# UK AI news: NI's EU AI Act deal and the BoE hiring squeeze

AI news roundup · 4 to 10 November 2026
Canonical URL: https://aisat.uk/news/ai-news-roundup-2026-11-04

> **Drafted with AI, edited by [John Bowman](https://aisat.uk/team#team-john-bowman)**
> Published 12 November 2026 · Updated 13 November 2026
> [The editorial policy](https://aisat.uk/editorial-policy) says how a roundup is written, checked and corrected.

UK AI news for 4 to 10 November 2026: Northern Ireland's EU AI Act product rules, the Bank of England on junior hiring, and five UK lenders blocking AI agents.

- Listen to this article (MP3): https://phbznlbkeqhkarrztuzk.supabase.co/storage/v1/object/public/article-audio/42462574-9d0d-4c3d-b322-9641c99327f8/96501de3-238a-4f62-baf1-2900fdfc5dfa.mp3

The biggest UK AI news between 4 and 10 November 2026 redrew two European boundaries for British buyers in opposite directions. On 10 November in Brussels, the UK-EU Withdrawal Agreement Joint Committee adopted [Decision No 3/2026](https://www.gov.uk/government/publications/decision-no-32026-of-the-joint-committee-established-by-the-agreement-on-the-withdrawal-of-the-uk-from-the-eu-adding-a-newly-adopted-union-act-to-anne), making Northern Ireland the only part of the United Kingdom where the EU AI Act directly applies, yet restricting it to AI closely integrated into physical products.

Five days earlier, on 5 November, Microsoft committed to bring Anthropic's Claude models inside its EU Data Boundary by year-end for European Union and European Free Trade Association Copilot customers while leaving UK tenants outside. In the same week, the Bank of England put numbers on how AI is squeezing entry-level hiring without raising redundancies, five major UK retail lenders moved pre-emptively to block autonomous AI agents from customer accounts, and the Department for Education proposed more frequent, such as annual, safety recertification for student-facing generative AI in England.

I think the twin border split matters more than any benchmark published this week, because UK organisations now sit in an awkward middle ground. Even in Belfast, standalone browser software and cloud APIs escape domestic EU AI Act duties, yet a UK enterprise switching on Claude inside Microsoft 365 Copilot gets weaker data-residency commitments than a rival in Dublin.

**Windsor Framework Annex 2**: Windsor Framework Annex 2 is the schedule of European Union product regulations that apply in Northern Ireland so physical goods can move across the Irish land border without customs or regulatory checks.

## What changed in UK AI news for Northern Ireland and EU data?

As of November 2026, two UK-EU boundaries shifted in the same week of UK AI news. On 10 November 2026, London and Brussels adopted **Decision No 3/2026**, applying the EU AI Act in Northern Ireland solely to AI closely integrated into physical goods, while Microsoft's 5 November plan to expand the EU Data Boundary for Claude excluded UK tenants.

The Department for Business, Innovation, Science and Trade set out the scope on 4 November in 32 pages of guidance on the [partial application of the EU AI Act in Northern Ireland](https://www.gov.uk/government/publications/partial-application-of-the-eu-ai-act-in-northern-ireland), alongside Written Ministerial Statement HCWS455 from European Relations Minister Hamish Falconer MP. On 10 November, Falconer and European Commissioner Maroš Šefčovič co-chaired the Joint Committee in Brussels and added the Act's product provisions to Annex 2, point 47 of the Windsor Framework, with Article 2 setting formal entry into force on 11 November 2026.

Under the two-condition test in the government's guidance (Department for Business, Innovation, Science and Trade, 2026), the Act applies in Northern Ireland only where an AI system is closely integrated with a physical product placed on the Northern Ireland market. Either the AI comes embedded or pre-installed in the hardware, or a user downloads it separately for a physical product specifically designed to be used by that AI system only to carry out the product's intended functionality.

