The Financial Conduct Authority has signalled that firms’ existing duty to report major incidents should also capture significant AI failures and near-misses. There is no new rule and no deadline yet, but regulated firms would be wise to start building the plumbing now.
What happened
Speaking at Bloomberg’s UK Policy Series on Monday 19 October 2026, Jessica Rusu, the FCA’s chief data, information and intelligence officer, set out how the regulator intends to respond to the Mills Review and to the arrival of increasingly autonomous AI in financial services. The headline for anyone in governance, risk or security: she said the incident reporting obligation firms already carry “must extend to significant AI failures and near-misses”.
Rusu linked this to agentic AI, where software takes actions for a customer or firm, and noted that the AI Minister sees near-miss reporting for such systems as becoming a national security priority. She added that it is a regulatory priority for the FCA as well.
It is important to be precise about what this is. It is a statement of direction in a speech, not a policy statement, consultation paper or Handbook change. No timetable, threshold or reporting template was given. At the same time the FCA released good and poor practice examples on AI drawn from its supervisory work and testing this year, which Finance Magnates reports the regulator says creates no new requirements.
The speech follows Rusu’s appearance before the Commons Treasury Committee on 13 October, where Nikhil Rathi, the FCA’s chief executive, said he remained unpersuaded that it needed “lots more powers” and, according to the Financial Times, the regulator is not drafting AI-specific rules for firms. The message is consistent: existing frameworks, not a separate AI rulebook.
The detail
Three themes run through the published good and poor practice: consumer outcomes, accountability and governance, and operational resilience. For security and risk teams the second and third matter most.
On governance, the FCA expects clear ownership, risk-based controls, human oversight, defined escalation triggers and senior managers who are personally accountable for AI systems. According to Finance Magnates, the material expects every AI use case to have its own named senior manager, which maps neatly onto the Senior Managers and Certification Regime. Rusu criticised firms that bolt governance on after deployment, or that fail to adjust monitoring as systems evolve.
On resilience, she urged firms to stress-test AI, plan for failure, keep fallback options and understand supplier concentration, including reliance on a single model. Finance Magnates reports that dependence on one model or one vendor is listed as an area for improvement, and one case study describes a firm forced to redesign a product after the underlying model was retired. She also told firms to make sure they hold appropriate cyber insurance.
Rusu argued that an AI system judged safe at launch can behave differently at scale, under stress, or once the model beneath it changes. Her conclusion was that agentic systems need assurance that is continuous and conditional rather than a one-off sign-off. The FCA plans to develop a framework for agentic finance alongside firms, fellow regulators and frontier labs, addressing how agents are identified, what authority is delegated to them, who is accountable and how execution works. No date was attached.
The regulator also said it is working with banks on how frontier models are changing cyber defence, from finding and chaining vulnerabilities to speeding up triage, patching and recovery, and that those findings feed into supervision and policy. A joint FCA and Bank of England survey, due next week, will show that 86% of firms now use AI.
Why it matters for UK organisations
Most firms’ incident processes were designed around outages, cyber attacks and third-party failures. An AI failure often looks different. A model that quietly drifts, a chatbot that gives wrong guidance to thousands of customers, or an agent that executes a transaction outside its intended authority may never trip a conventional availability alert. If the FCA follows through, firms will need to detect, classify and escalate these events with the same discipline they apply to a ransomware incident.
Near-misses are the harder part. Very few organisations systematically log events that nearly caused harm, and fewer still do so for AI. Capturing them requires instrumentation, a shared definition of what counts, and a culture where engineers are not penalised for raising them.
The concentration point also deserves attention. Many firms run customer-facing AI on one foundation model through one provider. If that model is withdrawn, changed or unavailable, important business services may be affected, which pulls AI squarely into operational resilience mapping and impact tolerances.
Firms outside financial services should note this too: regulators borrow ideas from one another.
Expert view
In my experience, AI deployments are where governance currently lags furthest behind technology. When we test applications built on large language models, the controls around the model are often thinner than those around a standard web application: limited logging of prompts and outputs, weak boundaries on what an agent can call, and little thought about how a failure would even be noticed.
The FCA’s framing is sensible because it avoids inventing a parallel regime. Bolting AI onto existing incident reporting, SM&CR accountability and operational resilience is pragmatic. The weakness is ambiguity. “Significant” and “near-miss” will need definitions, and until the FCA provides them firms will interpret them inconsistently. I would rather see firms set their own conservative thresholds now than wait for a consultation and then scramble.
The agentic framework is the piece to watch. Agent identity and delegated authority are fundamentally access control problems, and the security profession already knows how badly over-privileged service accounts can go. Treating agents as privileged identities, with scoped permissions and full audit trails, is the obvious starting point.
What to do now
- Build an AI inventory. List every AI use case, the model and vendor behind it, the data it touches and the actions it can take. Assign a named accountable senior manager to each.
- Extend incident classification. Add AI-specific categories to your incident and near-miss taxonomy: harmful outputs, unexpected agent actions, model drift, provider changes and failed guardrails. Define internal thresholds for escalation.
- Instrument and log. Capture prompts, outputs, tool calls and agent decisions with enough fidelity to reconstruct an event. Feed these into your existing monitoring.
- Lock down agent permissions. Apply least privilege and secure configuration, in line with Cyber Essentials user access control and secure configuration, to every AI agent and its credentials.
- Map concentration risk. Identify important business services relying on a single model or provider, and test fallback options, including a manual route.
- Stress-test and red team. Run adversarial testing before deployment and after each model change, not once at launch.
- Review insurance. Check with your broker whether your cyber policy responds to AI-driven failures.
Bottom line
The FCA has not changed the rules today, and it has given no deadline. It has, however, made its expectations unusually plain: AI failures and near-misses belong in incident reporting, every use case needs an accountable owner, and single-model dependency is a weakness. Firms that start building AI incident capability now will be ready whenever formal requirements arrive.
