> ## Content Index
> Fetch the complete content index at: https://racinform.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# FCA Mills Review — Agentic AI, Accountability & The Perimeter Gap
- URL: https://racinform.com/fca-mills-review/
- Published: 2026-10-22T15:33:28.000Z
- Updated: 2026-10-22T15:33:28.000Z
- Author: Vela Kuhaendran
- Tags: EU AI Act, EN18286, ACW, AIGP, DSA, Mills

#### 🟢 Why the Mills Review matters

****FCA**: “The Mills Review examines how autonomous artificial intelligence could increasingly reshape retail financial services and regulatory oversight.”

- Delegated AI decision-making now part of sector operations.
- Frontier-AI cyber capabilities + model concentration = system-wide risk.

****FCA** signals AI is no longer peripheral.

#### 🟢 Consumer Duty — conduct anchor

****FCA**: “Existing frameworks are flexible enough… firms remain answerable for the outcomes their AI systems produce.”

- AI-enabled services must still meet Consumer Duty outcomes.
- Fraud, cyber-risk, consumer harm remain firm responsibility.
- Frontier-AI safety depends on operational environment, not model hype.
- Cyber-resilience review: “Models can generate large numbers of findings that are technically possible but difficult to validate, prioritise or act upon.”

****Core risk**: volume + autonomy > oversight.

#### 🟢 SMCR — accountability does not move

**SMCR — Senior Managers & Certification Regime — is the FCA’s accountability framework.* 

****FCA**: “Senior Managers remain responsible for the outcomes an AI system produces, even where behaviour depends on a third-party model provider.

****Firms must**: 

- Name accountable Senior Manager for each AI-driven process.
- Define monitoring and escalation.
- Maintain oversight even when model is external.

AI autonomy increases accountability density.

#### 🟢 Operational resilience —governance must keep pace

- Governance forums must understand model behaviour.
- Escalation routes must be responsive.
- Oversight must detect drift and degraded outcomes.
- Concentration in cloud/model providers = system-wide risk.
- Linked to critical third-party regime → future perimeter tightening.

#### 🟢 The perimeter gap — general-purpose AI tools

****FCA**: General-purpose AI tools, such as ChatGPT, Claude or Gemini sit outside the FCA’s authorisation perimeter and create 

- Unregulated advice channels.
- Consumer reliance with no protection.
- Accountability ambiguity.
- Cross-jurisdiction complexity.

****FCA** can warn but cannot regulate without international alignment.

#### 🔴 Real-world perimeter gap — FT example

****FT** reports almost two-thirds of US doctors rely on searching **OpenEvidence* for patient decisions.

- Mirrors FCA warning: unregulated AI influencing regulated outcomes.
- Clinical and financial sectors share identical perimeter physics.
- Accountability collapses when regulated decisions rely on tools outside the perimeter.

#### 🟢 Checklist — regulated firms

- Clearly accountable Senior Manager for each AI-driven process.
- Defined escalation routes for abnormal AI behaviour.
- Demonstrable human judgment over automated decisions.
- Monitoring to catch drift before harm.
- Guardrails, approval gates, permission limits.
- Validation capacity matching AI autonomy.

#### Checklist — cryptoasset firms seeking authorisation

- Consumer Duty applies once authorised.
- Senior Managers must be named for each AI-driven process.
- Governance + guardrails must be built into the application.
- Consider interaction with unregulated general-purpose AI tools.

#### 🔵 RACinform view

- AI can act; firms remain accountable.
- AI can decide; oversight must scale.
- AI can discover; governance must keep pace.
- The perimeter gap is already shaping clinical and financial outcomes.
- International alignment will be required to close it.