The future of AI regulation in UK financial services: key insights from the FCA's Mills Review - Deloitte

On 6 July 2026, the Financial Conduct Authority (FCA) published what is likely to be one of the most consequential reviews for AI regulation in UK financial services.

The Mills Review (the Review), Artificial Intelligence (AI) and the future of retail financial services, sets out how AI could fundamentally reshape the delivery and use of financial services by 2030. Commissioned by the FCA Board and led by outgoing Executive Director Sheldon Mills, the Review explores four systemic shifts driven by AI across firms’ core functions and operations, consumer journeys, market competition, and fraud and cyber risk. To respond to these, it sets out seven recommendations on how the FCA’s approach to AI should evolve to remain fit for purpose, with direct implications for how firms can expect to be regulated and supervised in the future.

The Review notes how quickly AI has evolved since its work began in late 2025, including developments in frontier AI models. This highlights the core challenge for regulators: in the words of FCA Chief Executive Nikhil Rathi, “technology is moving much faster than [...] regulatory paradigms”.

Even without imminent AI-specific rules, supervision is likely to change quickly and feel very different. The AI-enabled, agentic supervisory model proposed in the Review, which the FCA indicated during the Review’s launch event that it expects to move towards, would reshape how the regulator monitors firms and challenges outcomes. Governance, accountability, risk management, and consumer and market outcomes are all likely to face agentic supervisory scrutiny, supported by the FCA’s growing capability to analyse firm and market data more quickly, systematically and at scale.

1. AI will drive four systemic shifts that will reshape financial services

AI will transform firms’ core functions and operations - Firms are already piloting more autonomous AI use cases and, by 2030, many could use AI across core functions such as customer support, underwriting, compliance, claims and product design. For leading firms, AI could become central to how they process information, serve customers and evidence outcomes. As AI takes on more decisions, a firm’s governance framework will need to set out who is accountable, for what, and how that accountability works in practice.

- Firms are already piloting more autonomous AI use cases and, by 2030, many could use AI across core functions such as customer support, underwriting, compliance, claims and product design. For leading firms, AI could become central to how they process information, serve customers and evidence outcomes. As AI takes on more decisions, a firm’s governance framework will need to set out who is accountable, for what, and how that accountability works in practice. Agent-led consumer journeys - Consumers are likely to rely more on AI agents to make or manage financial decisions. Adoption will depend on trust, access and user control. Unequal access to high-quality AI could widen inclusion gaps, while unchecked hyper-personalisation may increase risks of bias, opaque pricing and personalised manipulation.

- Consumers are likely to rely more on AI agents to make or manage financial decisions. Adoption will depend on trust, access and user control. Unequal access to high-quality AI could widen inclusion gaps, while unchecked hyper-personalisation may increase risks of bias, opaque pricing and personalised manipulation. A reshaped competitive landscape - Market power may shift towards those controlling the AI-mediated consumer interface, rather than the financial product itself, weakening firms’ direct customer relationships. Reliance on a small number of model providers and hyperscalers also raises concentration, lock-in and data sovereignty risks that firms will need to manage.

- Market power may shift towards those controlling the AI-mediated consumer interface, rather than the financial product itself, weakening firms’ direct customer relationships. Reliance on a small number of model providers and hyperscalers also raises concentration, lock-in and data sovereignty risks that firms will need to manage. Amplified fraud and cyber risks – AI will make fraud more convincing, scalable, and harder to detect, including through deepfakes, synthetic identities and personalised social engineering. It also enables attackers to find and exploit vulnerabilities in firms’ infrastructure at a speed and scale that traditional defences cannot match. Both threats require defensive capability and cross-sector intelligence sharing to evolve as quickly as the attacks.

2. Seven recommendations to make the FCA fit for (future) purpose.

Against that backdrop, the Review concludes that the regulatory and supervisory framework needs to evolve. The Review agrees that the FCA’s existing technology-neutral and outcomes-based framework, including the Consumer Duty, the Senior Managers Regime and operational resilience, remains a sound foundation. However, it also flags that it will come under increasing pressure as AI becomes more autonomous and the AI-driven market transformation described above accelerates. The Review’s seven recommendations (set out below) are therefore aimed at keeping the framework fit for purpose in an AI-enabled financial system, while supporting innovation and managing risks to consumers, firms and the wider market.

3. The recommendations are not yet FCA policy, but they signal a shift in regulatory thinking.

The FCA Board will need to consider the Review’s seven recommendations and decide whether, and how, to take them forward. Even so, they provide a clear indication of how the FCA’s approach to AI may evolve in the coming years. The Review should also be read alongside recent remarks by FCA Chief Executive Nikhil Rathi and Bank of England (BoE) Deputy Governor Sarah Breeden. Taken together, they suggest a shift in UK regulatory thinking, including a growing recognition that targeted AI-specific interventions may be needed to secure the regulatory perimeter, strengthen supervision, and address selected areas of regulation as AI becomes more autonomous and agentic.

4. Strong AI governance is a strategic capability, not a compliance function.

The Review is explicit that effective AI governance underpins the safe adoption of AI and can become a source of competitive advantage. As AI becomes more autonomous and takes on more decision making, approval at launch followed by periodic reviews will no longer be sufficient. Governance and oversight will need to operate closer to real-time, alongside the AI systems they govern. Firms that build this capability now will be able to deploy AI at greater speed and scale and adapt quickly to future regulatory and supervisory changes, including agentic supervision. They will also be better able to demonstrate that AI-driven or AI-informed decisions are delivering the intended outcomes.

The Review’s seven recommendations to the FCA Board: high-level summary

The Review stresses that the recommendations are mutually reinforcing. Together, they aim to support safe innovation, stronger oversight and better outcomes in an AI-enabled financial system.