Hi {{first_name | there}},
The moment the Mills Review dropped this morning, I knew exactly where to start. Not with the headlines, with the lens I've been building BuildMoat on for the past year: evidential accountability. I went through all 147 pages looking for one thing, whether the regulator's own thinking lined up with what I've been arguing to CCOs and SMF holders since January. It did, more precisely than I expected. If I'd tried to draft the validation myself, I couldn't have written it better.
But this isn't just a confirmation exercise, and treating it as one would miss the more useful thing the Review does. It moves the conversation forward. It tells us, in the regulator's own words, roughly where it sees agentic AI heading by 2030, and what that means for how oversight gets exercised once AI stops assisting decisions and starts making them.
So here's the quick version, built for CCOs, CROs and anyone else who needs the shape of this before their next committee meeting, not the full 147 pages. The core shift is this: accountability for AI-assisted decisions doesn't change. What changes is whether you can prove you exercised it, as we move from a slower, paper-based oversight model into one that has to keep pace with AI's speed and complexity. Let's go through it together.
Sheldon Mills' review into AI and the future of retail financial services runs 147 pages and seven recommendations. Here's the one sentence that should stop every SMF holder mid-scroll:
At higher levels of AI autonomy, firms may find it more difficult to evidence consumer understanding, demonstrate good outcomes, and maintain clear lines of accountability.
Read that again. Not "firms may become unaccountable." Firms may find it more difficult to evidence that they were accountable. The Review is explicit, repeatedly, that the Senior Managers Regime and Consumer Duty remain fit for purpose. Nothing about who is responsible has changed. What's changed is whether you can prove it.
The distinction that matters
Most reactions to this review this week will treat it as a story about AI risk. It isn't. It's a story about proof. The FCA's own autonomy spectrum, Operator through Observer, makes the point better than any commentary could:
At Operator and Collaborator level, where a human uses AI as a tool or works alongside it, the Review says accountability "operates effectively." At Consultant level, where AI recommends and a human decides, accountability remains clear but may require "effective human challenge of AI output." At Approver, where AI prepares and a human authorises, oversight "becomes more challenging." At Observer, where AI acts within boundaries and a human monitors, meaningful human control is "likely to be difficult to evidence."
That's not a risk curve. It's an evidence curve. And most firms don't currently know where their own AI deployments sit on it.
If you haven't read the review, here's the scale in plain terms:
Operator: a human does the work, AI is just a tool. Full control, nothing changes.
Collaborator: human and AI work side by side, human stays actively engaged throughout.
Consultant: AI recommends, human decides. Sounds safe, but the human is now reviewing a conclusion instead of doing the thinking. This is where firms drift without noticing.
Approver: AI prepares the whole decision, the human's job shrinks to signing off. "I took reasonable steps" gets hard to prove when the step was clicking approve.
Observer: AI acts within set boundaries, human just checks in periodically. This is the FCA's own pressure point: control may still exist, but proving it does is another matter.
Almost no firm sits cleanly at one level. A single process drifts from Collaborator toward Approver over eighteen months without anyone deciding to move it there. Nobody signs off on "let's go to Approver." It just happens as the tool earns more trust and gets reviewed less. That drift, unnoticed and undocumented, is where the next enforcement case gets built.
What this looks like on a Tuesday
Three places this stops being theoretical.
Model sign-off. If your governance still treats AI approval as a single gate, tested once, reviewed annually, the Review's language on model drift and continual learning should worry you. A model that keeps learning after deployment cannot be signed off once and left alone. That's not a five-year problem. It's already happening in systems live today.
The reasonable steps test. Every SMF holder already lives under this. The Review states plainly that as AI moves toward Approver or Observer, senior managers may struggle to demonstrate what reasonable steps they took, because the decision now runs through a system instead of a person. The practical implication: the evidence needs to exist at the moment of the decision. Reconstructing it afterward from meeting notes and memory is not a strategy, it's an admission.
Third-party dependency. The Review is blunt that firms remain accountable even where a model's behaviour sits outside their direct control. If you license a foundation model or run a vendor's fraud engine, "the vendor changed something" was never going to hold up. The Review just made explicit that the burden of proof sits with you regardless of where the model lives.
The uncomfortable part
Everything in this document is phrased as "the FCA should consider." Nothing here is binding. The perimeter review alone is proposed to start within three to six months, not conclude. If your first instinct on reading this was "we're now non-compliant," that's wrong, and it's the kind of claim that gets exposed the moment you say it to compliance leads who's actually read the thing.
The honest read is narrower and, frankly, more useful: the direction of travel is unambiguous, but the distance to enforcement isn't zero yet either. That gap is the opportunity. Firms building the evidencing muscle now are building it while it's still a differentiator. Firms waiting for a rule to force it will find that by the time the rule exists, doing the minimum will be table stakes, not an advantage.
For consumers, the same direction, different stakes
The Review found that one in five UK adults are already open to AI making financial decisions for them, and that a meaningful share already trust general-purpose tools like ChatGPT, Claude or Gemini with financial questions, often without realising they have no formal recourse if it goes wrong. That gap between consumer trust and consumer protection is exactly where a Consumer Duty finding gets built now and discovered in eighteen months.
The question worth asking your own team this week isn't "are we compliant." It's "where does each AI-touching process actually sit on the FCA's own spectrum, and does our evidence match that level." Most firms haven't run that exercise. The ones who run it first will be the ones with an answer ready when someone asks.
Read something in this that applies to your firm specifically? Reply and I'll send you the fuller breakdown, including where the Review's language maps directly onto what "reasonable steps" evidence needs to look like in practice.
Thanks for Reading
The gap this newsletter tracks every week isn't a knowledge gap. Compliance leaders know the FCA expects genuine oversight before AI-assisted decisions get made. The gap is evidential: when a regulator asks a named SMF holder to prove they exercised that oversight, in the moment, before the decision, not after. Most firms have a policy document. Almost none have a contemporaneous record.
If you're building that evidence trail, or trying to work out what it should even look like for your firm, we should talk. Not a sales call, a conversation about where you actually are.
If someone forwarded this to you and it landed, subscribe below. We publish weekly on the evidence trail FCA-regulated firms need before, not after, AI-assisted decisions.
Keep building,
Emeka Ogbonnaya | LinkedIn
BuildMoat - Pre-deployment evidential accountability infrastructure