In a 15-minute session at NVIDIA's GTC Berlin, presented by Together AI and billed as "European Infrastructure, at a Fraction of the Cost," Revolut's David Abitbol gave the numbers. Claude Code, launched with a budget of "$300 per month" per engineer, had "very little impact in overall productivity." Revolut then launched a self-hosted GLM model with unlimited tokens, and reports 70% better lead time and 60% better coding time. Serving GLM-5.3 to about 2,000 engineers takes "around 56 GPUs." The cost is "a blended cost per million token for GLM 5.3 of 30 cents, and so that's one-tenth the cost of what we are paying with the equivalent frontier model." The invoice is flat. OpenAI and Anthropic models "are the reserved option with still a very small budget for the toughest problem, and open source is now the default." Abitbol was frank about the rest. "Whenever we mention using Chinese models, we have heightened scrutiny," he said, and "self-hosting open source is not trivial at all." He did not name the GPU host, saying only that the weights run on "the EU or US service provider or your own data center." The Register reported a version of the talk, given at AI Engineer in New York, on November 3. Revolut's stated reason was cost, not cloud capacity, and the workload is internal engineering, not customer-facing.

Why it matters: A tenfold price gap and a flat bill will reach every CFO. The case rests on a narrow scope: internal coding, a human in the loop, and frontier models kept for the hardest problems. Source: NVIDIA On-Demand — How Revolut runs production agents on open models · The Register — Revolut slashes AI coding costs

Revolut published PRAGMA on arXiv in April. The paper describes "a family of foundation models for banking event sequences" whose downstream tasks include "credit scoring, fraud detection, and lifetime value prediction." In August Revolut launched Revolut Research to institutionalise what its head of AI, Pavel Nesterov, called its "'build, don't bolt on' philosophy." In an October 21 post for GTC Berlin, NVIDIA said Revolut "is scaling PRAGMA in production, servicing an initial 80 million customers and engineered to scale 3x" on Blackwell Ultra GPUs. NVIDIA's case study gives the training base: "about 26 million user records across 111 countries," some 207 billion tokens covering about 28 months, trained on H100 GPUs on Nebius. Against production baselines, it reports "2.3× better accuracy at identifying credit default risk" and "65% more fraud cases caught." It also describes the design choice that matters most to a risk committee: "every update to PRAGMA flows through to multiple business units - from fraud and credit to marketing and product."

Why it matters: This is not a coding assistant. Under the AI Act's Annex III, a credit-scoring system built on a model like this becomes high-risk from December 2027; fraud detection is explicitly excluded. And with one backbone, a single update reaches every downstream decision at once. Source: arXiv — PRAGMA: Revolut Foundation Model · Tech.eu — Revolut launches AI unit · NVIDIA — European financial services and open models · NVIDIA — Revolut case study

Microsoft's CFO, Amy Hood, told investors on October 28: "Customer demand continues to exceed available supply." Some "3P GPU as a service contracts" have slipped into the second half of Microsoft's fiscal year, January to June 2027. Satya Nadella described what enterprise buyers now ask: "Can I own the weights? Can I manage my costs? Can I have reliability?" Alphabet's CFO said that "given the supply constrained environment, we started utilizing third-party compute capacity." Amazon's Andy Jassy said that "almost as fast as we install capacity, customers are gobbling it up," and that the largest blocks are "reserved well in advance." In Europe, the shortage shows up as quota rather than closed regions. In September, a Latvian consultancy trying to deploy in the EU Data Zone wrote that on a new subscription it "got zero quota for the model we needed, and all four requests for more were turned down." A Microsoft Q&A thread the same week is headed "GPT-5.4 EUR Data Zone Standard quota denied due to capacity." Microsoft's documentation still offers data-zone deployments in Europe, and none of the three companies gave a Europe-specific capacity figure. Rental prices tell the same story. A Silicon Data index cited by the Wall Street Journal puts a B300 at $7.56 an hour, up about 56% this year. Forrester's summary is that FinOps now means "governing scarcity."

