The regulator shows its hand
On 13 October, the Treasury Committee got the clearest answer yet to a question boards have been asking all year: how does the FCA actually intend to regulate AI in financial services. The answer, delivered in evidence from chief executive Nikhil Rathi and chief data officer Jessica Rusu, was not a new rulebook. It was a plan to turn AI inward, onto the regulator's own supervision, while telling firms that the tools they already have — the Consumer Duty and the Senior Managers and Certification Regime — are the tools they will keep using.
That is worth sitting with, because it is a genuine choice, not a gap waiting to be filled. The FCA has had eighteen months and a dedicated review to decide whether UK financial services needs AI-specific rules. It has decided, for now, that it doesn't.
Rusu's automation, Rathi's caution
Rusu told the committee the FCA wants to automate "wherever we can" and to "intervene at scale" — using AI to read the unstructured text firms submit, from emails to interview transcripts, and to flag risk before it compounds. She called it becoming an "agentic regulator." A human still signs off on every decision, she said, "for now" — two words that matter more than they sound.
Rathi's framing was more cautious. He isn't convinced the FCA needs significantly greater AI powers, and wants to use what it already has before asking Parliament for more. He also conceded that general-purpose chatbots offering general information don't currently sit fully inside the regulated perimeter, and that where that boundary should sit is, in his words, "a very live discussion." For an industry increasingly putting conversational AI in front of retail customers, that's not a settled answer. It's an open question with a clock running.
This was always coming
None of this appeared from nowhere. The Mills Review, published in July and led by former FCA executive Sheldon Mills, recommended exactly this: an AI-enabled, agentic supervisory model, built because the regulator cannot read everything a sector this size now produces. It also asked, pointedly, whether large language models themselves should fall within financial services rules — a question the FCA has not yet answered, but has clearly not forgotten.
What the Treasury Committee session confirmed is the order of operations. The regulator goes first. It builds its own AI-enabled supervision, learns what that teaches it about where the real harms sit, and only then decides whether firms need new rules on top of the ones already in force. Boards hoping for early clarity on bespoke AI regulation should recalibrate: clarity is coming, but supervision is the test bed, not a consultation paper.
Consumer Duty just became the AI rulebook
Here is the part that should land hardest in the boardroom. By choosing not to write new AI rules, the FCA has quietly made its existing frameworks carry the weight instead. The Consumer Duty's four outcomes and the Senior Managers regime's individual accountability are now, by the FCA's own account, the mechanism for catching and attributing AI harm in retail financial services.
Roughly three-quarters of UK firms already use AI somewhere in their operations. None of them got a new AI rulebook. All of them are already subject to the one doing the job.
That's a smart regulatory choice, and a demanding one. There's no safe harbour of "we complied with the AI rules" to point to, because there aren't any. There's only the question Consumer Duty has always asked: can you show the outcome was fair, and who owned it. An AI model that mishandles a vulnerable customer, mis-prices a product, or quietly degrades consumer understanding doesn't get a separate hearing. It's judged exactly as a human adviser's bad judgment would be, under the same Duty, with the same senior manager in the room.
What boards should do with this
Stop waiting for bespoke AI legislation to tell you what good looks like. It isn't coming on any timetable you can plan around, and the FCA has just told Parliament as much. Instead, map every material AI system in your customer journey against the Consumer Duty's four outcomes directly, and name the senior manager accountable for each one, the way you would for a product line or distribution channel. If you can't currently answer who owns the outcome when a given model gets it wrong, that's the gap this session just exposed — not a theoretical one.
It's also worth reading the FCA's own upcoming publications closely. The regulator has said it will publish findings on good and poor AI practice at firms, its response to frontier AI models, and the results of its AI Live Testing programme, in the week of 19 October. That's effectively the FCA showing its working on what "good" looks like under the existing rules — the closest thing to guidance firms are going to get, and worth treating as such.
The takeaway
The FCA isn't ducking AI regulation. It's betting that the Consumer Duty, written before anyone seriously used the phrase "agentic AI," is flexible enough to regulate it anyway. Boards that treat this as a wait-and-see moment are reading the signal backwards. The waiting is over. The accountability question Consumer Duty has asked since 2023 — who owns this outcome — now has an AI-shaped answer due, and it's due from your own senior managers, not from a new rulebook that was never coming.