The FCA’s quiet shift from monitoring AI to regulating it

For the past two years, the FCA's position on AI in financial services has been consistent: existing rules are sufficient, the regulator is technology-agnostic, and firms should govern AI under the frameworks they already have. The 2024 AI Update reinforced this message.^[7] No new rules. No AI-specific regulation. Monitor and adapt.

That position is changing — not through a single announcement, but through a series of moves in early 2026 that together signal a clear shift from passive monitoring to active regulatory engagement. If your firm uses AI to assist with financial advice, these developments should be on your radar.

1. Parliament called the FCA's approach insufficient

On 20 January 2026, the Treasury Select Committee published its report on AI in financial services.^[1] The language was unusually direct. The Committee concluded that the Bank of England, the FCA, and HM Treasury are "not doing enough" to manage the risks of AI, and that their "wait-and-see approach" is "exposing the public and the financial system to potentially serious harm."^[2]

The Committee made several specific recommendations:

The FCA should publish guidance setting out who in organisations should be accountable for harm caused through AI.^[2] This goes beyond the existing SM&CR framework — the Committee wants explicit, AI-specific accountability guidance.

HM Treasury must designate major AI and cloud providers as critical third parties under the Critical Third Parties Regime by the end of 2026.^[2] This would give the FCA and BoE direct supervisory powers over the AI providers that financial services firms depend on.

The BoE and FCA should conduct AI-specific stress testing to assess firms' readiness for AI-driven market shocks.^[2]

Parliamentary reports don't create rules, but they create political pressure. When a Commons committee publicly criticises a regulator for being too passive, the regulator responds.

2. The Mills Review will report by summer 2026

One week after the Treasury Committee report, on 27 January 2026, the FCA launched the Mills Review — a formal examination of how AI will reshape retail financial services, led by Executive Director Sheldon Mills.^[3] The Review looks beyond current use cases toward 2030 and examines AI's impact on market structure, firm operations, consumer trends, and regulatory approach.^[4]

The FCA has been urged to publish, by the end of 2026, comprehensive and practical guidance covering two critical areas:^[5]

The application of consumer protection rules to AI. This means translating the Consumer Duty's broad obligations into specific expectations for firms using AI to generate advice, assess suitability, or communicate with clients.

The level of assurance expected from senior managers under SM&CR for AI harm. This is the FCA defining what "reasonable steps" means when your firm's AI produces unsuitable advice. It's the gap between "we had a policy" and "we can prove oversight happened."

Recommendations are expected to reach the FCA Board by summer 2026.^[3] These won't be enforceable rules immediately, but they will set the direction. Firms that align early will be ahead; firms that wait will be retrofitting.

3. The first AI-specific rules are already live

While the FCA maintains its technology-agnostic position at the strategic level, it has already introduced rules that target specific AI use cases. The PS25/22 "targeted support" framework, active from April 2026, creates a compliant pathway for automated financial guidance. It requires:

AI restricted to segment assignment and hard-coded suggestions. Mandatory, unskippable disclosures. Explicit guardrails preventing automated systems from crossing the line into regulated advice.

This matters because it demonstrates the FCA's willingness to regulate AI at the use-case level when consumer risk is clear. If they've done it for automated guidance, they can do it for AI-assisted advice.

Meanwhile, the FCA is actively warning about agentic AI — autonomous decision-making systems that major UK lenders are preparing to pilot with customers.^[6] The regulator is working to tighten oversight "ahead of 2026 market deployment." This is not wait-and-see. This is pre-emptive intervention.

What this means for your firm

The pattern is clear. Parliament is pushing. The FCA is responding. Specific guidance is coming. The question for firms is not whether they'll need to evidence AI oversight, but whether they'll be ready when the guidance lands.

Three things you should be doing now:

Know who is accountable. The Mills Review will likely clarify SM&CR expectations for AI.^[5] Make sure your senior managers know they're personally accountable for AI outcomes — and that you have evidence of the controls they've put in place.

Build your evidence base. The Consumer Duty's annual board assessment must be "evidenced with data." If your AI-assisted advice process relies on emails and spreadsheets for oversight records, start building something more defensible. The audit trail requirements under SYSC are already enforceable — you don't need to wait for new rules.

Don't wait for the guidance. The firms that will navigate this transition most smoothly are those building compliance infrastructure now, while the regulatory framework is still forming. Retrofitting oversight after the FCA publishes specific requirements is harder, more expensive, and more visible to supervisors.

The FCA hasn't changed its principles. It's still technology-agnostic and outcomes-focused. But it's no longer just watching. The shift from monitoring to regulating has begun.