A global investment manager's AI-powered trade execution algorithm begins generating anomalous order patterns — routing unusually large block trades at market-on-close, causing significant price impact and potential regulatory scrutiny. The incident is flagged at 3:45 PM EST. Which AI incident response sequence is most appropriate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
When your AI starts doing something unexpected with real money and potential regulatory consequences, you pull the kill switch first — then investigate. Answer B hits the right sequence: contain, document, notify, assess.
Full explanation below image
Full Explanation
AI incident response in financial markets must prioritize containment before root cause analysis. When an autonomous trading algorithm exhibits anomalous behavior — especially behavior that may violate market conduct rules or cause harm to counterparties — allowing it to continue operating while investigating is an unacceptable risk posture. The first action must be to assert human control over the system: suspend autonomous authority and shift to manual or rules-based execution modes.
This principle is embedded in multiple regulatory frameworks. ESMA's guidelines on algorithmic trading (MiFID II, RTS 6) require investment firms to have kill-switch mechanisms and to deploy them when algorithms malfunction. The SEC's Market Access Rule (Rule 15c3-5) mandates pre-trade risk controls that include the ability to immediately halt algorithmic trading. FINRA Rule 3110 requires supervisory systems capable of detecting and responding to algorithm anomalies.
Option A is the worst possible response — continuing to run a misbehaving algorithm compounds harm and regulatory liability in real time. Option C (rolling back and resuming) is premature: a rollback may not address the root cause (which could be data drift, an adversarial input, or a downstream system change), and resuming automated trading before understanding the incident recreates the risk. Option D (notifying the exchange for a halt) is an extraordinary measure used in extreme market disruption events, not a first-line incident response for a single firm's algorithm.
Post-containment, the incident response process should include: preserving model state, input data, and execution logs (evidence preservation); notifying compliance, legal, and senior management; conducting a structured root cause analysis; and evaluating regulatory notification requirements under applicable rules (e.g., SEC cybersecurity incident reporting, ESMA algorithm malfunction reporting). CFIA candidates should have a mental playbook for AI incident response that mirrors cybersecurity incident response: contain, preserve, investigate, remediate, report.