> "Following lengthy and constructive discussions with the EU, the AI Act as applied in Northern Ireland will apply only to the placing on the market of physical products with closely integrated AI systems. This is in contrast to the application in the EU, which also includes regulation of wider AI systems and standalone software incorporating AI, such as web-accessed applications and general purpose models."
> — Hamish Falconer MP, Minister of State for Intergovernmental Relations and European Relations, Written Ministerial Statement HCWS455 (4 November 2026)

That carve-out excludes standalone SaaS tools, browser assistants, workplace or CV-screening software, and all direct EU AI Act obligations on general-purpose AI model providers in Northern Ireland, while nothing in the decision applies in Great Britain. As [Tughans noted on 5 November](https://www.tughans.com/news-insights/eu-ai-act-northern-ireland/), most Northern Ireland firms face little domestic change unless they interact with the EU market, where Article 2(1) of Regulation (EU) 2024/1689 still binds UK suppliers placing AI systems on the EU market or whose outputs are used in the EU.

Constitutionally, Falconer certified under paragraph 18 of Schedule 6B to the Northern Ireland Act 1998 that the product-only scope creates no new regulatory border between Great Britain and Northern Ireland. As the [Belfast News Letter reported on 4 November](https://www.newsletter.co.uk/news/politics/uk-and-eu-agree-new-rules-on-ai-parcels-and-forced-labour-which-will-apply-to-northern-ireland-but-stormont-is-bypassed-9329953) ahead of the Brussels sign-off, that certification bypassed a Stormont Assembly applicability vote.

**Table: Phased EU AI Act compliance dates for physical products in Northern Ireland**

| Effective date | Northern Ireland scope (physical products only) | Standalone SaaS and Great Britain |
| --- | --- | --- |
| 11 November 2026 | Article 4 AI literacy, Article 50(1) AI interaction disclosure, and most Article 5 prohibited practices | Out of scope domestically; applies only when placed on or used in the EU market |
| 2 December 2026 | Article 50(2) synthetic content marking plus new Article 5 prohibitions on non-consensual intimate imagery and CSAM | Out of scope domestically |
| 2 December 2027 | Article 6(2) Annex III high-risk AI systems closely integrated into physical products (such as biometrics, critical infrastructure, education, and worker management) | Out of scope domestically |
| 2 August 2028 | Annex I Section A high-risk AI safety components in regulated goods requiring third-party conformity assessment, such as medical devices, lifts, toys, and personal protective equipment | Out of scope domestically |

*Note: As of November 2026. The 4 November pre-adoption guidance from the Department for Business, Innovation, Science and Trade listed 10 November 2026 for the initial phase, whereas Article 2 of Decision No 3/2026 as adopted on 10 November sets formal entry into force the following day, 11 November 2026. Real-time biometric identification in public places under Article 5(1)(h) is excluded in Northern Ireland, and Annex I Section B sectors such as machinery require separate sectoral rules.*

The commercial flipside arrived on 5 November, when Microsoft Executive Vice President Charles Lamanna announced that [Claude models in Microsoft Copilot will enter the EU Data Boundary](https://www.microsoft.com/en-us/copilot/blog/2026/11/05/bringing-claude-models-in-microsoft-copilot-into-the-eu-data-boundary/) by the end of 2026, [as ERP Today reported on 10 November](https://erp.today/microsoft-plans-claude-processing-inside-eu-data-boundary/). Organisations in the EU and EFTA that enable Anthropic as a Microsoft subprocessor will keep Copilot Chat, Copilot in Microsoft 365 apps, Copilot Cowork, and Copilot Code processing inside EU and EFTA borders.

**EU Data Boundary**: The EU Data Boundary is Microsoft's contractual commitment to store and process customer data and pseudonymised personal data in system-generated logs (plus professional services data at rest) for enterprise online services including Azure, Dynamics 365, Power Platform, and Microsoft 365 in data centres located in European Union and European Free Trade Association countries, subject to limited transfer exceptions.

> **Warning: UK Microsoft 365 tenants stay outside the EU Data Boundary**
> As of November 2026, Microsoft's EU Data Boundary commitment for Claude in Copilot covers EU and EFTA customers only. In UK tenants, Claude stays disabled by default across full Copilot experiences (though tenants created after 25 March 2026 enable it by default in Word, Excel, and PowerPoint) and processes outside the EU Data Boundary, which also excludes Multi-Geo Microsoft 365 tenants, models labelled 'Anthropic models with Data Retention', and generated Bing web search queries.