Why it matters: Capacity is now a procurement risk, not just a price. Self-hosting doesn't avoid it: someone had to sell or rent Revolut its 56 GPUs. Source: Microsoft — FY27 Q1 earnings · The Motley Fool — Alphabet Q3 transcript · Amazon — AWS Q3 · KSJ — EU Data Zone: residency, not capacity · Microsoft Q&A — EUR Data Zone quota denied · Forrester — governing scarcity

NVIDIA used GTC Berlin to show how far the model has spread. "Neobank bunq's agentic assistant Finn now runs on open weight models," which NVIDIA says on Nebius "matches the quality of leading closed models at 60% of the cost per answer." Starling built "Starling Intelligence" on Civo's UK cloud "using the bank's own transaction data." Lloyds Banking Group built ATUM, "a transaction foundation model that converts billions of banking transactions into reusable intelligence." Santander is an early adopter of NVIDIA's Kumo open-weight models for structured financial data. BBVA and Santander are "working with NVIDIA to explore the OpenShell Reference Architecture" for agent safety and governance. Jensen Huang put the pitch plainly: "You could start with an open model, something that's incredibly good like Nemotron, and with your own data, post-train it for your use case." Away from NVIDIA's stage, Farsight's platform is "operating on-premise" across Deutsche Bank's investment banking and capital markets teams. On October 28, Banco Sabadell chose T-Systems' model-agnostic agent platform to avoid "structural dependence on a single provider." Where these banks name the model, it is NVIDIA's or their own. Revolut's Chinese coding model is the outlier.

Why it matters: Self-hosted and bank-trained models are becoming a mainstream banking architecture, not a fintech experiment. Your board will be compared with these names. Source: NVIDIA — European financial services and open models · NVIDIA — OpenShell Reference Architecture · NVIDIA — GTC Berlin keynote · FinTech Global — Farsight at Deutsche Bank · Deutsche Telekom — AI agents at Banco Sabadell

In September, the US Center for AI Standards and Innovation (CAISI) assessed that "GLM-5.3 is the most cyber-capable open-weight model released to date," about four months behind the US frontier. Anthropic, whose Claude Code Revolut moved away from, reported that attackers "can bypass GLM-5.3's safeguards between 64% and 100% of the time with simple techniques." Last week two independent labs added evidence. Irregular found that "the model did not refuse any of the tested offensive tasks and completed 3 of 13 scenarios end to end at least once, more than any open-weight model we have tested." Epoch AI found it "reliably exploited the 'patch gap' to compromise six recent Firefox releases, costing about $1,000 each." Epoch added: "We did not trigger any safeguards or refusals from any provider, including Z.ai, when using GLM 5.3 in this way."

There is a paper trail too. Zhipu entities have been on the US Entity List since January 2025; the listing restricts exports to the company, not the use of its published weights. Reuters reported in October that US regulators are asking banks "whether they deploy Chinese-developed technology." GLM's licence requires Model-as-a-Service businesses with more than $10 billion in revenue to "pass Z.AI's security review"; an internal deployment is not a Model-as-a-Service business. China's draft export controls exempt open-source models, and comments close on November 15.

Why it matters: When you host the weights, the lab's safeguards are not there. Follow Irregular's advice to operators: "monitor its reasoning alongside actions and outcomes." Source: NIST — CAISI assessment of GLM-5.3 · Anthropic — GLM-5.3 and advanced cyber capabilities · Irregular — GLM-5.3 multi-stage cyber operations · Epoch AI — open-weight models and the patch gap · CTV News — Reuters on bank watchdogs and AI · TNW — China's draft AI export controls

Cohere stated the assumption behind self-hosting on October 26: "If we run the weights on our own servers, the thinking goes, our data can't leave the building." Then it described what its sandbox caught. Asked to write a defensive detection rule, Alibaba's Qwen3.8-Flash-Next "inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing." The sandbox blocked it. Cohere sells its own models, so treat this as interested evidence. But Vals AI checked its own evaluation traces the next day. It found Qwen models making web-fetch calls through an Alibaba Cloud proxy, which in all cases "rejected the agent's requests with a 403 forbidden error." Neither finding concerns GLM, but both test the same assumption. On November 2, Google's Threat Intelligence Group added the outside view. In LLMjacking cases, the "Threat Actor tests publicly exposed Ollama endpoints and attempts to register their own models," with fraudulent charges "exceeding $100,000 USD in a single day." Abitbol's own closing advice at GTC Berlin looked inward. Set up telemetry "so that you can investigate the prompts that your engineers are sending across. You may be surprised to see that you may have bad actors inside your own organization."

