Category: AI Regulation | Reading time: 9 minutes

For eighteen months, the most common reason UK financial services firms gave for stalling AI projects was regulatory uncertainty. The Treasury Committee said in January 2026 that a lack of clarity had slowed adoption across the sector, and many firms paused investment decisions until the FCA showed its hand.

On 6 July 2026 it did. The FCA published the Mills Review, a 147-page report led by executive director Sheldon Mills, examining how AI will reshape retail financial services by 2030 and beyond.¹ It is described by the FCA as the first review of its kind initiated by any financial regulator globally.²

The conclusion that matters most to you can be stated in one line: the existing regulatory framework remains fit for purpose, and the review recommends no new AI-specific rules.³

If you were waiting for an AI rulebook before moving, the waiting is over. There isn't going to be one for now. And that has sharper consequences than a new rulebook would have.

A new rulebook would have told you exactly what to do. Its absence means the regulator expects your existing obligations to stretch to cover AI, without a checklist to tell you where the edges are.

The review is explicit that accountability does not move as AI takes on more of the work. The Senior Managers Regime still applies, firms remain answerable for AI-driven outcomes, and the Consumer Duty and operational resilience rules were built to be technology-neutral.⁴

In practice this means the question a regulator will ask after something goes wrong is unchanged. When an AI system arranges a customer's mortgage, moves their savings, or recommends a pension, who answers if it goes wrong?⁴ The Mills Review puts that question at its centre and answers it the same way the regime always has: a named senior manager.

The comfort of a rulebook is that compliance is legible. You can point to the box you ticked. Principles-based supervision removes that comfort. You are judged on outcomes, and you have to be able to show your working.

The review identifies four systemic shifts that AI is driving through retail financial services: the transformation of firm operations, the evolution of consumer journeys, the reshaping of competition and market power, and the amplification of fraud and cyber risk.²

It grounds this in real evidence rather than speculation. The review drew on a survey of more than 5,000 UK financial services consumers, FCA-led focus groups, and comparative analysis of international approaches.⁵ One finding stands out for anyone planning ahead: research commissioned by the FCA shows that a fifth of people, equivalent to around 11 million UK adults, are likely to use AI that can act autonomously within pre-set goals.⁶

That number reframes the whole discussion. Agentic finance, where a consumer's AI agent initiates transactions on their behalf, is not a distant scenario. There is already consumer appetite for it at population scale.

The review makes seven priority recommendations for the FCA Board to consider.¹ In full, they are: secure and adapt the regulatory perimeter; strengthen system-wide coordination and oversight; monitor the transition to autonomous models and adapt regulatory frameworks; scale up the FCA's AI Lab; enable the foundations for agentic finance; build and adopt an AI-enabled agentic supervisory model; and develop a trusted public-interest AI-enabled financial capability service.¹

Most of these are about how the FCA changes. Two have direct near-term consequences for firms.

The perimeter review, within three to six months. The FCA will review the regulatory perimeter, and this is the development to watch.⁷ It is where the regulator will set its first concrete position on general-purpose AI, ahead of the Board's full response to the recommendations. If any part of your AI activity sits near the edge of what is currently regulated, that edge is about to be redrawn.

The evidencing expectation. Recommendation three asks the FCA to strengthen expectations on evidencing outcomes and control, including monitoring system behaviour in live operation, testing that extends beyond deployment, and controls that detect when systems move outside expected bounds.⁸ The direction is clear: continuous monitoring is expected to displace periodic review and manual sampling as AI spreads through firms.⁸ If your AI oversight is a point-in-time sign-off at go-live, that model is being quietly retired.

There is also a signalled publication to watch for. A "good and poor practice" document is expected later this year, and clarification on how the Senior Managers Regime and Consumer Duty apply to autonomous AI is anticipated alongside it.⁹

The most honest part of the review is where it concedes a limit. The infrastructure that agentic finance depends on, trusted digital identity, agent mandates and clear liability, sits largely outside the FCA's remit.⁷

This matters because recommendation five, enabling the foundations for agentic finance, cannot be delivered by the FCA alone. Without trusted digital identity, a way for an agent to prove it is acting on a specific customer's authority, and a clear liability position when an agent acts wrongly, the trusted-agent framework has nothing to stand on.

For your firm, the practical read is this. Do not wait for the identity and consent infrastructure to be solved before deciding your own position on agent authority. That infrastructure is a multi-party, multi-year problem. Your accountability for what your AI does exists now.

Strip away the roadmap language and the review leaves senior managers in a specific position.

Your existing obligations already cover AI. There is no grace period, no transition window, and no forthcoming rulebook to prepare for. The Consumer Duty applies to AI-influenced outcomes today. The Senior Managers Regime assigns accountability for those outcomes today.

Evidence is the currency. Because supervision is outcomes-based, your defence is not that you followed a rule. It is that you can demonstrate the outcome was good, that you monitored the system, and that you caught it when it drifted. That is a documentation discipline, and it is the thing firms most often skip because it produces nothing visible until the day it is needed.

The perimeter may move under you. Watch the three-to-six-month perimeter review. If your AI activity currently sits just outside the regulated boundary, plan for the possibility that it will not for long.

Agentic finance is a board-level question, not an IT one. With 11 million adults likely to use autonomous financial agents, the question of whether, and how, your firm interacts with customer-side agents is a strategic decision. It should not be discovered by accident when the first agent-initiated transaction hits your systems.

The Mills Review is being reported as the FCA declining to regulate AI. That framing misses the point. The FCA has not stepped back. It has confirmed that the accountability regime you already operate under was built to hold, and that it intends to supervise AI through that regime rather than a new one.

For a firm that hoped a rulebook would tell it exactly what to do, that is harder, not easier. There is no box to tick. There is only the question the regime has always asked, now pointed at your AI systems: can you show that the outcome was fair, and can you name who is accountable for it?

Further reading

This article is general guidance, not legal advice. How the Consumer Duty and Senior Managers Regime apply to a specific AI deployment in your firm is a question for your compliance function and legal counsel.

Where does your organisation actually stand?

The SAFE™ AI Readiness Assessment scores you across ten governance domains, including accountability and human oversight, the two the FCA's outcomes-based approach tests hardest. Under ten minutes, personalised maturity report.