The FCA has recently published its biggest statement yet on AI in financial services. The Mills Review, led by executive director Sheldon Mills, looks at how artificial intelligence could reshape retail financial services by 2030.
Globally, 81% of financial services firms are already using AI at some level, with 40% at advanced stages, more than double the rate seen among regulators. The Review's central argument is that AI has shifted from helping customers to acting on their behalf. While the FCA's existing framework holds up, it now accepts it needs clarification and closer monitoring as that shift continues, rather than a rewrite of the framework itself.
Until now, the FCA's position was that no new AI rules were needed and that existing
frameworks would be enough. The Mills Review agrees that's still broadly true, but
concludes there's more to figure out as AI capability moves from assistive to autonomous.
Here's a simple breakdown of what the review actually says:
→ AI becomes core to how firms operate.
→ Consumer journeys become AI-led, with agents recommending and eventually executing
decisions - the FCA's own research suggests a fifth of UK adults (around 11 million people)
are already likely to use AI that can act autonomously.
→ Competition and market power shift, particularly where a small number of big tech
providers supply the AI.
→ Financial crime and cyber risk increase, as AI capability spreads to attackers as well as
defenders.
→ The FCA has been asked to review, within three to six months, how far its rule book
actually reaches over general-purpose AI tools used in personal finance.
→ This covers consumer use of AI across savings, investments, pensions, mortgages and
debt management.
→ If your platform gives advice-like support in any of these areas, this asks the question
whether you already sit inside the perimeter.
The Senior Managers Regime and Consumer Duty stay in place. The FCA isn't proposing to
replace them, but senior managers remain accountable for outcomes even where the AI
model they rely on is built and updated by someone else. As things get more complex, the
question of who is responsible gets harder to answer and more important to answer
correctly.
What does this mean for your business?
→ More activity is likely to fall inside regulatory scope.
→ Accountability for AI-driven decisions still sits with named senior managers.
→ The gap between what your AI actually does and what your current policies were priced to cover is widening.
→ Firms that wait for the perimeter review to land will be starting this conversation later
than firms that start it now.
Even well-governed businesses can find their cover was written before AI took on tasks it's
doing today. The FCA has accepted that its old hands-off position was always going to collide
with reality, given the scale of change AI is bringing.
Professional Indemnity insurance covers claims arising from the advice or services your business provides, including decisions made or supported by AI on your behalf. Directors' & Officers' cover protects the people who carry personal accountability for those decisions under the FCA's Senior Managers and Certification Regime, even when the underlying model was built by a third party.
The term 'silent AI' exposure has been flying round the insurance market and it highlights
exactly this problem. It describes risk that sits in the gap of a policy, where it’s not explicitly
covered or explicitly excluded - because the wording was drafted before AI started making or
influencing decisions. PI and D&O policies are just as exposed as cyber and public liability.
And because only a few companies build the AI models everyone uses, that risk is even more
concentrated.
Many growing businesses assume their existing policies flex automatically as their product changes. In practice, PI and D&O wordings are priced against the risk profile you had when you bought them. If your platform has moved from assisting customers to acting on their behalf, your cover should reflect that.
If you're unsure whether your current Professional Indemnity or D&O policy would respond
to a claim arising from AI-driven advice or decisions, now is the time to check.
At Capsule, we can review your existing cover, explain what is and isn't included, and make
sure your limits and wordings reflect how your business actually uses AI today. Get in touch
today to make sure your insurance keeps pace with your product.
Disclaimer: This content has been produced for general information purposes and should not be taken as formal advice. You should always seek specific professional advice before acting on any of the information given.