The Mills Review: AI, autonomy and accountability
In short: The Mills Review, published by the FCA on 6 July 2026, finds that accountability in retail financial services does not shift as AI takes on more of the work. The Senior Managers Regime still applies, firms remain answerable for AI-driven outcomes, and the report sets out seven recommendations for the FCA Board to consider.
When an AI system arranges a customer’s mortgage, moves their savings or recommends a pension, who answers if it goes wrong? The Mills Review, the FCA’s assessment of how artificial intelligence will reshape retail financial services by 2030, puts that question at its centre. Led by FCA executive director Sheldon Mills and published on 6 July 2026, it concludes that the framework holds: the Consumer Duty, the Senior Managers Regime and the operational resilience rules were built to flex, and firms stay answerable for outcomes even as autonomy grows. Tracing that accountability is harder once decisions run across models a firm does not control.
Key findings from the Mills Review consumer research
The review drew on 140 written submissions and commissioned a nationally representative survey of 5,026 UK adults, run by Yonder in April 2026. The consumer figures below show adoption already under way and a clear gap in what consumers understand about recourse.
- 16% of consumers already use AI for at least one personal-finance task, rising to over one in five among those who use AI at all. Source: Mills Review consumer research (Yonder, April 2026).
- Around 26% trust general-purpose tools such as ChatGPT, Claude or Gemini for financial advice. Source: Yonder/FCA, April 2026.
- One in five UK adults are open to AI making financial decisions for them, with demand strongest for debt advice, pensions and investments. Source: Yonder/FCA, April 2026.
- Only 40% of consumers correctly recognise that there is no formal route to recourse when they rely on general-purpose AI. Source: Yonder/FCA, April 2026.
- The review frames AI against long-standing market failures: only 9% use traditional advice, 30% hold protection, around 900,000 adults are unbanked and £300bn sits in low-interest accounts. Source: Mills Review.
| Indicator | Figure | Source |
|---|---|---|
| Consumers using AI for a personal-finance task | 16% (over 1 in 5 of AI users) | Yonder/FCA, April 2026 |
| Trust general-purpose AI tools for financial advice | Around 26% | Yonder/FCA, April 2026 |
| Open to AI making financial decisions for them | 1 in 5 UK adults | Yonder/FCA, April 2026 |
| Correctly recognise there is no recourse | 40% | Yonder/FCA, April 2026 |
| Survey sample and fieldwork | 5,026 adults, April 2026 | Yonder/FCA |
| Priority recommendations for the FCA Board | 7 | Mills Review |
The autonomy spectrum and the framework behind it
The Mills Review sets out an autonomy spectrum with five human roles: operator, collaborator, consultant, approver and observer. At one end a person uses AI as a tool; at the other, AI acts continuously within agreed limits while the person monitors outcomes. The review’s central claim is that today’s regulatory levers work well at the operator, collaborator and consultant stages, and that the pressure emerges as firms and consumers reach the approver and observer stages, where AI becomes a core operational capability embedded across workflows.
The report follows the FCA’s engagement paper of January 2026, which sought views across four themes and closed on 24 February 2026. Respondents did not ask the FCA to rewrite the rules. They asked for clarity on how the existing regime applies as AI use grows: the Consumer Duty in the FCA Handbook, the Senior Managers Regime under the Financial Services and Markets Act 2000, and the operational resilience and critical third parties framework added by the Financial Services and Markets Act 2023.
Why accountability does not move with autonomy
The review is clear that the Senior Managers Regime continues to apply as AI systems become more autonomous. No respondent argued that the accountability model should change, and the review agrees it still binds: a senior manager remains answerable for outcomes even where a model’s behaviour, performance and updates sit partly outside the firm’s direct control. Model risk management must evolve. General-purpose and frontier models bring opacity, model drift, data bias and hallucinations that point-in-time validation does not catch, so the review calls for more dynamic monitoring and assurance across the AI lifecycle.
