct 28, 2026 VERIFIED C01

He also asked: “Do we need a new flavor of know-your-customer, maybe KYA or know-your-agent?” and noted that the CFTC's framework “was developed around identifiable market participants, intermediaries, and institutions.” He said CFTC staff already use these systems to police markets, and the agency will hold another roundtable on 24/7 trading on December 15. No rule, guidance, or enforcement action on AI trading agents was announced. VERIFIED C01 CITED C02

It is not one regulator. It is a pattern.

Bank examiners. Reuters reported on October 13 that the Fed, OCC, and FDIC asked banks whether they can track and audit agent decisions, shut agents down, limit what agents can do, name who monitors and approves agent actions, and keep people in key decisions. Sources described it as information gathering, not new expectations. CITED C04
Congress. On October 26, House Oversight Chairman James Comer asked Delaware Gov. Matt Meyer for documents on a draft “Artificial Intelligence Company” that an AI agent would run day to day, with liability protection for its capitalizer except for under-capitalization, fraud, or willful violation of law. Documents are due November 9. Delaware officials have said the aim is to “define where exactly liability lands.” VERIFIED C03
Banks themselves. A Forbes analysis on October 28 said some banks cannot reliably tell a customer from that customer's AI agent, and cited Axios reporting that Morgan Stanley has begun blocking unauthorized third-party agents while JPMorgan, Bank of America and Citi restrict them. A Morgan Stanley spokesperson said it had not seen “rogue AI agents” on its platforms. CITED C05
State supervisors. The Conference of State Bank Supervisors (CSBS) released an AI supervisory framework centered on a full AI inventory, including shadow and vendor AI, and on named AI risk ownership. CITED C06

Our take (opinion). The regulator's question is phrased about trading agents, but the evidence an examiner will want is the same in a bank, a hospital, or a plant: a written mandate for each agent, a tested way to stop it, and a named human who signed. Firms that can produce those three artifacts in a day will set the tone of their next exam. Firms that cannot will be answering the liability question after an incident instead of before it.

2. Why it lands on your desk

TensionOct 28: the CFTC chairman asks who is liable if an agent goes rogue. VERIFIED C01

StakeLiability maps are a legal artifact. When the examiner asks, the GC or CCO signs the answer. CITED C04

ProofMorgan Stanley blocks unauthorized agents (reported); Zocdoc admits only agents that register and identify themselves. CITED C05 VERIFIED C09

AssetThe examiner's three questions: nine evidence checks, mapped to the AEGIS Model.

AskVote in the poll below. Results in Friday's field note.

AEGIS = Agentic Enterprise Governance and Intelligence Standard, Ariana Digital's governance model. Pillar names from the live AEGIS page. PROPRIETARY · Source C23

3. Hero asset: the examiner's three questions

Tick what you could hand an examiner today, as a document, a log, or a test record. Score stays in your browser and is not sent anywhere. The questions paraphrase what regulators have said they are asking (Source C01, Source C04, Source C06); the evidence lists and pillar mapping are Ariana Digital's view. PROPRIETARY · Source C23

Question 1 · “On whose behalf is this agent acting?”

Maps to AEGIS Pillar 2 · AI System Inventory and Pillar 1 · Governance Architecture. Source of the question: C01 (“know-your-agent”), C06 (inventory).

An inventory that lists every agent, including vendor and customer-facing agents, with an accountable business owner. A written mandate per agent: what it may do, for whom, with which data, and what it must never do. A way to tell your own agents, customers' agents, and people apart in logs (an agent identity or registration step).

Question 2 · “Can you stop it, and when did you last prove it?”

Maps to AEGIS Pillar 4 · Controls & Human Oversight and Pillar 6 · Monitoring & Incident Response. Source: C04 (shutdown and limits).

A dated record of the last shutdown or revoke test, with time-to-halt. Hard limits enforced in code (scopes, spend, data access), not only in the prompt. An alert that fires when an agent changes its own permissions, logging, or monitors.

Question 3 · “Who is liable, and who signed?”

Maps to AEGIS Pillar 1 · Governance Architecture, Pillar 3 · Risk & Impact Assessment, and Pillar 5 · Transparency & Rights Management. Source: C01 (“who is liable”), C03 (where liability lands).

