Recently featured in European Business Magazine, TCC Group and Recordsure CEO Joe Norburn explores why the FCA’s Mills Review should be an important marker for firms adopting artificial intelligence (AI) and how organisations can maintain accountability, oversight and evidence as AI becomes more deeply embedded across financial services.
Published by the FCA in July 2026, the Mills Review examines how AI could transform retail financial services by 2030, while highlighting the governance, regulatory and consumer protection considerations firms would need to address as adoption accelerates.
A key message from the Review is that existing regulatory requirements remain unchanged. FCA’s Consumer Duty, the Senior Managers Regime (SMR) and operational resilience obligations continue to apply, regardless of whether AI solutions are developed internally or delivered through third-party providers. As firms increasingly rely on AI-driven decision-making, regulators will expect greater transparency, robust oversight and clear accountability frameworks.
The Review also emphasises the importance of understanding where AI is being used across the organisation, including informal use of general-purpose AI tools. Firms need visibility of where AI influences customer interactions and business decisions, who is accountable for outcomes, and how performance is monitored over time.
As Joe Norburn notes:
“Boards now need a practical account of where AI affects decisions, who carries responsibility and how the firm knows customers are being treated fairly.”
For firms navigating AI adoption, evidencing governance and customer outcomes will become increasingly important. Organisations will need reliable monitoring capabilities, clear audit trails and robust records that demonstrate how decisions are made and how customer interests continue to be protected.
As AI rises up both regulatory and government agendas, the Mills Review provides an early indication of where supervisory expectations may develop next, reinforcing the importance of effective oversight, ongoing monitoring and demonstrable compliance.
