Too little too late? The FCA adopts most of the Mills Review’s recommendations, but where are the AI rules?

AI and the future of retail financial services, FCA, the Mills Review, 6 July 2026: https://www.fca.org.uk/publications/corporate-documents/mills-review

AI in financial services: good practice and areas for improvement, FCA, 19 October 2026: https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services

The FCA has now published good and poor practice examples and adopted six of the Mills Review’s seven recommendations, but no new rules. Is that enough?

The case studies, “good practice” and “areas for improvement” in the latest FCA response to Mills, AI in financial services: good practice and areas for improvement, are useful to a point, but don't adequately respond to firms’ requests for clarity on how to interpret and govern AI deployment within the existing regulatory framework, or remove the uncertainty about how the FCA’s technology-agnostic, principles-based, outcomes-focused regulation applies to AI.

The existing regulatory framework needs more than examples of good AI practice and “can-do-better” cases. At the very least, it calls for AI/agentic AI-specific guidance from the FCA. Better still, it needs a more radical adaptation of the Handbook to address the specific threats (allowing for opportunities) of AI at firm, market and systemic levels. 

Mills found that the FCA’s overall regulatory framework “remains sound,” reiterating that this approach — including the Consumer Duty and the Senior Managers Regime (SMR), operational resilience regulation, and other key features — was “designed to flex across changing business models”, including AI. But Mills also acknowledged that respondents who contributed to its thinking wanted clarity on how to interpret and govern increasing deployment of AI within the existing regulatory framework. Mills also conceded that the regulatory framework is coming under increasing strain in accommodating AI. Common sense tells us that the regulatory framework will take even more strain as AI and agentic finance are integrated in firms’ operations, the markets, and the whole financial ecosystem.

The FCA's response to Mills, AI in financial services: good practice and areas for improvement, reiterates that existing rules and the regulatory framework apply to firms’ use of AI, and that the examples in it of “good practice” and “areas for improvement” (which will evolve) do “not create new requirements, prescribe a single model or replace firms’ responsibility for considering what is appropriate and proportionate for their own AI use cases, risks and potential impact”. And that remains one of the regulatory and operational challenges for firms in adopting AI.

The FCA’s CEO, Nikhil Rathi, has acknowledged publicly that, in some cases, more detailed rules for AI will be needed. As he said to the Treasury Select Committee in October, his perspective on additional regulation “has been evolving”, but that he would need proof that current regulation is inadequate before seeking “lots more powers until we have really demonstrated that we have used our powers to the fullest extent”: https://committees.parliament.uk/oralevidence/18118/pdf/, in Rathi's answer to Q737.

A firm that has been shown not to have followed “good practice” in the FCA’s response to Mills may run the risk of breaching the Handbook, whether under the Consumer Duty, SMR and governance, or the Operational Resilience regime. But that is not the same as the regulator setting out more specific rules to address AI, or – and here’s my concession — clearer and more specific guidance on how existing regulation applies to AI use cases. 

In practice, this means firms are being left to bridge that gap through governance and operational controls, which will likely include:

• risk-tiering of use cases,
• explainability requirements,
• outcome testing, 
• model-drift monitoring, 
• clear SMR accountability, 
• escalation processes, and
• evidence-based controls.

All these measures would be sensible and increasingly necessary responses. But governance frameworks can only solve part of the problem, especially when it comes to agentic AI.

Eventually, regulators will need to answer some fundamental questions about agentic AI, including:

• Who is responsible and liable when an AI agent causes harm?
• How much agentic autonomy is too much autonomy?
• How should agents and agency be verified?
• Where should meaningful human oversight begin and end in agentic processes?
• How should accountability operate when responsibility is distributed across a regulated firm, a model developer, infrastructure providers and multiple layers of suppliers?

In the context of genAI and agentic AI, perhaps the most intriguing question is whether and how far accountability will eventually extend upstream into third-party supply chains. Today, FCA accountability generally points back to regulated firms and their senior managers. It also includes supply chains in, among others, outsourcing, cloud, and operational resilience rules. That is likely to remain true for the foreseeable future, particularly given the regulator's established approach to outsourcing and third-party risk. 

However, there may already be signs of a broader shift.  This was confirmed by Jessica Rusu, FCA Chief Data, Information and Intelligence Officer, in a speech given on 19 October: “The FCA will work with industry, fellow regulators and frontier labs to develop a trusted framework for agentic finance, including clear approaches to agent identity, delegated authority, accountability and execution.”: https://www.fca.org.uk/news/speeches/building-future-finance-age-ai

So the FCA is developing its thinking on agentic AI in collaboration with frontier AI laboratories rather than treating the issue solely as one of firm governance. At the same time, the UK's Operational Resilience regime and Critical Third Party regulation recognise that concentration and systemic risks can originate beyond regulated firms themselves. As the market becomes increasingly dependent — as seems inevitable — on a small group of dominant AI developers, model providers and infrastructure providers, the parallels are difficult to ignore.

A future regime that places direct obligations on parts of the AI/agentic AI supply chain no longer seems far-fetched. It is more than likely to prove necessary if regulators are serious about addressing concentration risk, systemic dependencies and the governance challenges posed by agentic finance.

Looking beyond the Mills Review and the FCA’s current position on AI

AI in financial services: good practice and areas for improvement is a welcome first step. The examples in it are practical and provide useful insight into some of the regulator's expectations today. But they are not intended to be comprehensive, they will and need to evolve, and they do not begin to fully answer the harder questions that AI, and particularly agentic AI, is creating.

When it became a prevalent business model, outsourcing received specific regulatory treatment under FCA SYSC8 and SYSC13. And when cloud computing became a popular computing and business model, the FCA published cloud-specific guidance. 

While AI presents more complex technical, operational, systemic and regulatory challenges, how much longer can - or should - the FCA wait before delivering AI/agentic AI-specific regulation or more formal specific guidance? Or is it too late, because we have already passed the point of no return in the classic Collingridge Dilemma*?