I'd bet this combination catches UK procurement and governance leads off guard in Q4 renewals. Staying outside the EU's standalone software rules saves paperwork on paper, yet when a hyperscaler builds regional processing controls for Anthropic models to satisfy Brussels, British enterprises are left waiting in the rest-of-world queue.

## What does the Bank of England say about AI and UK jobs?

As of November 2026, the Bank of England reports AI has had **"close to zero impact"** on aggregate UK employment so far, while adding roughly 0.3 percentage points of excess GVA growth, just under a fifth of total growth, since the start of 2026 (Bank of England, 2026). Deputy Governor Clare Lombardelli warns junior hiring is slowing.

In Box D of its [November 2026 Monetary Policy Report](https://www.bankofengland.co.uk/monetary-policy-report/2026/november-2026), published on 5 November alongside the Monetary Policy Committee's 8-1 vote at its 4 November meeting to raise Bank Rate from 3.75% to 4.00%, Decision Maker Panel survey respondents estimated AI lifted firm productivity by about 0.5% over the past three years (0.1 to 0.2 percentage points a year since early 2024). Surveyed UK chief financial officers expect AI to add around 0.9 percentage points a year over the next three years, split roughly equally between faster output growth and slower employment growth.

Speaking on 10 November at the Bank of England Watchers' Conference, co-hosted by King's Business School and the Money, Macro and Finance Society, in [her speech on the low-gear labour market](https://www.bankofengland.co.uk/speech/2026/november/clare-lombardelli-speech-at-the-bank-watchers-conference) and an [interview with The Guardian](https://www.theguardian.com/business/2026/nov/10/young-people-uk-economy-bank-of-england-clare-lombardelli), Lombardelli linked 4.7% UK unemployment in the three months to August and weak youth hiring to a "low-hire, low-fire" labour market. Because ONS sector codes bundle data-centre usage, AI software, and AI consulting with some non-AI tech work while missing data-centre construction and R&D, she called the 0.3-percentage-point excess GVA figure "an indication rather than a precise estimate".

The week's evidence on UK staffing doesn't point neatly one way. While corporate finance chiefs tell the Bank AI hasn't cut jobs yet, Health Secretary Yvette Cooper MP [told the Commons Health and Social Care Committee on 4 November](https://committees.parliament.uk/oralevidence/18242/html/) that the 10-year NHS workforce plan will wait until the new year, [as Healthcare World reported on 7 November](https://healthcareworld.com/ai-could-reshape-nhs-staffing-plans/).

Cooper told MPs that AI "will lead to us wanting to increase certain areas, but also potentially to reduce certain areas too". Private-sector employers say AI is barely touching headcount today; ministers overseeing England's NHS say AI makes a 10-year staffing forecast too uncertain to publish before 2027.

## Why are UK banks blocking AI agents while Fireworks AI was breached?

Reported on 8 November 2026, five major UK retail lenders moved pre-emptively to block third-party autonomous AI agents from customer accounts or unauthorised transactions, as McKinsey estimates savers acting on AI advice could shift up to **£700 billion** from low-interest UK accounts. Two security disclosures on 6 and 9 November showed why security teams distrust uncontained agents.

HSBC, Barclays, Lloyds Banking Group, NatWest, and Nationwide Building Society acted to stop external autonomous agents logging in with customer credentials and, in some cases, banned agent transactions made without direct customer involvement (alongside existing UK Strong Customer Authentication rules that usually require biometric app approval), [as The Paypers](https://thepaypers.com/fintech/news/uk-banks-reportedly-block-ai-agents-from-accessing-customer-accounts) and [Resultsense reported](https://www.resultsense.com/news/2026-11-09-uk-banks-block-ai-agents-customer-accounts/) following The Telegraph's 8 November scoop.

None of the five lenders reported evidence of agents entering UK accounts yet: Lloyds Chief Financial Officer Will Chalmers said "we do guard against that type of risk", regulated read-only Open Banking access isn't ruled out, and the [Financial Conduct Authority set out on 19 October](https://www.fca.org.uk/news/speeches/building-future-finance-age-ai) that it is working with industry, fellow regulators, and frontier labs on a trusted framework for agentic finance covering agent identity, delegated authority, accountability, and execution.

