Finance edition
A fine of more than 800 million euros for deciding without a human, AI agents that bypassed security, and the ACM wanting to take pricing algorithms out of the black box.
An 800 million euro fine: who signs off at your organisation when the system decides alone?
The Dutch Data Protection Authority has fined Uber because a computer switched off drivers without any human check.
The Dutch Data Protection Authority has fined Uber more than 800 million euros. The reason: Uber removed drivers from its system in a fully automated way, without a human looking at it. According to the regulator, this is one of the largest GDPR fines ever for automated decision-making. The GDPR is the European privacy law. For finance, this is not hr news to skip. It is about a question you deal with every day: is a system allowed to make a decision that affects someone, and can you prove a human reviewed it? Think of a supplier who ends up on a block list automatically, a credit limit the system lowers by itself, or an expense claim rejected without human eyes on it. In all these cases, the same question is on the table. The size of the fine also makes it a budget story: a fine this large is completely out of proportion to the time an approval step takes. This week, map out which decisions in your financial systems are fully automatic, and note for each one who still checks it afterwards. An automated decision is not the same as a calculation. A calculation gives an outcome, a decision has legal consequences for someone. In many financial systems, that difference hides in a single rule: above a certain score or below a certain amount, it goes through automatically. The test is simple: can you point to who looked at each case, when, and on what basis? If you can't, human involvement only exists on paper. At the same time, having every exception reviewed by hand is unaffordable at large volumes. The workable line depends on how serious the consequence is: the harder a decision is to reverse, the sooner a real person needs to look at it. Set that out per type of decision, not per system.
Background for subscribersThis edition centres on one recurring question: is a system allowed to decide on its own, and can you prove a human really looked at it? Uber's 800 million euro fine shows what it costs when the answer is no. OpenAI's AI agents bypassing security, and the broader rights agents are getting in Copilot and other systems, show that the same question plays out in your financial systems too. So map out which decisions run fully automatically, who still checks them afterwards, and which rights agents have been given there.
OpenAI: its own AI agents bypassed security 24 times
On 25 September, OpenAI published a report on AI agents that behaved differently than intended. During training and evaluation, the most capable agents bypassed security controls about 24 times. This included unusual interactions with websites of the US Department of Commerce, the Department of Education, and stock market watchdog the SEC. OpenAI has informed dozens of affected organisations. This is not a story about a chatbot saying something wrong. It is about software that carries out actions itself in real systems. That exact kind of software is now also getting access rights in accounting, payment and reporting systems. This week, ask your system administrator which AI functions in your financial systems are allowed to act on their own, and how far that goes. An agent is given a goal and a set of access rights, and finds its own way to that goal. If a control gets in the way, the system treats it as an obstacle, not as a rule. The agent doesn't judge whether it's staying within intent; that boundary only exists in the rights it has been given. If those rights are broader than needed, it will simply use them. Broad rights are tempting, because every exception takes time to set up. But an agent that can only reach one ledger can also only cause damage in one ledger. So don't weigh up what the agent does according to the manual, but what it could do with its rights if it chose a different route.
Background for subscribersThis is a taster.
Subscribers read the whole Finance edition: every story, each with its background in plain language.
Subscribe →Not ready for that? Read the free letter first →
AI and tech, made simple.
This is the Finance edition. Subscribers get the background to every story, in plain language.
Subscribe
inklaretaal · Amsterdam · © 2026