Why it matters: Self-hosting moves the black box inside your firewall. Deny outbound network access by default on every inference host, and log every prompt and tool call. Source: Cohere — concerning behaviour from an open-weight model · Vals AI — why is my local Qwen sending requests to Alibaba Cloud? · Google Threat Intelligence — LLMjacking

Owning the weights means owning the software that serves them, and last week that software had a busy patch cycle. On October 27 GitHub published an advisory, scored 9.9, for LiteLLM, the open-source AI gateway compromised last month: "An authenticated user with internal_user privileges can escalate to proxy_admin and achieve remote code execution." On October 28 vLLM, a widely used inference server, published fixes for a batch of flaws. One reaches "pickle.loads()" from a forged handle; another opens a Ghostscript remote-code-execution path. The same week brought fixes for llama.cpp's RPC server, which "allows unauthenticated peers to overflow the rpc-server stack," for the official MCP SDKs, and for n8n's LangChain Code node. The developer tools around the stack had their own incident. On October 30, Microsoft reported that "a tampered copy of Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312) was available and served in the Cursor extension marketplace for a few hours." The tampered extension carried an SSH backdoor.

Why it matters: An API vendor patches its own servers. A self-hosted stack makes vulnerability handling under NIS2 Article 21(2)(e) your job, for the gateway, the inference server and the developer tools around them. Source: GitHub — LiteLLM advisory GHSA-7hp6-4w63-5g45 · GitHub — vLLM advisories · Microsoft — malicious Claude Code-branded Cursor extension

On October 29 Mistral released the weights of Mistral Large 4. The model has about 1 trillion parameters, about 49 billion of them active per token, and was "trained from scratch on 3,800 NVIDIA Grace Blackwell GPUs in Mistral's own datacenters in Europe." According to TNW, a quantised version runs on four B200 or B300 GPUs. TNW also reports that it scored 41% on Terminal-Bench 4.0 against GLM-5.3's 40%. On Artificial Analysis' Coding Agent Index it "rivals GLM-5.3 while using 47% fewer tokens per task." The model is free to use and commercialise, but "businesses that operate a Model-as-a-Service offering" need a commercial licence. Mistral was candid about the risk: "we see a potential for uplift to conduct real attacks." A specialised cyber variant goes only to design partners such as Orange Cyberdefense, and access is "subject to rigorous vetting and contractual safeguards." In Berlin on November 2, the German government's AI task force report called open-source and open-weight models "wichtige Bausteine digitaler Souveränität" (important building blocks of digital sovereignty). The report also commits to aligning how the AI Act, DORA and NIS2 are implemented, to avoid duplicate reporting. Moonshot published the weights of Kimi K3.1 Pro the same day, so the supply of Chinese open frontier-scale models keeps growing as well.

Why it matters: European buyers now have a European-trained open model in GLM-5.3's class for coding. Choose on provenance and licence as well as price. Source: Mistral — Mistral Large 4 open weights · Hugging Face — Mistral Large 4 model card · TNW — Mistral releases Large 4 weights · BMDS — KI-Nation Deutschland 2030 (German)

On November 4, the Bank of England, PRA and FCA sent the Treasury Committee their initial answers on Google's October 20 London outage. The europe-west2-b zone lost power when "the data centre's back-up generator failed to receive the signal required to start and the available battery reserves were subsequently depleted." The key line is how the regulators found out: "we became aware of the disruption at 09:09 BST through affected firms, not initially through a notification from Google itself." HM Treasury designated Google Cloud EMEA a critical third party on July 13. A fuller response is due by January 20, 2027. In an October 30 interview, the ECB's Pedro Machado said: "Around 85% of the banks use generative AI already." He added: "A more meaningful and substantial assessment can only be made after we get the banks' action plans (by the end of October)." No ECB statement on those plans had appeared by November 3. EIOPA's October risk dashboard rates cyber risk "elevated, with a worsening outlook, reflecting concerns over frontier AI models."

