AI agents and client instructions: UK and Singapore regulators sharpen the questions

The brief

Two developments put the handling of AI-assisted decisions under closer examination. The UK ICO opened a call for evidence on agentic AI on 8 October, closing on 20 November. Singapore’s MAS issued financial-sector AI risk guidelines on 7 October, with phased implementation in 2027 and 2028. ICO consultation; MAS announcement.

Their status and jurisdictions differ. Our shared operational question is narrower: when an AI system can read a client file, what authorises it to send a message or act on an instruction? Firms should define those permissions separately and preserve the approval for the exact action. A useful test is whether the system stops when a draft changes after a person has approved it.

The full record

The ICO is gathering evidence to inform its approach to agentic AI. Its questions cover security, transparency, accountability, automated decisions, fairness, purpose limitation and lawful processing. This is an evidence-gathering exercise, not a certificate that a particular agent complies with data protection law. Source: ICO call for evidence.

MAS’s final guidelines set supervisory expectations for financial institutions across AI technologies, using a risk-proportionate approach. Its announcement emphasises oversight, inventories of AI use, testing, human oversight and accountability for third-party systems. Sections 3–4 are to be met from 7 October 2027 and sections 5–6 by 7 October 2028. Source: MAS announcement and implementation timetable.

Our analysis: separate reading, drafting and acting

Imagine an assistant that can retrieve a mandate, prepare a client message and send it. Those three capabilities deserve separate decisions. Access to the mandate answers what the assistant may read. Permission to draft answers what it may prepare. Neither, by itself, answers whether it may contact a recipient or commit the firm to an instruction.

Define a release approval around the recipient, content, attachments and intended action. If a material element changes, the earlier approval should no longer silently cover it. Record the version approved and the version actually sent so a discrepancy can be investigated.

Ask for evidence from the provider

A provider’s general statement that a human remains in control is insufficient for a particular workflow. Ask where the control operates, what the reviewer sees and whether an agent can alter the action afterwards. Establish what happens if a tool times out: a retry should not accidentally send a second instruction or repeat an action already completed.

Use fictional data to test refusal and recovery. Give the assistant permission to prepare a letter, then ask it to send the letter to a different recipient. Check that it stops. Interrupt an action and verify that the system can distinguish “not attempted”, “completed” and “outcome unknown”. These are proposed acceptance tests, not findings from tests we have conducted.

Keep the record proportionate

Preserve the instruction, the relevant approval and the outcome, with access limited to those who need it. More logging is not automatically better if it copies sensitive client material into an unnecessarily broad audience. The aim is to explain who authorised a consequential action and what happened when it ran.

We checked the ICO’s call for evidence and MAS’s final-guidelines announcement and landing page. We distinguish a UK consultation from Singapore supervisory expectations and their phased dates. The permission model and fictional tests are editorial proposals, not regulator-prescribed formats or product benchmarks.

1. ICO agentic AI call for evidence, 8 October 2026
2. MAS AI risk management announcement, 7 October 2026
3. MAS guidelines landing page