UK financial services AI governance: what do regulators expect now?

TL;DR: UK financial services AI governance is still anchored in existing obligations, according to NeuralTrust, with the FCA relying on Consumer Duty and SM&CR, the PRA on model risk management, and the ICO on automated-decision safeguards rather than AI-specific rules. The practical test is whether firms can evidence named ownership, meaningful human control and defensible records for each system.

Editorial analysis by NHI Mgmt Group, based on content published by NeuralTrust: “AI Governance for UK Financial Services”.

By the numbers:

• The Mills Review drew on 140 written submissions before concluding that lower-autonomy AI can still fit within the existing SM&CR model.
• HM Treasury designated the first four critical third parties on 10 July 2026.
• The Data (Use and Access) Act's automated decision-making rules have applied since 5 February 2026.

Key questions

Q: What should firms do first when AI governance is still covered by existing rules?

A: Start with a complete inventory of AI systems, assign a named owner to each one and record the business decision it affects.

Q: Why does higher autonomy make AI harder to govern under current financial services rules?

A: Higher autonomy weakens the assumption that a human can meaningfully review or stop the decision before it takes effect.

Q: What are the signs that AI governance is failing in the enterprise?

A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.

Practitioner guidance

• Build a live inventory of AI systems and agents Record the owner, vendor, data sources, autonomy level and customer impact for every material AI use case, including embedded third-party features.
• Classify AI systems by decision autonomy Separate assistants, collaborators, consultants, approvers and observers so that governance evidence matches the real level of delegated decision-making.
• Document meaningful human intervention points Define where a person can review, override, pause or contest a system decision, then keep evidence that those interventions are available in practice.

Bottom line: UK financial services AI governance is being forced to fit existing regulatory structures, so accountability and evidence matter more than a new rulebook.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →