The Mills Review – what FCA-regulated firms should do now on AI, outsourcing and operational resilience

Background

The FCA has been actively considering the implications of AI in financial services for several years and has consistently favoured adapting existing regulatory frameworks rather than introducing a standalone AI regime. Through initiatives such as its AI Lab, the FCA has sought to support innovation while understanding the opportunities and risks presented by AI in financial services.

In early 2026, the FCA Board commissioned Sheldon Mills to conduct a strategic review into how advances in AI could transform retail financial services by 2030 and beyond. The review was published on 6 July and draws on over 140 written submissions and extensive engagement with financial services firms, technology companies, academia, consumer groups, and fellow regulators. Its central finding is clear: financial services are shifting from human-led, episodic activity towards AI-enabled, continuous, and delegated models.

For FCA-regulated firms, the key message is not that a new AI rulebook is imminent. Rather, firms deploying AI (whether internally, through outsourced services or via third-party technology platforms) should be able to demonstrate that their existing governance, accountability, operational resilience and Consumer Duty frameworks remain effective as AI systems become increasingly autonomous.

The Mills Review introduces an "AI autonomy spectrum" (see page 13 of the Mills Review) to illustrate how the human role changes as AI systems become more capable and autonomous. As firms move from AI-assisted decision-making towards greater delegation, questions of accountability, governance and oversight become increasingly important.

Key Takeaways for FCA Regulated Firms

• The existing regulatory framework remains sound. Consumer Duty, SM&CR, operational resilience, and the wider conduct framework apply to AI use without the need for a standalone AI regulatory regime, as has been the FCA’s public position for a number of years.
• The review identifies an “autonomy spectrum” with five levels (L1 Operator to L5 Observer). As AI moves along this spectrum, the human role shifts from performing tasks to setting boundaries and overseeing outcomes.
• Four systemic shifts are underway: AI transforming firm operations; consumer journeys becoming agent-led; competition being reshaped by AI platforms; and threats and defences both accelerating.
• One in five UK adults is already open to AI making financial decisions on their behalf. Firms must prepare for consumer journeys that are increasingly dynamic, personalised, and delegated.
• The Review suggests that SM&CR is likely to operate more comfortably at L1–L3, but that further clarity may be needed on what “reasonable steps” means for senior managers as systems move towards L4–L5 autonomy.
• Firms remain accountable for outcomes even where AI capabilities are provided by third-party model providers, cloud providers or other technology suppliers. Governance, oversight and accountability cannot be outsourced.
• System-wide risks are growing. Shared reliance on common models, datasets, cloud infrastructure and technology providers could generate correlated behaviour and common points of failure across multiple firms.
• The FCA will lead development of a trusted framework for AI agent participation — clarifying how agents can be authorised, identified, and held accountable in “agentic finance.”
• The Review also makes six further recommendations focused on adapting the regulatory perimeter, strengthening system-wide oversight, scaling the FCA’s AI capabilities and supporting the development of AI-enabled financial services.

The full text of the Mills Review can be found here: The Mills Review: AI and the future of retail financial services

Practical Steps for FCA Regulated Firms

Firms do not need to wait for further FCA guidance before taking these steps; they flow directly from existing expectations on governance, accountability, outsourcing, operational resilience and Consumer Duty.

1. Map AI use cases and accountability

Boards and senior managers should map current and planned AI use cases against the autonomy spectrum and ensure that clear accountability sits with named individuals under SM&CR. Particular attention should be paid to use cases moving towards higher levels of autonomy, where oversight and governance become increasingly important.

2. Refresh AI governance and risk management

Governance and model risk management frameworks should evolve to address AI-specific risks including model drift, data bias, hallucinations, and emergent behaviours, particularly where firms are deploying increasingly capable or autonomous systems.

3. Update operational resilience assessments

Operational resilience frameworks should identify AI dependencies, particularly on third-party model providers, cloud infrastructure and other critical technology suppliers, and ensure that appropriate impact tolerances, contingency arrangements and scenario testing are in place.

4. Strengthen third-party risk management

Firms remain responsible for outcomes even where AI capabilities are provided through outsourced services, cloud platforms, foundation models or other third-party technology providers. Firms should understand and actively manage dependencies on external providers, including governance, resilience, access to data, model change and concentration risk.

5. Reassess Consumer Duty compliance

Consumer Duty obligations apply equally to AI-enable customer journeys. Firms should assess whether outcomes remain fair, foreseeable and capable of effective oversight as personalisation and delegation increase.

6. Review supplier and AI contracting arrangements

Firms should review technology and outsourcing contracts supporting AI-enabled services to ensure they provide appropriate transparency, governance, audit, incident notification and regulatory access rights, particularly where critical services rely on external AI models or infrastructure.

Finally, model risk management and governance frameworks should evolve to address general-purpose and frontier AI models, with particular focus on opacity, model drift, concentration risk, and the potential for correlated failures across the sector. 

Firms that take these steps now will be better placed to demonstrate effective governance, accountability and operational resilience as AI becomes increasingly embedded in products, services and customer journeys.