FCA AI Governance Banking 2026: Mills Review, Consumer Duty AI Obligations, SM&CR Accountability, and UK Financial Services AI Compliance

The UK's approach is genuinely different from the EU's, and that difference has real consequences for group-level AI governance

The UK has not built, and shows no sign of building, an AI-specific rulebook comparable to the EU AI Act. Instead, existing regimes — Consumer Duty and the Senior Managers and Certification Regime (SM&CR) — apply to AI systems the same way they apply to any other process that touches a customer or a regulated decision. Whatever the precise source document, the substance of the UK's position is consistent with the FCA's publicly stated, technology-neutral regulatory philosophy: same rules, new technology, no carve-out.

So what: if your UK governance program has been waiting for FCA-specific AI rules before building controls, stop waiting. Consumer Duty and SM&CR already apply to every AI system touching a UK consumer outcome today, with no grace period tied to AI-specific rulemaking that hasn't happened.

Consumer Duty turns four existing outcomes into four AI-specific obligations

Products and Services — AI determining product eligibility, mortgage affordability, or investment suitability has to demonstrate accuracy across consumer segments, with particular attention to vulnerable customers, and firms need documented testing evidence plus investigation of exceptions rather than a pass/fail model-accuracy number alone.

Price and Value — AI-driven pricing cannot create systematic disadvantage for specific consumer groups; firms need evidence that AI-priced products deliver fair value across cohorts and that no segment receives systematically worse terms than a non-AI alternative would have produced.

Consumer Understanding — AI-generated or AI-personalised communication has to be tested for actual comprehension, not just technical correctness. Content that's factually accurate but less comprehensible than a human-authored equivalent is a Consumer Understanding failure under this framework, even with no factual error anywhere in it.

Consumer Support — AI chatbots and automated support have to deliver service equivalent to a human channel, including hallucination monitoring, distress-detection protocols, and specific accuracy testing for regulatory information like complaint rights and FSCS protection — a chatbot that confidently gives a customer wrong information about their deposit protection is a Consumer Support failure regardless of how fluent the response sounded.

So what: test every consumer-facing AI output against all four outcomes separately, not as a single combined "customer experience" review. A system can pass Products and Services testing and still fail Consumer Understanding if its explanations are technically correct but harder to parse than what a human adviser would have said.

SM&CR puts a named person's career on the line for AI failures, which changes incentives faster than any technical control does

Senior Managers carry personal accountability for AI-related consumer harm under three mechanisms: Prescribed Responsibilities documentation naming which Senior Manager owns AI governance, Statements of Responsibilities reflecting AI systems carrying material risk, and Individual Conduct Rules applying directly to Certified Persons who design or operate AI systems. The FCA can act against a Senior Manager personally for failing to take reasonable steps to prevent an AI conduct failure — which means "we had a vendor contract" is not a defence if that Senior Manager can't show documented risk assessment, tested controls, and ongoing monitoring evidence.

So what: if no Senior Manager's Statement of Responsibilities currently names AI governance explicitly, that's a gap to close immediately — not because it's a paperwork formality, but because it determines who the FCA can actually hold accountable when something goes wrong.

Operational resilience treats a degraded model the same as a system outage

AI systems supporting important business services have to be mapped as operational dependencies under the same regime that covers any other critical system. Model degradation counts as operational disruption in the same category as a system outage; single-provider AI dependency requires substitution testing the same way any other critical vendor concentration would; and AI-specific failure scenarios need to appear in resilience testing alongside conventional cyber scenarios, not as a separate, lower-priority exercise.

So what: if your operational resilience testing plan doesn't include a scenario where your core AI model degrades or becomes unavailable, that plan has a gap a supervisor will find before you do.

India banks operating in the UK carry both regimes at once, and the overlap is where the efficiency actually lives

ICICI Bank UK and Bank of Baroda (UK) Ltd both have to satisfy Consumer Duty for their UK retail products while maintaining RBI MRMF-compatible documentation for group-level governance; SBI UK Ltd applies the same dual-jurisdiction discipline to its trade finance and correspondent banking AI. For any India-headquartered bank with a UK-regulated subsidiary, the efficient path is one governance framework mapped to both regulators' requirements, rather than building and maintaining two separate AI governance programs for what is often the same underlying model.

So what: if your UK subsidiary and your India parent maintain entirely separate AI governance documentation for shared models, you're paying for the duplication twice over — once in cost, and once in the inconsistency risk that shows up when an examiner on either side asks a question the other side answered differently.

A four-point action checklist

1. Confirm every consumer-facing AI system has been tested against all four Consumer Duty outcomes separately, with documented evidence for each — not a single combined review.
2. Name a specific Senior Manager's Statement of Responsibilities for AI governance today, if one doesn't already exist.
3. Add AI model degradation and single-vendor-dependency scenarios to your operational resilience testing plan.
4. If you operate a UK subsidiary of an India-headquartered bank, map one governance framework to both RBI and FCA requirements rather than running two separate programs for the same models.