AI Trading Agents Reach Retail Brokers — Who Is Liable When the Bot Places the Trade?

Over the summer of 2026 the retail-brokerage industry crossed a line it had been circling for a year: AI models stopped merely advising traders and started acting for them. ThinkMarkets released Chelsea AIin June — a plug-in that lets Claude, Gemini, ChatGPT and other models operate a client's account; it can execute trades but cannot touch funds, and chief executive Nauman Anees says most users still lean on it for analysis, with trading volume rising. In July, Robinhood launched agent accounts: more than 50,000 of its roughly 14 million users opened one within weeks, and co-founder Vlad Tenev said they were “trading millions of dollars per day of equities and options”.

The plumbing sits underneath the brands. Most of the industry's third-party infrastructure runs through MetaQuotes and Spotware, and both have shipped their own agent plug-ins: MetaQuotes reported passing a trillion tokens since its July MCP release, and Spotware opened cTrader to AI agents. Nine of the ten major brokers exposing an MCP connector allow Claude. The Model Context Protocol has quietly become the standard way a language model reaches into a trading account — which means the question is no longer whether agentic trading arrives in Europe, but on whose terms.

Start with liability, because it is the part traders most often get wrong. Delegating the click does not delegate the responsibility. A Robinhood spokesperson stated that customers are “solely responsible for how the agents are built and any resulting actions the agents take”. Sophie Gerber, who runs the compliance firm TRAction, is blunter: “if you give the AI agent permission, you are responsible for its actions as though you did it yourself”, and she views standard broker terms as robust enough that an agent's trades count as validly yours. If an agent over-trades a volatile pair at 3am, the loss and the margin call land on you.

The EU framework is still catching up, and that gap is the real story. The EU AI Acthas no dedicated category for AI agents and does not currently classify AI-based algorithmic trading as high-risk — a stance Cyprus technology lawyer Christiana Aristidou warns is “not necessarily permanent”. But the absence of AI-specific rules does not mean a vacuum. MiFID II best-execution obligations bind your broker whether a human or a model places the order; ESMA issued a supervisory briefing on AI-based algorithmic trading in February 2026; and under DORA, a broker has to bring the MCP connector, the agent-access layer and the vendors behind them inside its operational-resilience scope. The FCA's July 2026 Mills Review sketched how AI reshapes finance by 2030 and raised agentic AI steering consumer choices, without yet addressing agentic trading head-on.

The subtler risk is execution conflict. Aristidou notes the danger of an agent that favours products generating higher commission or payment-for-order-flow revenue for whoever built it — a concern that rhymes with the broader European move against order-flow payments we covered in our note on the EU's payment-for-order-flow ban. Her framing is that surveillance becomes non-negotiable — “the AI did it is not a defence to inadequate surveillance” — and that the evidentiary burden shifts to decision provenance: being able to prove why an agent traded as it did, likely with tamper-evident logs and cryptographic attestations borrowed from Web3.

Regulators also doubt the reassurance brokers reach for first. Bank of England Deputy Governor Sarah Breeden told the ECB Forum in June that human-in-the-loop safeguards are unrealistic at agentic-trading speeds, arguing for kill switches and circuit breakers and warning about herding if many agents chase the same signal at once. In other words, “a human will check it” is not a control you should rely on.

First, treat an AI agent as a power tool, not an adviser. The controls the serious implementations already ship — a capital cap, an instrument whitelist, order previews and an instant disconnect — exist because the speed is the point and the point is also the risk. Set the limits before you connect anything, and set them tighter than feels necessary.

Second, read the permission scope, not the marketing. Chelsea AI can trade but cannot move money; that separation is the model to look for. Any agent that asks for both order and withdrawal permissions is asking for more than the job needs.

Third, pick a broker whose execution you can audit. Because the liability is yours and the conflict risk is real, the broker questions that matter are unchanged by AI: is it under top-tier EU supervision with a real EU entity, does it publish execution-quality data, and can you reconstruct why a trade filled where it did? An agent only amplifies whatever execution culture already sits underneath your account.

Among the EU-authorised brokers we cover, the two below sit at different ends of the spectrum — a proprietary social-trading platform and a long-established multi-asset house — both under top-tier EU oversight, and both useful reference points for what “auditable execution” should look like before you hand any part of it to an agent.