Accountability is hardest to trace at the regulatory perimeter. The UK regime is activity-based: firms hold permissions for regulated activities, and general-purpose AI tools that consumers already use for financial decisions sit largely outside it. The review’s first recommendation is that the FCA launch a review, within three to six months, into the scale and impact of general-purpose large language models operating beyond the perimeter, examining how the advice and guidance boundary works in conversational interfaces, how the “by way of business” test applies, and how the financial promotion restriction in section 21 of the Financial Services and Markets Act 2000 reaches AI-mediated journeys. The consumer research shows why it matters: only 40% of people correctly recognise that there is no formal route to recourse when they rely on a general-purpose tool. Our earlier note on the FCA AI approach and the AI Lab sets out the supervisory groundwork the review now proposes to scale.
What the Mills Review means for regulated firms
For payment service providers, e-money institutions and other regulated firms, the practical work is governance. The review expects model risk management to extend to deeper reliance on third-party model providers, which is where the accountability trail becomes hardest to hold. A senior manager who signs off an AI deployment carries responsibility for a system whose training, updates and drift belong to a supplier. Concentration in a small number of model, cloud and infrastructure providers also raises system-wide resilience questions, which the review links to the critical third parties regime and to stronger coordination between regulators.
The opportunity the review identifies is agentic finance: AI agents that act for consumers within agreed limits, easing onboarding, switching and ongoing money management. Its fifth recommendation is a trusted framework for how such agents are authorised, identified and held accountable, covering consent mandates, identity, control and liability. That work depends on data access and on digital identity, which the review notes sits outside the FCA’s remit. Firms building toward account-to-account and agent-led journeys will recognise the same dependencies from the open banking competition regime. Where an AI deployment raises questions about the advice boundary or senior-manager accountability, our AI and data governance advice page sets out how we help.
Viewpoint
The Mills Review’s restraint is welcome. It does not reach for new rules; it holds accountability where the Senior Managers Regime already puts it, and leaves firms and the FCA to work out how that regime operates when a named senior manager owns the risk of a model they neither build nor update. That work belongs in supervision and in firms’ own model risk governance. I put more weight on identity and consent infrastructure than on the perimeter. The review flags that infrastructure as outside the FCA’s remit, and it is the real constraint on agentic finance: without trusted digital identity, agent mandates and clear liability, the trusted-agent framework in recommendation five cannot be built. The perimeter review the FCA proposes within three to six months is the development to watch. It is where the regulator will set its first concrete position on general-purpose AI, ahead of the Board’s response to the seven recommendations.
Frequently asked questions
What is the Mills Review?
The Mills Review is the FCA’s assessment of how AI will transform retail financial services by 2030 and beyond, published on 6 July 2026 and led by FCA executive director Sheldon Mills. It draws on 140 submissions and a survey of 5,026 UK adults, and makes seven priority recommendations for the FCA Board to consider.
Does the Senior Managers Regime apply to AI-driven decisions?
Yes. The review concludes that the Senior Managers Regime continues to apply as AI systems become more autonomous. A senior manager remains accountable for outcomes even where model behaviour and updates sit partly outside the firm’s control. Firms and the FCA will need to work through how the regime operates in practice as automation increases.
Are ChatGPT, Claude or Gemini regulated when used for financial advice?
General-purpose AI tools sit largely outside the FCA’s activity-based perimeter, so a consumer using one for financial decisions may have no formal route to recourse. The review’s first recommendation is a review of how general-purpose large language models outside the perimeter engage the advice and guidance boundary and the financial promotion rules under the Financial Services and Markets Act 2000.
What did the review recommend?
It makes seven recommendations for the FCA Board to consider: secure and adapt the regulatory perimeter; strengthen system-wide coordination; monitor the transition to autonomous models; scale up the FCA AI Lab; enable the foundations for agentic finance; build an AI-enabled supervisory model; and develop a free, public-interest AI financial capability service.
If you are assessing how the Senior Managers Regime, the Consumer Duty and the advice boundary apply to an AI deployment, Bratby Law advises payment firms, e-money institutions and fintechs on AI accountability and governance. Contact Rob Bratby.