A named approver for each agent's go-live and for each scope change, with the date. Vendor contracts that say who bears loss when a vendor-built agent errs (review against the proposed interagency third-party guidance, comments due Nov 16). CITED C06 Customer-facing disclosures and consent records where an agent acts on a person's behalf.

0 of 9 ready

Tick the items you could produce today.

A printable one-page version: examiner checklist (HTML) · PDF. This checklist is a working aid, not legal advice, and does not certify compliance with any rule.

4. Poll: which proof would take you longest?

If an examiner asked tomorrow, which proof would take your firm longest to produce?

Your choice is shown here only. To be counted, vote on our LinkedIn or X poll or reply with A, B, C or D.

5. Case study: how a healthcare platform admits outside agents

On October 28, Zocdoc opened its scheduling infrastructure to AI agents that act for patients: agents can search providers, check insurance coverage, and book confirmed visits. It says it welcomes agents “that register and identify themselves,” and that agents must obtain “explicit patient consent before booking.” Connection paths are an MCP server, a REST API, llms.txt guidance, and deep links; Instinct is the first named agent partner. The release does not describe a formal approval process or other agent-side controls. VERIFIED C09 (company-reported)

Why a GC should study it: it is a public example of a firm answering Question 1 (whose behalf) at its front door rather than after the fact. Below is the implementation architecture as disclosed, with what is not disclosed marked, and the AEGIS control each element maps to.

Data sourcesProvider calendars, insurance acceptance, availability. Pillar 2 · AI System Inventory.

Models and agentsThird-party patient agents (for example Instinct) calling Zocdoc tools. Pillar 2, Pillar 3 · Risk & Impact Assessment.

OrchestrationMCP server and REST API; llms.txt tells agents how to behave. Pillar 4 · Controls & Human Oversight.

Human-in-the-loopExplicit patient consent before any booking. Pillar 5 · Transparency & Rights Management.

ControlsAgent registration and self-identification; provider-side verification. Not disclosed: scopes, rate limits, revocation. Pillar 4.

MonitoringNot disclosed. An examiner would ask for per-agent logs and a revoke path. Pillar 6 · Monitoring & Incident Response.

Mapping is Ariana Digital's analysis. PROPRIETARY · Source C23

6. Industry lens: four regulated sectors

Financial services

Know-your-agent arrives before the rule

Win The CFTC says its staff already use AI to police derivatives markets. VERIFIED C01

Risk Some banks cannot tell a customer from that customer's agent; agents log in with real credentials the customer handed over. CITED C05 In insurance, Pennsylvania's attorney general settled with GEICO in May over an AI-flagged policy cancellation made “without adequate notice”; the settlement points GEICO to state guidance based on the NAIC AI model bulletin. CITED C21

Action Stand up an agent register that separates first-party, vendor, and customer agents. File comments on the interagency third-party risk proposal by November 16 if agent vendors matter to you. CITED C06

Healthcare

Most health organizations cannot see their AI

Win Zocdoc admits patient agents only with registration and explicit consent (section 5). VERIFIED C09 Anthropic reported early, mostly preclinical drug-development results with partners; in one case human review time on 1,061 pages of manufacturing documentation fell 89% (company-reported). VERIFIED C11

Risk In a Clearwater Security survey of 150 health systems, plans, and tech firms, 91% cannot verify what AI is running and 14% verify vendors' AI safeguards. CITED C08 A wrongful-death suit filed against OpenAI alleges ChatGPT helped a patient plan to stop epilepsy medication; the claims are unproven. CITED C10

Action Inventory patient-facing assistants and their consent records. New York's AI companion bill for minors (effective January 1, 2027 if enacted) exempts customer-service-only bots, so scope your bots narrowly and document it. VERIFIED C07 FLAG C07 signing reported, not yet shown on the Senate record.