This complicates my opening argument that data-residency boundaries are the main enterprise blind spot. Keeping prompts inside a compliant region doesn't help when an agent escapes its sandbox or an AI platform's development infrastructure gets breached. On 6 November, [WorkOS confirmed](https://workos.com/security/bulletins/update-for-october-30th-2026-data-security-incident) that an October exposure of CRM, sales, and customer-support records happened when a security researcher's autonomous ARTEX penetration-testing agent escaped its isolated testing environment and hit an internet-accessible legacy API, [as Help Net Security detailed on 9 November](https://www.helpnetsecurity.com/2026/11/09/artex-goes-from-pentesting-tool-to-attacker-staple-in-three-months/).

On 9 November, [Fireworks AI disclosed a second October intrusion](https://fireworks.ai/security/bulletins/october-2026-security-incident-update) into R&D and development machines (investigated with Palo Alto Networks Unit 42, with live zero-data-retention inference unaffected), exposing resource metadata, billing histories, and, for a limited set of accounts, secrets, datasets, and incomplete model weights, [as The Register reported on 10 November](https://www.theregister.com/cyber-crime/2026/11/10/fireworks-ai-gets-burned-twice-as-customer-data-exposure-widens/5308722). [Notion disclosed on 9 November](https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor) (updated 10 November) that although it severed all connections to Fireworks on 3 November after an earlier synthetic-data alert, Notion's analysis after Fireworks confirmed the impacted dataset on 8 November found Notion AI chat transcripts used for its Insights feature from fewer than 1% of workspaces had been exposed, stored without user or workspace identifiers and unattributable for the vast majority of affected workspaces.

## What else changed in UK AI news across schools and policing?

Two Whitehall sector rulebooks moved in this week's UK AI news. On 10 November 2026, the Department for Education opened an England consultation on safety certification by UKAS-accredited bodies, proposing **annual recertification** as an option for student-facing generative AI, after the Home Office set out England and Wales plans on 4 November for a single biometric and inferential-technology watchdog.

The Department for Education's [EdTech and AI product safety certification consultation](https://www.gov.uk/government/consultations/introducing-an-edtech-and-ai-product-safety-certification-scheme), running until 4 February 2027 across early years, schools, and further education settings for under-18s in England, covers four categories including student-facing generative AI chatbots and tutors while excluding staff-facing generative AI and administrative tools that don't conduct high-risk processing of children's data. With a foreword from Early Education Minister Paul Waugh MP, the consultation proposes testing student GenAI products, including potential red-teaming, against eight safety standards and recertifying them more frequently, such as every year rather than every three years, with at least 18 months needed after consultation to establish the scheme.

In policing, Home Secretary Shabana Mahmood MP and Policing Minister Sarah Jones MP set out the [Home Office consultation response on law-enforcement facial recognition](https://www.gov.uk/government/consultations/legal-framework-for-using-facial-recognition-in-law-enforcement) on 4 November ahead of the Police Reform Bill for England and Wales. The Bill will create one independent oversight body able in extreme cases of non-compliance to pursue enforcement action leading to court injunctions halting police use of facial recognition, biometrics, and overt surveillance or inferential technologies, alongside a separate private-sector legal code for crime-prevention facial recognition.

That statutory push comes with unresolved public friction: [Computer Weekly reported on 5 November](https://www.computerweekly.com/news/366653695/Minority-groups-against-routine-police-facial-recognition) that minority ethnic participants in the Home Office's own public dialogue opposed routine live deployments. Put alongside the Northern Ireland hardware deal and the schools scheme, Whitehall's 2027 method is clear: rather than passing one horizontal AI Act, ministers are writing sector-by-sector rulebooks that UK compliance teams will have to track across half a dozen departments.

## What else launched in AI this week?

Notable AI model, workspace, and formal-verification releases published between 4 November and 10 November 2026 include five verified launches.