Why it matters: Self-hosting doesn't remove the provider; it changes which one you depend on. The company hosting your GPUs belongs in your DORA Article 28(3) register of information. Your own monitoring has to be the first to know when that provider fails. Source: UK Parliament — BoE, PRA and FCA reply to the Treasury Committee (PDF) · ECB Banking Supervision — Machado interview with Bloomberg · EIOPA — October 2026 risk dashboard

The Cyber Security and Resilience Bill completed its Lords stages on November 2, with only government drafting amendments at third reading. The clause requiring a review of whether frontier AI, and the AI Security Institute's powers over it, should be brought into scope survived. On November 4 the Commons extended the bill's deadline to April 29, 2027, leaving time for ping-pong. On November 3, the Department for Science, Innovation and Technology published a factsheet on the rules it plans for agents. They are meant "to cover incidents where operators are unable to adequately monitor or control AI agents." There are four parts: security requirements such as "monitoring agents' actions," a duty to notify affected organisations, evidence preservation, and ministerial powers to order post-incident reviews. In the factsheet's worked example, the operator "has kept a record of both the actions the agents have taken during the incident, and the logic agents followed when deciding to take them (for example through agents' 'chain of thought' logs)." The NCSC's assessment, published the same day: "It is highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI." It also found that "Russian cyber actors have leveraged open-source AI models, adapting and retraining them."

Why it matters: Last week's argument, that the record is yours to keep, now has a government template. A self-hosted stack can produce that record by default. An API may not. Source: GOV.UK — agentic AI resilience measures factsheet · UK Parliament — bill stages · NCSC — AI and cyber intrusion

Revolut's two announcements answer different questions. GLM-5.3 shows when it pays to host a model yourself instead of renting one. PRAGMA shows what changes when a bank owns the model outright. This Deep Dive covers when self-hosting is the right call for a European bank, what it moves onto the bank's books, and why Europe's rules make it easier to defend here than elsewhere.

For two years, the default for a European bank was a frontier model behind an API, ideally hosted in an EU region of a US hyperscaler. Three things moved this autumn. First, open weights caught up on the work banks do most. CAISI puts GLM-5.3 about four months behind the US frontier on cyber benchmarks, and Mistral Large 4 matches GLM-5.3 on agentic coding. Second, the price gap became a factor of ten, by Revolut's own accounting. Third, the three largest clouds told investors they are short of supply, and Microsoft said it allocates capacity to "the highest-value opportunities." Revolut then showed a bigger version of the same idea: a foundation model trained on its own customers' transactions and run in production for its whole customer base.

Does self-hosting make sense for banks? For a defined class of workloads, yes. The economics fit internal, high-volume, text-heavy work with a human in the loop, such as coding, ticket triage and document search. Usage is steady enough to keep GPUs busy, the bill is flat instead of metered, and prompts stay on infrastructure the bank controls or contracts for directly. The capacity squeeze adds a reason: GPUs you have contracted are not stuck behind someone else's quota queue.

There are two governance gains as well. The first is the record. Last week's edition argued that nobody else is keeping the AI incident record. On a self-hosted stack the bank sees every prompt, completion and tool call by default, which is why Abitbol's checklist ends with telemetry. The second is exit. DORA Article 28(8) requires exit strategies for ICT services supporting critical or important functions. A bank that can run open weights on hardware it controls has a credible exit from any single model vendor. Revolut's design, with frontier models as "the reserved option," keeps the exit open in the other direction too.

First, self-hosting doesn't end the dependency; it changes the counterparty. Revolut's GPUs sit with "the EU or US service provider or your own data center." Someone sold or rented them, in a market where B300 rents rose 56% this year. That provider belongs in the DORA register of information, with the same contract terms and exit planning as any cloud. The BoE and FCA learned of Google's outage from banks, not from Google. Expect no better from a smaller GPU host.

Second, the lab's safety layer stays behind. A frontier API comes with refusals, abuse monitoring and a vendor that patches. Downloaded weights come with none of that, and the GLM-5.3 evaluations show what remains: no refusals on offensive tasks, and safeguards bypassed 64–100% of the time. For a coding assistant inside a sandbox, that is manageable. It does mean the bank's own controls are the only controls: an allow-list of commands, deny-by-default egress, prompt logging and a process for insider misuse. Abitbol's warning about "bad actors inside your own organization" is the part most business cases leave out.

Third, the serving stack. AI gateways and inference servers now carry the same class of flaws as any internet-facing software, as last week's LiteLLM and vLLM advisories showed. Under NIS2 Article 21(2)(e), vulnerability handling for that stack is the bank's responsibility.

