How can firms maintain oversight as AI takes on more decisions?

On 6 July 2026, the FCA published the Mills Review — a wide-ranging examination of how AI might reshape financial services by 2030. Drawing on more than 5,000 consumer responses and submissions from firms, academics, and regulators, the review outlines a future that looks significantly different from today.

For compliance, risk, and operations leaders, the question it raises is not theoretical. AI is already embedded in many firms’ workflows. The review simply accelerates a conversation that is already overdue.

From AI assistance to AI delegation

The review traces a three-stage evolution that most firms are currently navigating, even if they don’t describe it in those terms. In stage one, AI presents options — surfacing information, flagging patterns, or summarising data. In stage two, AI makes recommendations that humans ratify. In stage three, AI acts within agreed parameters without requiring human sign-off for each decision.

The review uses a simple but effective illustration: a customer’s savings account. AI first presents switching options. Then recommends a specific product. Eventually, it moves money automatically within parameters the customer has agreed to. The question for firms is not whether this kind of delegation is happening — it is whether their governance frameworks were designed for it.

What an AI-enabled financial system could look like

The review outlines an AI-enabled financial system in which automated agents are embedded across compliance monitoring, customer support, claims handling, and risk management. Agent-led customer journeys — where AI coordinates multiple tasks on behalf of a customer — are already emerging in early forms.

The review notes that roughly one in five consumers would already be open to AI systems making financial recommendations. The potential benefits are real: lower barriers to financial planning, higher product-switching rates, and more personalised service at scale.

The risks are equally real. Deepfakes, synthetic identities, AI-enabled fraud, and social engineering attacks represent a new threat surface that firms must monitor and report on.

“Meaningful governance requires more than placing a person within a process. Firms need clarity on what decisions humans are responsible for — and whether they genuinely understand the technology they oversee.”

The role of humans is changing, not disappearing

One of the most important clarifications in the review is that increased AI involvement does not mean fewer humans — it means differently positioned humans. The expectation is that people will shift away from task execution toward setting parameters, monitoring outcomes, investigating exceptions, and challenging AI-generated decisions.

That shift is conceptually straightforward. In practice, it demands something firms rarely have: a clear definition of which decisions are being delegated to AI, what the acceptable output range looks like, and how quickly a human can identify and act on exceptions.

Why accountability becomes harder

As AI ecosystems grow more complex — multiple models, third-party providers, interconnected supply chains — understanding how any given outcome was produced becomes significantly harder. The audit trail that compliance teams rely on becomes fragmented across systems, vendors, and decision layers.

The review highlights model drift as a specific concern. A system that was accurate at the point of testing may behave differently as market conditions shift or customer behaviour evolves. This means AI governance cannot be a one-off approval at deployment. It requires continuous monitoring — and the evidence to demonstrate that monitoring is actually happening.

Why the Consumer Duty remains central

The Mills Review concludes that the existing frameworks — the Consumer Duty and the Senior Managers Regime — remain a strong foundation. The challenge is not regulatory adequacy. The challenge is demonstrating how those obligations hold as AI grows more influential in customer journeys and decision-making.

For Consumer Duty specifically, the test is outcomes-based: can firms show that customers in comparable situations received comparable treatment, that needs and vulnerabilities were identified and acted upon, and that communications and decisions were fair? When AI is involved in any of those stages, the evidence trail for each question must still be there.

Regulation is becoming more data-driven

The review recommends development of an AI-enabled Agentic Supervisory Model for the FCA itself — a shift toward regulatory supervision that detects emerging harms and system-wide risks through data patterns rather than point-in-time document reviews. Future supervision is expected to emphasise outcomes, patterns, and real evidence rather than process documentation alone.

That is a significant shift. Firms whose oversight relies primarily on management information and periodic samples will be less well-positioned than those who can demonstrate continuous, structured monitoring across interactions and decisions.

Preparing for what comes next

Firms do not need fully autonomous AI before accountability questions arise. They arise the moment AI is shaping which customers get called back, which claims get prioritised, or which advice templates are applied. The ability to demonstrate effective oversight of those inputs may become just as important as the technology itself.

Recordsure is designed for exactly this environment — helping firms review customer interactions at scale, identify conduct risks, monitor outcomes, and evidence that controls are working. As AI takes on more of the work, what firms need is not less oversight but smarter, more systematic oversight.