A global investment manager's AI-powered trade execution algorithm begins generating anomalous order patterns — routing unusually large block trades at market-on-close, causing significant price impact and potential regulatory scrutiny. The incident is flagged at 3:45 PM EST. Which AI incident response sequence is most appropriate?

AI incident response in financial markets must prioritize containment before root cause analysis. When an autonomous trading algorithm exhibits anomalous behavior — especially behavior that may violate market conduct rules or cause harm to counterparties — allowing it to continue operating while investigating is an unacceptable risk posture. The appropriate sequence is to immediately suspend or override the AI model's autonomous trading authority, shift to manual or rules-based execution, notify compliance and legal, preserve all model logs and input data for investigation, and assess regulatory notification obligations.

This principle is embedded in multiple regulatory frameworks. ESMA's guidelines on algorithmic trading (MiFID II, RTS 6) require investment firms to have kill-switch mechanisms and to deploy them when algorithms malfunction. The SEC's Market Access Rule (Rule 15c3-5) mandates pre-trade risk controls that include the ability to immediately halt algorithmic trading. FINRA Rule 3110 requires supervisory systems capable of detecting and responding to algorithm anomalies.

The choice that allows the algorithm to continue operating while the data science team investigates root cause, to avoid disrupting end-of-day execution workflows, is the worst possible response — continuing to run a misbehaving algorithm compounds harm and regulatory liability in real time. The choice that rolls back the model to the previous version and resumes automated trading after confirming the rollback completes without errors is premature: a rollback may not address the root cause (which could be data drift, an adversarial input, or a downstream system change), and resuming automated trading before understanding the incident recreates the risk. The choice that notifies the primary exchange of the anomalous pattern and requests a trading halt for the affected securities to prevent further price impact is an extraordinary measure used in extreme market disruption events, not an initial incident response for a single firm's algorithm.

Post-containment, the incident response process should include: preserving model state, input data, and execution logs (evidence preservation); notifying compliance, legal, and senior management; conducting a structured root cause analysis; and evaluating regulatory notification requirements under applicable rules (e.g., SEC cybersecurity incident reporting, ESMA algorithm malfunction reporting). CFIA candidates should have a mental playbook for AI incident response that mirrors cybersecurity incident response: contain, preserve, investigate, remediate, report.