Fourth, provenance. When the weights run locally, Abitbol is right that prompts do not travel to China, so origin is not mainly a data-privacy question. It is a supply-chain question: what behaviour was trained in, and how would you know? Cohere and Vals found Qwen models reaching for Alibaba Cloud servers. Nobody has shown that of GLM. But supervisors have started asking. US regulators already ask banks "whether they deploy Chinese-developed technology." European supervisors have said nothing comparable yet. Have your answer ready before they do.

The strategic story is PRAGMA, not GLM. A coding model is a tool the bank deploys. A transaction model trained on 26 million users' records that feeds credit decisions makes the bank the provider of the high-risk systems built on it. Annex III of the AI Act lists AI systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud." From December 2, 2027, the provider of such a system needs training data that is "relevant, sufficiently representative, and to the best extent possible, free of errors and complete" under Article 10. It also needs technical documentation, accuracy and robustness testing, and human oversight. Article 17(4) lets financial institutions meet most of the quality-management duty through their existing governance under financial-services law, which helps. GDPR Article 22 still gives customers the right not to be subject to a decision "based solely on automated processing." The Dutch data protection authority warned debt collectors last week that such decisions may already be happening "zonder dat bureaus zich daarvan bewust zijn" (without the agencies being aware of it).

The design also creates a new concentration risk, this time inside the bank. NVIDIA's case study presents it as a strength: "every update to PRAGMA flows through to multiple business units." To a model-risk function, that means one change touches every downstream decision at once. An update to the shared model needs the change control of a core-banking release. Each downstream use should be revalidated before it goes live, with a record of which version produced which decision.

This is where Europe's constraint becomes an advantage. The rules that make self-hosting look like hard work are the same discipline that makes an owned model defensible to a supervisor: DORA registers and exit plans, NIS2 vulnerability handling, AI Act documentation. Germany's government now calls open weights building blocks of digital sovereignty, and Mistral Large 4 gives European banks a European-trained open option. A bank that owns its weights and can document them has something an API customer does not: a model that no one outside the bank can withdraw, reprice or ration.

Sort AI workloads into three groups. Internal work with a human in the loop can be self-hosted now. Customer-facing work needs a full risk file first. Decisions about people, such as credit, need an AI Act plan wherever the model runs. For the first group, run the Decision Card in the Artifact before signing for GPUs. For any proprietary model, set up change control before the first downstream use goes live.

For the board: Ask, "Which of our AI models could someone else withdraw, reprice or ration, and which could we run ourselves?"

Run these ten questions before you move a workload onto open weights you host yourself. Each row gives when self-hosting fits, when an API is the safer choice, this month's evidence and the clause it touches. The clauses are starting points, not legal advice. DORA applies to financial entities, NIS2 to essential and important entities, and the AI Act's high-risk rules to stand-alone systems from December 2, 2027.

One line to keep: Owning the weights means owning the risk file. Price is the easy part.

Market

Enterprise AI

Security

Supervision

Regulation

Infrastructure

This week, ask your CTO one question: "Which of our AI workloads could we run on open weights we host ourselves, and who signs off the model's provenance, safeguards and network egress before we do?"

Why this one: Revolut showed a tenfold cost gap and a flat bill, the clouds say demand exceeds supply, and open weights from Mistral and Z.ai are now good enough for coding. The question gets you a list of candidate workloads and an owner for the risk file in one answer.

If the answer is "nobody signs off": That is the finding. Run the Decision Card on one internal workload first.

Reply with one word: "hosting" or "renting." It joins the mapped, ready, sent, contained, revocable, clocked, tagged, verified, failed-over and recorded tallies in this newsletter's picture of where European AI operations actually stand.

Eleven weeks into the autumn, the questions have moved from what the model can do to who controls it, who is told, who counts, who checks, what lies beneath and who keeps the record. This week the question was who owns the weights. Revolut's answer is that a bank can own them, cheaply, for the right work. The banks that follow will find the price is the easy part, because the risk file comes with the weights.

Until next Thursday, João

OnAbout.AI delivers strategic AI analysis to enterprise technology leaders. European governance lens. Vendor-agnostic. Actionable.

If this landed in your inbox from a forward — subscribe here to get the full picture every week.