13 Nov 2026

United is restricting unauthorised personal AI agents on its channels. It cites unintended purchases, exposed account information and regulatory requirements. Analysts in the piece say inconsistent standards, and the difficulty of telling a bot from a customer, make automated transactions hard to support.

I think United is right for now, and lenders will reach the same place faster. An airline that sells the wrong seat can refund it. A lender that accepts an application an agent filled in, with an income figure the customer never checked, has a creditworthiness problem and a Consumer Duty problem with a named senior manager attached. Blocking bots outright is the easy answer. It will also look dated quickly if customers start arriving through agents as a matter of course.

The useful work is deciding what an agent may do in your journey before one turns up. Take your point of sale application flow and mark each step as agent-safe, agent with customer confirmation, or human only. Declarations, affordability answers and signing the credit agreement almost certainly sit in the last group. Quotes and eligibility checks probably do not. Write that down now and you have a policy rather than a scramble.

A Microsoft 365 outage on 12 November disrupted email, Teams features and admin tools including Intune. Microsoft reported failing server health checks and an overwhelmed server process, and recovered by rerouting traffic and restarting servers.

Most lenders map their important business services around the loan platform, the payment rails and the credit bureau link. Few map them around the productivity suite, yet that is where complaints arrive, where retailer queries land and where staff approve exceptions. When Outlook and Teams go down together the core systems can be perfectly healthy while the operation quietly stops. Under the FCA's operational resilience rules, what counts is whether the customer is served within tolerance, wherever the failure sits.

The test is simple and slightly uncomfortable. Pick a normal Tuesday and ask how your complaints team would acknowledge a complaint, and how a retailer would chase a stuck application, with no Microsoft email and no Teams for four hours. If the honest answer involves personal mobiles and WhatsApp, you have a resilience gap and a record-keeping gap at the same time. A second channel, a published phone line and an agreed status page cost very little by comparison.

The EU's proposed Digital Fairness Act would ban dark patterns and hard-to-cancel subscriptions, and restrict loot boxes and other pay-to-win tactics that push minors to overspend. Fines could reach six percent of global revenue, and the Commission would gain direct powers to investigate large-scale cases instead of leaving it to member states.

UK firms sit outside it, but the direction is the point. Consumer Duty already expects firms to avoid sludge and to make leaving a product no harder than joining it, and the FCA has used that word in its own guidance. What the EU proposal adds is a list and a very large fine. That tends to sharpen how compliance teams read the softer UK wording, and it gives customers and claims firms a ready vocabulary for complaints.

In point of sale finance the places to look are pre-ticked add-ons, the term chosen by default, and the route to withdraw within fourteen days or settle early. Try this: time how long it takes a customer to find and use the withdrawal right online, then compare it with how long the application took. If one is three minutes and the other is a phone call during office hours, that gap is your dark pattern.

Jensen Huang has resigned as Nvidia's chief executive after the revelation of two extramarital affairs. Finance chief Colette Kress is interim CEO while the board considers internal and external candidates, and long-time director Harvey C. Jones has been appointed the company's first ever chair. Huang had previously said he did not believe in succession planning.

The telling detail is that the board had to create a chair role in the middle of a crisis. Founder-led firms, including plenty of UK fintechs and lenders, run on one person's judgement and relationships, and boards often defer to that. It works well until the day it stops, and then funders, retailers and the regulator all want to know who is in charge by the afternoon.

For an FCA-regulated firm this should already be written down. SM&CR expects a clear allocation of responsibilities, and you should be able to say who holds the chief executive function if the current holder leaves on a Monday. A good test for any board: name the interim CEO, the person who rings the lead funder and the person who speaks to the FCA, without looking anything up. If every answer depends on the founder being reachable, the plan is unfinished.

Microsoft's FORGE Lab spent two weeks pointing AI models at Linux kernel subsystems and got 26,502 raw findings. That narrowed to 621 with working proofs of concept, then 59 upstream reports, 33 CVEs and eight working root exploits. The bugs had sat in the kernel for an average of 8.1 years. The slow part was repair: a median of 41 days per fix, and only 38 patches merged five months later.

Microsoft's argument is that discovery now far outpaces repair, and I think that should change how lenders plan. If finding a serious flaw is cheap for defenders, it is cheap for attackers too. The gap between disclosure and exploitation narrows, while many firms still patch on a monthly change board. Today's critical Apache HTTP/2 flaw, rated 9.8, is the sort of thing that will keep arriving.

So measure your real patch time. Take the last three critical vulnerabilities that applied to your estate, including those in suppliers' platforms, and record the days from advisory to fix in production. If the median runs past a month, the bottleneck is process and contracts rather than technology. Give criticals a faster change route, and make supplier patch timelines a clause someone actually checks at the quarterly review.