Supervisory Addendum: From Frontier-AI Expectations to Action Authority

Download the complete addendum and evidence record (PDF).

Published online on 11 September 2026. The editorial edition and evidence cutoff are preserved below.

How dated supervisory expectations connect to one bounded defensive-action record

8 September 2026

Editorial successor to the 4 September 2026 edition. The evidence cutoff and source-review date remain 4 September 2026.

Purpose

Five European texts published between late June and the end of July 2026 point in the same direction without doing the same legal work. One is a systemic-risk warning, one is a direct supervisory letter to significant institutions, two set wider policy and supervisory expectations, and one is national supervisory guidance. Read together, they make frontier-AI cyber risk harder for a financial institution to leave as an unowned observation.

They do not, however, supply one new universal rule for automating defence. An action plan still has to answer a different question: what may one named defensive action do in production, to which controlled object, under whose authority, with what recovery path and with what consequence owner? This addendum connects that supervisory demand to the decision method in Autonomous Defensive Action: How Buyers Decide Action Authority and Accountability.

What arrived

The source and wording limits behind these summaries are recorded in the accompanying Evidence Record — Supervisory Addendum. That record is part of this addendum, not an optional bibliography.

Which supervisory or national clock reaches you

The 31 October deadline belongs to the ECB letter and therefore to the significant institutions it addresses. It does not automatically become a local legal deadline for every subsidiary or for every institution outside direct ECB supervision. A parent may translate it into a group requirement, but the local entity still needs a named owner, an applicable basis and its own delivery date.

Outside that direct route, the clock depends on the instrument and the duty. In Poland, the amended national cybersecurity act entered into force on 3 April 2026. Existing entities that qualify under its transitional rule have twelve months to implement the Chapter 3 obligations, and existing key entities have twenty-four months to complete the first audit; the registration request follows the ministerial schedule rather than one universal six-month date. For financial entities, DORA may operate as the sector-specific rule for equivalent duties, but it does not erase every NIS2 or national obligation by label alone.

In Czechia, Act 264/2025 Sb. entered into force on 1 November 2025. The reviewed official materials use a sixty-day service-notification clock and a one-year implementation period measured from delivery of the registration decision. The entity, regulated service and delivery event therefore have to be identified before anyone converts those periods into calendar dates.

Other jurisdictions are intentionally omitted from this edition. Their dates and applicability triggers require the same atomic legal record as Poland and Czechia; a signpost without that record would look more useful than it is.

The decision gap inside an action plan

The reviewed texts focus chiefly on how frontier models change the threat and on how institutions and supervisors should respond. None of the five reviewed texts expressly names the defender-side controlled object on which a production action would operate. That is a bounded finding about this declared five-text basket as reviewed on 4 September 2026, not a claim that no law, supervisor or contract addresses the issue anywhere.

The distinction matters. A plan can be fully responsive at programme level and still contain a measure that nobody can safely authorise: “automate containment”, for example, says nothing about the object, trigger, blast radius, approval path or restoration obligation. The report’s four decision questions and nine-field record turn that programme measure into a decision that can be monitored, challenged and reopened.

Mapping the expectation to the record

Programme delivery block required alongside the action record

The action record controls the authority for one production action. It does not by itself constitute the resource plan or implementation schedule requested in a programme-level action plan. Complete the following three blocks for every measure in that plan, or maintain equivalent fields in the institution’s programme system with a stable reference from the measure.

Field 4 clocks measure evidence freshness and decision validity; they are not an implementation timetable. Field 9 expiry, reopen conditions and decision date govern the action record and likewise do not show delivery progress. Implementation progress belongs in the milestones block below.

Resources

Milestones and implementation timetable

Completion evidence

Use one separate completion-evidence card for each measure or milestone.

A programme may share a threat assessment, policy owner or reporting cadence across measures. Its authority does not aggregate in the same way. Four production-changing measures normally require four action records, because each acts on a different object or carries a different trigger, scope or recovery path. Later records should become cheaper as common evidence is reused by reference, but no result widens itself.

The same applies when a security operations centre is outsourced. The provider may perform the operational role, but consent, escalation, recovery, restoration cost and the business-service owner remain interfaces the institution must be able to name. A contract does not dissolve the authority boundary; it makes the boundary more important.

Legitimate results that are easy to overlook

Incumbent sufficient — No action. Existing controls meet the same material threshold on the same scenario, object, population, clock and exclusions; no further action is warranted on the current evidence.

Unresolved is different. It means a measurement or condition needed to answer the question is still missing. The plan should name that item, its owner and the date on which the question reopens; if the action record cannot yet close, Field 9 records DEFER. Missing evidence must not be relabelled as No action simply to make the plan look complete.

No action is also legitimate where the question has been answered and nothing further is warranted under the current evidence. It is terminal on that evidence, while Unresolved remains open.

At record level, the vocabulary changes deliberately. AUTHORISE permits only the exact action, class, object, scope, owners, limits and expiry that passed. DEFER leaves existing authority unchanged while a named item remains open. WITHHOLD grants no action authority because a required condition has failed. These decision values do not replace the question outcomes, and the question outcomes do not quietly authorise a plan measure.

What weakens a plan

• Comparing suppliers before the action, object, threshold, owner, rollback and recovery requirements are defined.

• Treating investigation, recommendation and a production change as one automation choice, although they carry different authority and consequences.

• Treating a reversible command as operationally recoverable without a tested route back to state parity inside the required recovery time.

• Treating Incumbent sufficient — No action, Unresolved or DEFER as drafting failures and replacing them with procurement activity that the evidence does not support.

An internal-audit or independent-assurance reader has a simple route through the finished artefact: start with the Field 9 decision, expiry and reopen conditions, then trace every condition back through Fields 1–8 to dated evidence and a named owner. Audit tests the route; it does not become the operational decision owner.

Status and limits

This editorial successor is dated 8 September 2026 and follows the separately maintained evidence record with a 4 September 2026 cutoff. It does not retroactively change the underlying report’s 31 August 2026 evidence date. Supervisory and national positions can move quickly; an expired source loses current-status use even where the dated historical fact remains sound.

This document is neither legal advice nor a compliance template, and it grants no authority. Applicability, legal deadlines and group-to-entity routing require current review for the named entity, service, duty, jurisdiction and date.

Companion to Autonomous Defensive Action: How Buyers Decide Action Authority and Accountability (Ascendo Analytics, 31 August 2026). The four decision questions appear in sections 4–7; the nine-field record is Annex D. ascendoanalytics.com

Evidence Record — Supervisory Addendum

Declared basket, source boundaries and current-use status

Cutoff: 4 September 2026

How to read this record

Each row states the most the cited source can carry for this addendum. A FACT records a source property or dated event. INTERPRETATION applies the report’s method to named facts. NO_DATA records only a bounded absence inside the declared basket and date; it never means universal absence. “Current” means usable as at the cutoff, subject to the review trigger shown.

S1 — ESRB warning

S2 — ECB Banking Supervision letter

S3 — European Commission action plan

S4 — UKNF recommendations

S5 — Joint ESA statement

S6 — Defender-side controlled object

S7 — Poland’s national implementation clock

S8 — Czechia’s national implementation clock

Record boundary

This record supports only the companion addendum dated 4 September 2026. It does not alter the 31 August 2026 cutoff of the underlying report, determine legal applicability for an unnamed entity or authorise an action.

Related work

Read about Autonomous Defensive Action: How Buyers Decide Action Authority and Accountability and the separately licensed Defensive AI: a dated supply-side landscape. For licence enquiries, email contact@ascendoanalytics.com.