FCA Mills Review — Agentic AI, Accountability & The Perimeter Gap

FCA: “The Mills Review examines how autonomous artificial intelligence could increasingly reshape retail financial services and regulatory oversight.”

• Delegated AI decision-making now part of sector operations.
• Frontier-AI cyber capabilities + model concentration = system-wide risk.

FCA signals AI is no longer peripheral.

FCA: “Existing frameworks are flexible enough… firms remain answerable for the outcomes their AI systems produce.”

• AI-enabled services must still meet Consumer Duty outcomes.
• Fraud, cyber-risk, consumer harm remain firm responsibility.
• Frontier-AI safety depends on operational environment, not model hype.
• Cyber-resilience review: “Models can generate large numbers of findings that are technically possible but difficult to validate, prioritise or act upon.”

Core risk: volume + autonomy > oversight.

SMCR — Senior Managers & Certification Regime — is the FCA’s accountability framework.

FCA: “Senior Managers remain responsible for the outcomes an AI system produces, even where behaviour depends on a third-party model provider.

Firms must:

• Name accountable Senior Manager for each AI-driven process.
• Define monitoring and escalation.
• Maintain oversight even when model is external.

AI autonomy increases accountability density.

• Governance forums must understand model behaviour.
• Escalation routes must be responsive.
• Oversight must detect drift and degraded outcomes.
• Concentration in cloud/model providers = system-wide risk.
• Linked to critical third-party regime → future perimeter tightening.

FCA: General-purpose AI tools, such as ChatGPT, Claude or Gemini sit outside the FCA’s authorisation perimeter and create

• Unregulated advice channels.
• Consumer reliance with no protection.
• Accountability ambiguity.
• Cross-jurisdiction complexity.

FCA can warn but cannot regulate without international alignment.

FT reports almost two-thirds of US doctors rely on searching OpenEvidence for patient decisions.

• Mirrors FCA warning: unregulated AI influencing regulated outcomes.
• Clinical and financial sectors share identical perimeter physics.
• Accountability collapses when regulated decisions rely on tools outside the perimeter.

• Clearly accountable Senior Manager for each AI-driven process.
• Defined escalation routes for abnormal AI behaviour.
• Demonstrable human judgment over automated decisions.
• Monitoring to catch drift before harm.
• Guardrails, approval gates, permission limits.
• Validation capacity matching AI autonomy.

• Consumer Duty applies once authorised.
• Senior Managers must be named for each AI-driven process.
• Governance + guardrails must be built into the application.
• Consider interaction with unregulated general-purpose AI tools.

• AI can act; firms remain accountable.
• AI can decide; oversight must scale.
• AI can discover; governance must keep pace.
• The perimeter gap is already shaping clinical and financial outcomes.
• International alignment will be required to close it.