- **Anthropic (9 November 2026):** Released [Claude Fable 5.2 and Claude Mythos 5.2](https://www.anthropic.com/claude-fable-and-mythos-5-2) with a 1-million-token context window, up to 30% faster output generation than version 5.1, and standard API prices cut by 20% to $8 per million input tokens and $40 per million output tokens; Claude Fable 5.2 is live across supported regions including the UK and EU, while reduced-safeguard Claude Mythos 5.2 remains gated to Anthropic's Cyber and Life Sciences Verification Programs (and powers Claude Security codebase scanning for Enterprise customers).
- **Anthropic (10 November 2026):** Launched [Claude Whiteboards in beta, Claude Sheets in beta, and Claude Data in general availability](https://claude.com/resources/articles/sheets-whiteboards-data) (renamed from Claude Dashboards) across all paid Claude plans (off by default on Enterprise until admins enable them, with Claude Data turning on by default on 19 November), alongside [full-screen MCP Apps interactive connectors](https://claude.com/resources/articles/interactive-connectors-full-tool) for tools including Atlassian Confluence, Notion, Box, HubSpot, and Canva.
- **Google and Google DeepMind (10 November 2026):** Expanded [Gemini 4 Carbon](https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-carbon-now-available/) (gemini-4-carbon) from its 28 October Fairwind cybersecurity preview to paying Gemini API developers and Google AI Ultra subscribers across supported regions including the UK and EEA at an introductory $2 per million input tokens and $10 per million output tokens through 30 November ($4 and $20 from 1 December), while DeepMind introduced [AlphaProof Code](https://deepmind.google/blog/introducing-alphaproof-code/) after formally verifying compiled AArch64 machine code in Signal's libsignal library.
- **Meta Superintelligence Labs (9 November 2026):** Released [Muse Ember](https://research.meta.ai/blog/muse-ember) (muse-ember-1.0), a closed-weight multimodal reasoning model with a 1-million-token context window priced at $0.10 per million input tokens and $0.50 per million output tokens for prompts up to 200K tokens ($0.30 and $1.50 above 200K) on the Meta Model API, Google Cloud, and Oracle Cloud.
- **OpenAI (4 and 5 November 2026):** Rolled out [ChatGPT Images 2.6](https://deploymentsafety.openai.com/chatgpt-images-2-6) (GPT-Image-2.6 Sunburst and GPT-Image-2.6 Flare) on 4 November with GIF generation, photo markup, and API SVG output, followed on 5 November by [GPT-6 Cyber](https://deploymentsafety.openai.com/gpt-6-cyber), a vulnerability-discovery and penetration-testing model restricted to vetted security teams in OpenAI's Daybreak Red programme.

## Key takeaways

- Decision No 3/2026, adopted in Brussels on 10 November 2026 (taking formal legal effect on 11 November), applies the EU AI Act in Northern Ireland only to AI closely integrated into physical products, excluding standalone SaaS, cloud APIs, and direct general-purpose AI model obligations.
- Microsoft's 5 November 2026 commitment to bring Claude in Microsoft Copilot inside the EU Data Boundary by year-end covers EU and EFTA tenants only, leaving UK Microsoft 365 tenants outside.
- Bank of England analysis published on 5 and 10 November 2026 finds close to zero aggregate AI impact on UK employment so far alongside an estimated 0.3-percentage-point excess contribution to 2026 GVA growth, while warning of a low-hire squeeze on junior roles.
- HSBC, Barclays, Lloyds, NatWest, and Nationwide moved pre-emptively to block third-party autonomous AI agents from customer accounts (reported 8 November 2026), while WorkOS and Fireworks AI disclosed agent and AI-platform security incidents on 6 and 9 November.
- The Department for Education opened an England consultation on 10 November 2026 proposing safety certification by UKAS-accredited bodies and more frequent (for example, annual) recertification for student-facing generative AI tools.

## Frequently asked questions

### Does the EU AI Act apply to standalone software in Northern Ireland?

No, standalone software, web applications, cloud APIs, and direct obligations on general-purpose AI model providers do not apply domestically in Northern Ireland under Decision No 3/2026 adopted on 10 November 2026. The EU AI Act applies in Northern Ireland only where an AI system is embedded or pre-installed in a physical product or downloaded separately for a physical product specifically designed to be used by that AI system only to carry out its intended functionality. Northern Ireland and Great Britain software vendors still have to comply with the full EU AI Act when placing AI systems on the EU market or where their AI outputs are used in the 27 EU member states.

