Specific conditions are moving into the foreground.
Anthropic is embedding evaluators; the SEC has set conditions for tokenised-stock trading; OSFI has published its 2027 market-risk chapter; and CISA has added exploited flaws.
Weekly brief / 20 Sept 2026
The conditions are the control.
Five public developments that make a simple point: a new platform, market route or control is only acceptable while the particular conditions that support it remain true.
Five-minute read / one-minute scan available
Weekly Judgement
Week ending 20 Sept 2026 · Edition 14
The conditions are the control.
What happened
Anthropic is putting independent evaluators inside its model-development process. The SEC has set conditions for tokenised-stock venues, OSFI has published its 2027 market-risk chapter, and CISA has added newly exploited vulnerabilities.
Why it matters
These are not broad policy tests. They bind a real activity to particular conditions: who can see the evidence, whether the underlying asset and rights match, how code is auditable, which data supports a risk measure, and how quickly a known exposure can be found.
What to do
Choose one live external platform or market workflow. Write down the two or three conditions that make it acceptable, name the evidence that shows they still hold, and take any breach — not a generic assurance update — to the next risk committee.
The weekly readout
Conditions, not comfort
The useful leadership question is not whether a proposal was approved. It is whether the few conditions that make it acceptable still hold in live operation.
The permission lives in the detail.
Access, rights equivalence, auditable code, reliable data and a known estate are not attachments to a control. They are the conditions that make the activity defensible.
Name the conditions.
Choose one live platform or workflow. State the two or three conditions that make it acceptable and the evidence that proves they hold now.
Bring the exception, if there is one.
Take a breached condition to committee with the source record, current fact pattern and a clear decision on whether the activity can continue.
Top 5
This week’s significant signals
Each title goes to the underlying publication. The Signals pages carry the wider source trail and retained material.
- 01
Embedded AI evaluation turns provider assurance into an access-and-independence question
- 02
SEC’s tokenised-stock exemption makes venue controls a condition of market access
- 03
OSFI’s 2027 market-risk standard sets a timetable for model and data evidence
- 04
Two newly exploited flaws test whether the asset inventory can drive emergency patching
- 05
BIS puts critical third-party dependence inside the cyber-resilience test
Which two or three conditions make one live platform or venue acceptable today?
Start with a real activity, not a framework.
The relevant rule or contract, the live record, the last challenge and any breach
Ask for the facts that prove the conditions hold.
Anthropic, SEC, OSFI, CISA and BIS
Each signal links to its primary source; the judgement is our editorial interpretation.
Deep Dive
The question beneath the week
For the issue that needs more than a weekly readout, follow the argument through to the control choices it creates.
It was never about the model. It’s about the harness.
What the FCA and FSB's latest warnings mean for remediation capacity, control design and correlated cyber disruption.
Reading the signals
Where the condition sits
Three short read-across points for the next leadership conversation.
Access determines whether assurance can be challenged.
An evaluator who cannot see the relevant safeguards, evidence and operating context cannot test a provider’s account of its own system.
A route to market can be conditional throughout its life.
For tokenised stock, rights, code, disclosure and market safeguards have to remain aligned; the original approval is only the starting point.
Evidence has to arrive at the speed of the risk.
Model and data implementation plans, and emergency patching, fail in the same place when the current estate cannot be found and evidenced in time.
Executive challenge
Three questions from the week
Carry one into a committee, 1:1 or control review.
- Which conditions make this platform, model or market route acceptable — and where is the live proof?
- Who has enough access and independence to challenge that proof when the arrangement changes?
- What would tell us that a condition has failed, and who decides whether the activity pauses or continues?