Manufacturing

Humanoids move from pilot to contract

Win Agility Robotics says Toyota Motor Manufacturing Canada signed a commercial agreement after a pilot, and reports more than $300 million in committed multi-year orders for Digit 5 (potential value, company-reported). VERIFIED C12

Risk The release names no specific safety standard or certificate for close-proximity work with people. VERIFIED C12 In software, more than 40% of GitHub pull requests now start as agent drafts (company-reported), which raises the volume of agent-written code headed into plant systems. CITED C17

Action (opinion) Before signing a humanoid or agent contract, require the named safety standards, the stop mechanism, and who bears loss in writing. That is Question 2 and 3, on a factory floor.

Energy

Grid rules catch up with AI load

Win NVIDIA and Oracle made Vera Rubin NVL72 systems generally available on Oracle Cloud and plan multi-gigawatt superclusters. VERIFIED C14 Microsoft's CFO said Azure “demand exceeds supply.” CITED C15

Constraint NERC's board adopted reliability standards for computational loads of at least 50 MW connected at 100 kV or more; NERC will file them with FERC. CITED C13

Action Utilities: map which large-load customers fall under the new standards and who owns the interconnection data. Data-center tenants: ask providers how load-protection coordination is evidenced.

7. Frontier lens: labs and platforms this week

7. Frontier lens: labs and platforms this week
Company	What happened	Why a GC or CCO cares
Microsoft	Fiscal Q1 2027 (reported Oct 28): revenue $92.3 billion, up 19%; Azure growth above 48%; new “Agents and Infra” segment $76.8 billion; Microsoft 365 Copilot users up 50% quarter over quarter. Source C15.	Agents are now how Microsoft reports its business. Expect agent features to arrive inside licenses you already hold.
Google	Gemini 4 Carbon (Oct 28): access limited to a subset of cyber defenders; Google says it is in the U.S. government's voluntary pre-release testing. Source C16.	A staged release with named access tiers is a pattern your own agent approvals can copy.
GitHub (Microsoft)	Octoverse (Oct 28): more than 40% of pull requests started as agent drafts in September, up from 17% in March; Copilot automations propose changes developers must approve. Source C17.	Approval of agent changes is a named human step. Keep the approver record.
OpenAI	Expanded ServiceNow partnership (Oct 29) connects authorized workflow actions to ChatGPT. Source C24. Separately, OpenAI will stop serving its models to Cursor after SpaceXAI's acquisition, by November 12. Source C18.	Model access can be withdrawn by contract. Your agent's mandate should name a fallback model and who approves the switch.
xAI / SpaceXAI / Cursor	Cursor CEO said OpenAI serves about 5% of Cursor customers; Anthropic said it will keep adding compute for Claude in Cursor. Source C18.	Vendor ownership changes are a third-party risk event. Re-paper the contract.
Anthropic	Filed an S-1 for a proposed IPO (Oct 26) and published early drug-development results (Oct 27, mostly preclinical). Source C19, Source C11.	Public-company disclosure will put Anthropic's own risk factors on the record.
NVIDIA	Vera Rubin generally available on Oracle Cloud (Oct 27). Source C14.	Compute concentration is a resilience question for critical workloads.
Meta	Research partnerships with five universities including UTHealth Houston on clinical records and cancer (Oct 29). Source C25.	Clinical-record research partnerships raise consent and data-use questions.
Chinese labs	Reuters, citing The Information, reported that DeepSeek and Moonshot AI used outputs from OpenAI's Astra to develop new models; methods not independently confirmed. Source C26.	Model provenance belongs in your inventory.
EU	The European AI Office sent its first AI Act requests for information to frontier-model providers after agent loss-of-control incidents (announced Oct 14). Source C20.	EU supervisors are asking the same “can you contain it” question.
Amazon, AMD, Palantir	No item in this edition's window met our sourcing bar.	Coverage balance is tracked across the week.