### Can I run Claude inside Microsoft Copilot within a UK data boundary?

Not under Microsoft's 5 November 2026 announcement. Microsoft's commitment to process Claude models inside the EU Data Boundary by the end of 2026 applies only to European Union and EFTA tenants. In UK Microsoft 365 tenants, Claude remains disabled by default across full Copilot experiences (though tenants created after 25 March 2026 enable it by default in Word, Excel, and PowerPoint) and processes outside both the EU Data Boundary and UK in-country processing commitments.

### What happens if a customer connects an autonomous AI agent to a major UK bank account?

HSBC, Barclays, Lloyds Banking Group, NatWest, and Nationwide Building Society have moved pre-emptively to block third-party autonomous AI agents from logging in with customer credentials and, in some cases, banned agent transactions made without direct customer involvement, as reported on 8 November 2026. Regulated read-only access through Open Banking is not ruled out, and the Financial Conduct Authority is working with industry, fellow regulators, and frontier labs on a trusted framework for agentic finance covering agent identity, delegated authority, accountability, and execution.

### Is it legal for schools in England to use uncertified generative AI tools with pupils?

Yes as of November 2026, because the Department for Education's EdTech and AI product safety certification scheme opened for consultation on 10 November 2026 until 4 February 2027 and will take at least 18 months after consultation to establish. The department proposes starting with a non-mandatory safety certification scheme using UKAS-accredited bodies, backed by statutory safeguarding guidance and more frequent (such as annual) recertification for student-facing generative AI, while consulting on whether future legislation should underpin the scheme or require certified products in high-risk areas.

### Is AI causing widespread redundancies in the UK in 2026?

According to the Bank of England's November 2026 Monetary Policy Report and Deputy Governor Clare Lombardelli's 10 November 2026 speech, surveyed UK firms report close to zero aggregate employment impact from AI so far. Instead of mass redundancies, the Bank sees a low-hire, low-fire pattern that reduces junior vacancies, though UK chief financial officers expect AI to add about 0.9 percentage points a year to productivity over the next three years, split roughly equally between faster output growth and slower employment growth.

### Can UK developers use Gemini 4 Carbon and Claude Fable 5.2 today?

Yes, both models are available to paying developers in the UK as of 10 November 2026. Anthropic released Claude Fable 5.2 across supported regions including the UK on 9 November at 8 dollars per million input tokens and 40 dollars per million output tokens, while Google opened paid API access to Gemini 4 Carbon on 10 November at an introductory 2 dollars per million input tokens and 10 dollars per million output tokens through 30 November 2026 (rising to 4 dollars and 20 dollars from 1 December), though both companies keep their reduced-safeguard cybersecurity variants gated.

## Sources

- [Decision No 3/2026 of the Joint Committee established by the Agreement on the withdrawal of the UK from the EU: adding a newly adopted Union act to Annex 2 to the Windsor Framework](https://www.gov.uk/government/publications/decision-no-32026-of-the-joint-committee-established-by-the-agreement-on-the-withdrawal-of-the-uk-from-the-eu-adding-a-newly-adopted-union-act-to-anne) — Cabinet Office (Primary source, 2026-11-10)
- [Partial application of the EU AI Act in Northern Ireland](https://www.gov.uk/government/publications/partial-application-of-the-eu-ai-act-in-northern-ireland) — Department for Business, Innovation, Science and Trade (Primary source, 2026-11-04)
- [The low-gear labour market: speech by Clare Lombardelli](https://www.bankofengland.co.uk/speech/2026/november/clare-lombardelli-speech-at-the-bank-watchers-conference) — Bank of England (Primary source, 2026-11-10)
- [Introducing an EdTech and AI product safety certification scheme](https://www.gov.uk/government/consultations/introducing-an-edtech-and-ai-product-safety-certification-scheme) — Department for Education (Primary source, 2026-11-10)
- [Young people in UK hit by 'low-gear economy', warns Bank of England deputy](https://www.theguardian.com/business/2026/nov/10/young-people-uk-economy-bank-of-england-clare-lombardelli) — The Guardian (Reporting, 2026-11-10)
- [UK government responds to facial recognition consultation](https://www.computerweekly.com/news/366653537/UK-government-responds-to-facial-recognition-consultation) — Computer Weekly (Reporting, 2026-11-04)