24 Hours and Seven Firms

On Wednesday, I shared an article explaining why my recent content has been leaning more heavily into compliance, and specifically the gap I’m seeing in how organisations approach AI in regulated environments.

Most solutions on the market are still AI-naive. They focus on tools, not on the behavioural and operational shift required to use those tools effectively, especially where accountability and regulatory scrutiny sit.

That shift is exactly what led to the development of our AI Compliance Co-Pilot. It’s designed not just to help compliance teams adopt AI, but to embed it into real workflows, increase productivity, and redefine how responsibility and decision-making are distributed across the organisation.

I also committed to a new rhythm. Every Friday, I’ll be sharing a short editorial on developments across the UK financial services regulatory landscape, with a focus on what they actually mean for compliance teams working with AI and embedded workflows.

This week, two regulatory developments landed within days of each other, and most compliance teams have only clocked one of them. The FCA, PRA, and Bank of England finalised rules giving firms 12 months to build a reporting framework that can file an operational incident notification within 24 hours of crossing a prescribed threshold.

Separately, the FCA confirmed active enforcement cases against seven named firms for Consumer Duty failures, two insurers, five investment and asset management businesses. These are not coincidental. The regulator is shifting from checking whether you have policies to testing whether you can perform under pressure. AI is embedded in both of these workflows at most large firms. That is exactly the problem.

Attio is the AI CRM with conversational AI built directly into your workspace. Every morning, Ask Attio handles my prep:

All in seconds. No searching, no switching tabs, no manual updates.

Ready to scale faster?

Start now →

PS26/2: You have 12 months to build a 24-hour reporting capability, and most firms' AI is already in the way

On 18 March 2026, the FCA, PRA, and Bank of England jointly published PS26/2 and the linked PRA Policy Statement PS7/26. The rules come into force on 18 March 2027. The centrepiece obligation is a 24-hour reporting window: once a firm determines that an operational incident has crossed a prescribed threshold, a regulatory notification must follow, as soon as practicable, and within 24 hours. Payment service providers face a tighter 4-hour window. Alongside this, all firms must maintain a centralised register of material third-party arrangements and submit it to regulators annually. Enhanced-tier firms will file more granular updates throughout an incident lifecycle using a consolidated reporting form. The regulators were explicit about their intent: they want "increased supervisory awareness of incidents encountered by firms, and increased visibility of third-party dependencies across the sector." This is systemic oversight infrastructure, not a paperwork update.

Every PRA-regulated bank, insurer, and investment firm is in scope. So are a broad range of FCA-regulated entities including deposit-takers and third-country branches. The 12-month implementation period begins now. That sounds generous until you map what actually needs to change: threshold definitions, escalation protocols, SM&CR accountability assignments, third-party registers, and the operational capability to execute all of it under a real-time clock. Firms that have treated operational resilience as an annual review exercise are about to discover it has acquired a live dimension that no amount of retrospective documentation will fix.

The AI governance implication is specific and almost universally underestimated. Most large regulated firms have already deployed AI into operational monitoring, anomaly detection, system health alerting, third-party performance tracking, incident triage. These systems are often the first mechanism to surface a potential incident. Under PS26/2, the 24-hour clock starts when the firm "determines" a threshold has been met. If AI is generating or surfacing that determination, the question becomes: who is the SM&CR Senior Manager accountable for accepting it, authorising the report, and putting their name to it? If the escalation path between AI output and named human authority is not documented and tested before the clock starts, the firm is not compliant, regardless of how accurate the AI is. A 24-hour window cannot be navigated through improvisation. It requires pre-designed accountability, not retrospective scrambling.

The FCA's regulatory priority reports published across the sector between 3 and 19 March 2026 make one thing unambiguous: the Consumer Duty implementation phase is over. The FCA is no longer asking whether you have the Duty in place. It is demanding measurable evidence that the Duty is delivering tangible consumer benefit, and it has opened enforcement cases to reinforce the point.

Two of the most serious cases involve insurers in the home and travel markets. Five further investigations are underway in consumer investment and asset management, with the FCA citing suspected misleading statements and failures to identify or manage conflicts of interest. Consumer Duty is now, in the FCA's own framing, "the default lens for supervision and enforcement escalation."

The FCA also confirmed a H1 2026 consultation on how the Duty applies across distribution chains, specifically co-manufacturing arrangements in insurance and the scope of reliance arrangements between distributors and manufacturers.

Every consumer-facing firm is in scope: retail banks, insurers, investment advisers, consumer finance lenders, asset managers. The FCA has identified underperformance in home insurance, travel insurance, consumer investments, and asset management, and has moved from signalling concern to opening cases.

Firms that structured Consumer Duty as a documentation exercise rather than an outcomes discipline are the ones now under investigation. The upcoming H1 consultation on distribution chains will matter especially for firms operating in co-manufacturing or multi-party arrangements, where accountability for consumer outcomes has been conveniently diffused. That diffusion is now a regulatory risk, not a structural feature.

The AI governance implication is direct. Consumer Duty's four outcome pillars, products and services, price and value, consumer understanding, consumer support, now carry an evidential burden that documentation alone cannot discharge. Firms using AI in product design, pricing engines, customer communications, suitability assessments, or claims handling must demonstrate that the AI-driven process produced measurable, interpretable, and favourable consumer outcomes. Not that it followed a documented process.

Not that it was trained on the right data. That the outcomes were good, and that a named human accountable under SM&CR can explain why. AI systems that influence consumer decisions but cannot produce interpretable output are now carrying enforcement risk inside Consumer Duty workflows. The FCA has seven firms in its sights. More will follow.

The best HR advice comes from those in the trenches. That’s what this is: real-world HR insights delivered in a newsletter from Hebba Youssef, a Chief People Officer who’s been there. Practical, real strategies with a dash of humor. Because HR shouldn’t be thankless—and you shouldn’t be alone in it.

Sign Up Free

Both developments this week expose the same underlying failure: firms deployed AI into regulated workflows without assigning human accountability at the points where regulatory obligations are triggered. PS26/2 puts a 24-hour clock on that omission. Consumer Duty enforcement puts a case number on it. In both situations, the AI is already in the process, detecting incidents, pricing products, shaping consumer journeys, but the human infrastructure around it has not been built.

No named Senior Manager with documented AI oversight obligations. No tested escalation path from AI output to human decision authority. No outcomes monitoring that produces evidence a regulator can read. The firms that survive the next 12 months of intensifying FCA scrutiny are not the ones with the most capable AI.

They are the ones that built the human infrastructure first. If you are a Head of Compliance or Head of AI, your task this week is the same: map every AI-assisted workflow that touches a regulatory trigger, incident detection, product recommendation, pricing, consumer communications, and find the named human who can explain, authorise, and stand behind every output. If you cannot find that person, you have found the gap.

Your AI system surfaces an operational incident at 9am on a Tuesday. The 24-hour clock starts now. Who is the named SM&CR Senior Manager who will own that regulatory report, and have they ever seen the AI output that would inform it?

If this is a live problem in your organisation, reply to this email. BuildMoat works with UK financial services firms to build the human infrastructure that closes the gap between AI deployment and regulatory accountability.

BuildMoat — buildmoat.co.uk