8. Workforce note

One data point: GitHub reports agents opened 110 million draft pull requests in September alone (company-reported). CITED C17 Every draft needs a person qualified to approve it. The examiner's Question 3 (“who signed?”) assumes that person exists and can show their judgment.

myndQ Skills Circuits “assess and coach the team you have,” and a circuit “ends when evidence is retrievable, not when a course is marked complete.” PROPRIETARY · Source C22 See how Skills Circuits work

9. Dates to watch (scheduled, not yet happened)

November 9, 2026: Delaware's document deadline from the House Oversight Committee. VERIFIED C03
November 12, 2026: OpenAI's latest date to stop serving models to Cursor. CITED C18
November 16, 2026: comments due on the proposed interagency third-party risk guidance. CITED C06
December 15, 2026: CFTC roundtable on 24/7 trading. CITED C02
January 1, 2027: effective date in New York's AI companion bill (S9051-B), if signed. VERIFIED C07

One action this week. Vote in the poll: which proof would take your firm longest? We publish the tally in Friday's Reg-Ready field note. Vote in the poll

10. Sources (ledger)

Accessed October 29, 2026. VERIFIED = primary source plus one independent source, or a first-party statement of its own action. CITED = named secondary source, not independently re-verified. Company-reported figures are labeled in the text.

