The Mills Review: What It Means for AI Regulation in Financial Services

The Financial Conduct Authority’s approach to regulating AI has relied on its existing, principles-based, framework being robust enough to manage the risks AI creates. That premise is now being tested - both by the pace of AI adoption across financial services and by mounting pressure from Parliament for the regulator to go further.

This has led to the FCA publishing its review of ‘AI and the Future of Retail Financial Services’ (known as the ‘Mills Review’) on 6^th July 2026. In this article, the first in a series on the evolving regulatory framework for AI, Nigel Sydenham explains the background to the review and its significance for financial services firms.

Is the FCA's principles-based approach keeping up with AI?

There is no doubt that the ever-increasing capabilities of artificial intelligence (AI) systems, and their rapid adoption by financial services firms, pose challenges for regulators globally. Legal and regulatory frameworks, which pre-date the development of the latest generations of AI, may not be well-equipped to address the risks posed by the new technology.

The FCA, like other regulators, has been alive to this issue and, over recent years, has published a series of discussion papers and updates relating to AI. Its most recent ‘AI Update’, published in 2024, sets out the regulator’s current approach:

“Many risks related to AI are not necessarily unique to AI itself and can therefore be mitigated within existing legislative and/or regulatory frameworks. Under our outcomes-based approach, we already have a number of frameworks in place which are relevant to firms’ safe use of AI.”  [Source: AI Update, FCA]

In short, the FCA’s view has been that its principles-based and outcomes-focused approach is sufficiently flexible to manage the risks associated with AI. In practice, this means that firms must comply with their existing obligations, such as the Principles for Businesses, SM&CR and Consumer Duty, when using AI systems.

While this reliance on existing principles-based frameworks may seem a pragmatic response in the context of a rapidly developing technology, it raises questions regarding the practical application of the rules in the context of AI. For example, how can firms apply existing accountability structures when implementing advanced AI systems, the outputs of which cannot be easily explained?

Why the FCA launched the Mills review: Treasury Committee Report

There has also been a growing sense that the FCA’s current approach isn’t sustainable, and that firms require additional guidance from the regulator. The UK Parliament’s Treasury Committee made this case forcefully in its January 2026 report, ‘Artificial Intelligence in Financial Services’

After hearing evidence from both regulators and financial institutions, the committee concluded:

“The Financial Conduct Authority, the Bank of England and HM Treasury are not doing enough to manage the risks presented by AI. By taking a wait-and-see approach to AI in financial services, the three authorities are exposing consumers and the financial system to potentially serious harm.”

The Committee went further, recommending that the FCA publish ‘comprehensive, practical guidance for firms’ on the application of the existing rules in the context of AI by the end of 2026.

The FCA’s Response

In response, the FCA announced a review “into the implications of advanced AI on consumers, retail financial markets and regulators”. The review would be led by Sheldon Mills (an executive director of the FCA) and would conclude by the summer of 2026.

Yet even as it announced the review, the regulator was clear that its basic approach wasn't changing, stating that it would: “continue to rely on its existing, principles-based regulatory framework while considering how regulators need to evolve as AI becomes more embedded in financial services”.

What is the Mills review?

Following a period of consultation, and discussion with interested parties, the Mills Review was published on 6^th July. At 147 pages (including seven annexes) it is clearly a substantial piece of work, and its analysis, and recommendations, will undoubtedly inform the ongoing evolution of the FCA’s regulatory approach.

However, it’s important to recognise what the review is, and what it’s not. Crucially, the review’s recommendations are directed at the FCA’s Board. It will, no doubt, be of interest to firms, particularly those who are implementing AI systems, since it will inform the next stage of development of the FCA’s approach to AI. However, it doesn’t serve as new guidance for firms (it’s worth noting that the FCA has until the end of the year to meet the Treasury Committee’s recommendation).

What’s inside the Mills review?

In terms of content, the review covers a wide range of topics, including consumer responses to AI, as well as the heightened financial crime and cybercrime risks posed by misuse of AI.

 However, perhaps its most significant contribution is its discussion of the implications of the growing autonomy of agentic AI systems, in particular the transition from humans as operators and collaborators with AI to the point where humans become approvers of AI-initiated actions and, ultimately, observers

It is this ‘spectrum of autonomy’, and its implications for regulation, that we will explore in the next article.

Our training solutions include live, focused, in-depth training that provides a deeper understanding of the requirements related to AI. See our range of related courses below and get in touch to find out more.

Nigel specialises in training boards, senior executives and other staff on the impact of regulation and regulatory change.

He is a CFA Charterholder and Chartered Fellow of the CISI, with over 20 years' of industry experience.

With a background in compliance in private banking and wealth management, Nigel has a particular interest in effective corporate governance and the management of compliance and regulatory risk. His interests also include issues relating to ESG and climate risk, conduct and culture (including non-financial misconduct), and all aspects of financial crime prevention, as well as the impact of fintech on compliance and regulation.

Recent assignments have included briefing multiple boards and executive teams on the Consumer Duty, delivering compliance and ethics training for senior managers and front-office staff and creating a user-friendly risk and compliance handbook for a major bank.