Regulators: AI Traders Must Name Responsible Humans

Regulators, exchanges and market participants are pushing for rules that require a named natural person to accept legal responsibility for automated trading driven by machine learning. The proposals aim to clarify who is accountable when algorithms place orders that affect markets.

The debate references past incidents such as the May 6, 2010 flash crash and the 2012 Knight Capital software error. Officials point to advances in adaptive machine-learning models that can behave in non-deterministic ways as a reason for tighter controls. The European Union’s draft AI rules classify some financial systems as high-risk and call for human oversight, documentation and transparency. U.S. agencies including the SEC and the CFTC have issued guidance and enforcement actions relating to algorithmic trading and are discussing additional measures.

Regulators are considering measures that include requiring a named person to accept responsibility for an algorithm’s behaviour, mandatory record-keeping and explainability for models used in trading, periodic third-party audits, stress testing under extreme market conditions, and limits on autonomous learning in live production environments. Officials want firms to demonstrate oversight arrangements and intervention plans when algorithms could materially move prices or affect market integrity.

Trading venues, broker-dealers and banks already use safeguards such as pre-trade risk limits, real-time surveillance and automated kill switches. Firms apply model risk-management frameworks that require validation, version control and backtesting. Some exchanges require algorithm identifiers and simulated testing before strategies run on live markets.

Market participants report that many controls are standard at institutional firms but that some machine-learning methods resist full technical explainability. Model developers point to practices such as versioned code repositories, access controls and incident response procedures as ways to show who had responsibility at each stage of a model’s life cycle. Compliance teams say they are investing in tools that link model outputs to human approvals and that record decisions to deploy, pause or retire strategies.

Regulatory authorities have identified enforcement paths including fines, trading suspensions and orders to improve controls. Legal advisers note that clearer assignment of responsibility would simplify the application of anti-fraud and market manipulation laws when automated systems are involved in prohibited behavior.

Firms are updating internal policies. Risk teams are setting stricter change-management rules, requiring pre-deployment approvals and post-deployment monitoring that produce searchable logs. Some firms are naming an “algorithm owner” whose contact details accompany registrations with exchanges or regulators.

“Human oversight must be demonstrable and traceable,” wrote a regulator involved in recent consultations. Policy papers circulating among authorities emphasize traceability of model decisions, access to training data records and retention of runtime logs for defined periods as part of oversight and post-incident review.