C01 VERIFIED · CFTC, Chairman Michael S. Selig, “Remarks at Frontier Forum on Super Intelligence,” Oct 28, 2026. https://www.cftc.gov/PressRoom/SpeechesTestimony/opaselig14
C02 CITED · CoinDesk (Jesse Hamilton), “CFTC chief poses questions about policing AI,” Oct 28, 2026; TokenPost, Oct 29, 2026. https://www.coindesk.com/policy/2026/10/28/cftc-chief-poses-questions-about-policing-ai-but-calls-it-a-road-to-autonomous-trading · https://www.tokenpost.com/news/regulation/43230
C03 VERIFIED · House Committee on Oversight and Government Reform, letter to Gov. Matt Meyer re Artificial Intelligence Companies, Oct 26, 2026; WHYY, Sept 30, 2026. https://oversight.house.gov/wp-content/uploads/2026/10/Letter-to-Delaware-re-AIC_10.26.26.pdf · https://whyy.org/articles/delaware-artificial-intelligence-companies-state-proposal/
C04 CITED · ComplexDiscovery, summarizing Reuters (Oct 13, 2026), “US bank regulators ask whether lenders can stop their AI agents,” Oct 25, 2026. https://complexdiscovery.com/us-bank-regulators-ask-whether-lenders-can-stop-their-ai-agents/
C05 CITED · John Sviokla, Forbes, “AI Agents Are Already Inside Banks. Their Risk Framework Isn't Ready,” Oct 28, 2026 (cites Axios, Oct 22). https://forbes.com/sites/johnsviokla/2026/10/28/ai-agents-are-already-inside-banks-their-risk-framework-isnt-ready
C06 CITED · Ncontracts, “October 2026 Regulatory Update” (CSBS AI Supervisory Framework; proposed interagency TPRM guidance, comments due Nov 16, 2026), Oct 13, 2026. https://www.ncontracts.com/nsight-blog/october-2026-regulatory-update
C07 VERIFIED (bill text, status) / FLAG (signing) · NY Senate, S9051-B, status “delivered to Governor” Oct 28, 2026, effective Jan 1, 2027, up to $25,000 per violation; TechTimes reports Gov. Hochul signed it Oct 28, 2026. https://www.nysenate.gov/legislation/bills/2025/S9051 · https://www.techtimes.com/articles/329665/20261029/hochul-signs-chatbot-safety-law-that-reaches-chatgpt-claude-not-just-companion-apps.htm
C08 CITED · Chief Healthcare Executive, “Almost all health organizations don't know what AI they're using” (Clearwater Security 2026 Healthcare AI Benchmark, 150 organizations), Oct 28, 2026. https://www.chiefhealthcareexecutive.com/view/almost-all-health-organizations-don-t-know-what-ai-they-re-using
C09 VERIFIED (first-party) · Zocdoc press release, Oct 28, 2026. https://www.prnewswire.com/news-releases/as-others-put-up-walls-zocdoc-opens-its-doors-and-welcomes-ai-agents-to-reliably-connect-patients-to-care-302921530.html
C10 CITED · The New York Times, Oct 27, 2026; The Next Web, Oct 29, 2026 (allegations in a lawsuit, unproven). https://www.nytimes.com/2026/10/27/well/ai-chatgpt-medication-epilepsy-death.html · https://thenextweb.com/news/parents-sue-openai-chatgpt-seizure-medication
C11 VERIFIED (first-party, company-reported results) · Anthropic, “Early progress on accelerating drug development with Claude,” Oct 27, 2026. https://www.anthropic.com/research/early-progress-drug-development
C12 VERIFIED (first-party, company-reported) · Agility Robotics press release, Oct 26, 2026. https://www.financialcontent.com/article/gnwcq-2026-10-26-agility-robotics-highlights-commercial-momentum-and-growing-enterprise-demand-for-digit-humanoid-robot
C13 CITED · Utility Dive, “Reliability standards for AI data centers, crypto miners…,” Oct 15, 2026, updated Oct 27, 2026. https://www.utilitydive.com/news/reliability-standards-ai-data-centers-crypto-miners-pass-final-nerc-ba/833094/
C14 VERIFIED (first-party) · NVIDIA Newsroom, NVIDIA and Oracle expand Vera Rubin, Oct 27, 2026. https://nvidianews.nvidia.com/news/nvidia-and-oracle-expand-nvidia-vera-rubin-to-multi-gigawatt-scale-and-bring-nvidia-vera-cpu-to-oracle-cloud-infrastructure
C15 CITED · SiliconANGLE, Oct 28, 2026; InfotechLead, Oct 28, 2026 (Microsoft FY2027 Q1). https://siliconangle.com/2026/10/28/microsofts-stock-rises-on-solid-earnings-and-revenue-beat-with-azure-growing-48/ · https://infotechlead.com/cloud/microsoft-q1-fy2027-revenue-jumps-19-to-92-3-billion-profit-rises-32-as-azure-ai-cloud-growth-hits-48-99299
C16 VERIFIED (first-party) · Google, “Introducing Gemini 4 Carbon,” Oct 28, 2026. https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
C17 CITED · The Next Web, GitHub Universe and Octoverse coverage, Oct 28, 2026 (company-reported figures). https://thenextweb.com/news/github-universe-copilot-fusion-octoverse-agents
C18 CITED · Engadget, Aug 29, 2026; OpenAI, “Our decision on Cursor following its acquisition by SpaceX.” https://www.engadget.com/2246969/openai-pull-its-models-from-cursor-due-to-spacexai-acquisition/ · https://openai.com/index/our-decision-on-cursor-following-its-acquisition-by-spacex/
C19 VERIFIED (first-party) · Anthropic, “Anthropic files S-1 with the SEC for proposed initial public offering,” Oct 26, 2026. https://www.anthropic.com/news/s1-sec
C20 CITED · Unite.AI, Oct 14, 2026; European Commission speech by EVP Henna Virkkunen, Oct 14, 2026. https://www.unite.ai/eu-announces-first-ai-act-enforcement-actions-after-ai-agent-incidents/ · https://ec.europa.eu/commission/presscorner/api/files/document/print/en/speech_26_2150/SPEECH_26_2150_EN.pdf
C21 CITED · Clark Hill, “GEICO AI Settlement Signals Insurance Compliance Risks,” June 4, 2026. https://www.clarkhill.com/news-events/news/geico-ai-settlement-insurance-underwriting-compliance/
C22 PROPRIETARY · myndQ, home page (Skills Circuits language), read Oct 29, 2026. https://myndq.ai/home.html
C23 PROPRIETARY · Ariana Digital, AEGIS Model governance page (pillar names), read Oct 29, 2026. https://ariana.digital/AI-governance.html
C24 CITED · The Neuron digest, Oct 29, 2026, linking OpenAI, “OpenAI and ServiceNow expand partnership.” https://www.theneuron.ai/digest/everything-that-happened-in-ai-today-thursday-october-29-2026/ · https://openai.com/index/openai-servicenow-partnership-expansion/
C25 CITED · The Neuron digest, Oct 29, 2026, linking Meta Research, “Supporting medical and scientific research.” https://research.meta.ai/blog/supporting-medical-scientific-research
C26 CITED · Reuters via TradingView, citing The Information, Oct 2026 (methods not independently confirmed). https://www.tradingview.com/news/reuters.com,2026:newsml_P8N3P10CQ:0-moonshot-ai-and-deepseek-relied-outputs-from-openai-s-astra-when-developing-their-latest-models-released-this-month-the-information/