On 6 July 2026, the FCA published the Mills Review into the impact of AI on retail financial services (the “Review”). The Review is described as setting out “a roadmap for how industry, regulators and government can prepare for the next phase of AI-driven change in our world-leading financial services sector”. It highlights AI governance and model risk management as a critical capability by 2030, suggesting firms assess their leadership teams for AI readiness.
The AI autonomy spectrum
The Review introduces an “AI autonomy spectrum” with five levels of agent autonomy: Human as operator, collaborator, consultant, approver, and observer. This framework helps the industry understand AI developments and associated risks, anticipating a gradual increase in autonomy by 2030 and detailing how firm activities and departments will adapt across this spectrum.
Four major AI driven shifts to 2030
The Review identifies four key shifts: AI will transform firms, making AI governance and model risk management critical; consumer journeys will become agent-led, with AI applications increasingly acting on behalf of consumers, offering benefits like efficiency but also risks of bias and manipulation; AI will reshape market power and competition, blurring the lines between Big Tech and regulated financial services; and financial crime and cyber risks will be amplified by AI's speed, scale, and persuasiveness, necessitating evolving system-level capabilities.
System-level changes and regulatory pressure points
The Review emphasizes that the FCA's primary monitoring focus should be at a system level, as shared reliance on similar AI models and infrastructure could lead to correlated behaviour, opacity, and common points of failure across the financial services ecosystem. It also highlights complex pressure points in the current regulatory framework, including the Senior Managers Regime, advice guidance boundaries for LLMs, and the Consumer Duty, noting significant data protection implications, such as those addressed by the ICO's report on agentic AI.
Seven recommendations for the FCA
The Review outlines seven recommendations for the FCA: securing and adapting the regulatory perimeter for AI-mediated services through a prompt review of LLMs; strengthening system-wide coordination with domestic and international partners; monitoring and adapting regulatory frameworks for autonomous AI; scaling up the FCA's AI Lab to assess AI models and support innovation; enabling a trusted framework for AI agent participation; building an AI-enabled Agentic Supervisory Model for enhanced supervision and enforcement; and developing a public-interest AI-enabled financial capability service to provide trusted financial information and support to consumers.
Quantum computing as a strategic uncertainty
The Review identifies quantum computing as a distinct but related strategic uncertainty, cautioning about the 'harvest now, decrypt later' risk where current encrypted data could be compromised by future quantum computers. It advises financial firms to proactively identify cryptographic vulnerabilities, develop crypto-agility, and plan for migration to post-quantum standards without waiting for a cryptographically relevant quantum computer to emerge.
Upcoming FCA good and poor practice publication
In conjunction with the Mills Review, the FCA plans to release an 'AI good and poor practice' publication later in 2026. This guide, informed by direct engagement with firms regarding their challenges and successes with AI, aims to provide practical assistance and clarity for firms navigating AI-related issues in retail financial services.
Conclusion and call to action for firms
The Review offers a comprehensive analysis of AI's implications for retail financial services, signaling forthcoming regulatory shifts. It stresses that robust AI governance and model risk management will be 'critical capabilities' by 2030, urging firms' leadership to enhance their AI knowledge to ensure strategic oversight, uphold governance standards, and manage risks effectively in a rapidly evolving market.
