The One Oversight Record Your AI Model Governance Leaves Out

Hi {{first_name | there}},

Welcome to The Accountability Record. This is a newsletter for the people personally named under SM&CR: the Senior Managers, compliance leads and risk owners who carry individual accountability for what AI does inside a regulated firm.

Here is the situation we are all in. Firms are being held accountable for their AI right now, under rules that already exist, and the FCA has been clear it is not writing a new AI rulebook to replace them. What it expects instead is evidence: that the named person responsible actually oversaw the system, and can show it. Most firms have the governance. Very few have the individual evidence. And the regulator's own guidance on what that evidence should look like is not due until the end of the year.

So we are not waiting for it. Over the coming weeks, this series gives away the practical artefacts we built to close that gap, the records a named individual can use to evidence oversight today, free and ready to use. We will be candid about why: BuildMoat builds the engine that produces and maintains these records across every AI system in a firm. Putting the tools in your hands, one at a time, is how we show you the problem is real and the approach works. If the hand-tools are all you ever need, keep them with our compliments. If your AI estate is bigger than a handful of systems, you will know where to find us.

We are giving away the SM&CR AI Attribution Certificate: the record a named Senior Manager uses to show, in writing and dated to the day of deployment, that they personally oversaw an AI system before it went live. It is free, it works today, and it fills the one gap your model-governance stack leaves open.

→ Download the SM&CR AI Attribution Certificate

This is the first in a short series of accountability artefacts we are releasing over the coming weeks. Next week we give away the Quarterly AI Oversight Pack, the companion record that evidences oversight continuously, not just at go-live.

Take the certificate now if that is all you came for. If you want to know why we are giving it away rather than selling it, and why the regulator has made this the thing that matters, read on.

On 6 July, the FCA published the Mills Review, its most senior assessment yet of how AI will reshape retail financial services. Firms hoping the report would hand them a dedicated AI rulebook, and with it somewhere to point when something goes wrong, did not get one.

The Review, led by outgoing Executive Director Sheldon Mills, concludes that the existing framework is broadly sound and recommends no new AI-specific rules. The Consumer Duty, the Senior Managers Regime and the operational resilience rules are treated as the framework that already governs AI. This echoes what the FCA said on 2 June, when it confirmed it would not introduce new rules and that existing regimes would govern how firms use the technology.

What changed on 6 July is the candour. The Review is open that these regimes, SM&CR included, will come under growing strain as systems become more autonomous. And it settles the question that matters most to anyone reading this: accountability does not move to the model.

Sign up for a free trial of Attio, the agentic CRM.

Ask Attio to build a daily workflow that surfaces the deals that need your attention today, like anything with a stage change, a recent reply, or a new signal in the last 24 hours.

Review your pipeline in Claude, synced live from Attio via MCP.

That's it.

Try Attio Now

The Review is explicit that the Senior Managers Regime keeps applying as AI takes on more of the work. A named Senior Manager stays accountable for outcomes in their area even where the model's behaviour, and its updates, sit partly outside the firm's direct control.

Read that again, because it removes the most common private hope in the market: that enough autonomy, or a capable enough vendor, eventually dilutes personal liability. It does not. Delegating a decision to an algorithm does not delegate the accountability for it. This is consistent with what FCA Executive Director David Geale told the Treasury Committee in January, when he said individuals in regulated firms are "on the hook" for consumer harm caused by AI. Individuals, not firms. Under existing rules, not future ones.

The regime applies now. The guidance on how to satisfy it is not here yet. The Treasury Committee has asked the FCA to publish practical guidance on the accountability expected under SM&CR for AI harm by the end of 2026, and a good and poor practice publication is promised later this year. Mills himself framed the hardest question without answering it: what do reasonable steps look like when a model updates weekly, relies on components you do not control, and behaves differently the moment new data arrives.

So the clarity is coming, later. The accountability is here, now. That gap, between live accountability and pending guidance, is not the regulator's to hold. It is yours. And the Senior Manager who waits for the guidance before building the oversight record carries the personal consequence if something goes wrong in the meantime.

The through-line across every recent FCA signal is the same: it is not enough to govern your AI well, you have to be able to show that you did. Demonstrating that takes a stack, not a single document: a live inventory of your material AI models, independently validated in the spirit of the PRA's SS1/23 model-risk expectations; audit trails and human-in-the-loop controls that show where a person could intervene, and did; and monitoring that catches drift after go-live, not just at approval.

And the piece most firms miss entirely: individual attribution. The stack above proves the firm governed the model. None of it answers the first question a supervisor asks when a system causes harm, which is personal. Who owned this, and what did they check before it went live. That answer has to exist in writing, attached to a named individual, dated to the moment of deployment, not reconstructed afterwards when everyone knows when it was written.

That is the gap the Attribution Certificate closes, and it is why we are starting the series with it.

Over the next few weeks, the artefacts, each free and each usable the day you download it:

More will follow. Each closes a different part of the evidence chain.

One certificate, filled in once, is straightforward. The reality in a regulated firm is not one AI system. It is dozens, changing constantly, each needing its own current, defensible record. Doing that by hand does not scale, and a record you can quietly edit after the fact is a record a supervisor can discount.

That is what BuildMoat's engine is for. It produces and maintains an attribution record for every AI system in your estate, keeps each one current as models and vendors change, and stores every version as a hashed, tamper-evident record, so the date on it is provable and no one can argue it was written after the event. It runs continuously, 24/7, coordinating the evidence across your whole AI footprint rather than leaving it to a quarterly scramble.

The artefacts we give away are the hand-tools. The engine is the always-on system that runs them at scale. The certificate shows you the shape of the problem. The engine is how you stay ahead of it, across every system, every day.

→ Start with the certificate. It is free.

Until next week, The Accountability Record

That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.

Forward this to one person who should be reading it.

Find me on X and LinkedIn if you want to continue the conversation there.

For sponsorship enquiries, email [email protected]

Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.

Until next week.