In January, the Treasury Select Committee published its report on AI in financial services and asked for something specific: by the end of 2026, the FCA should publish practical guidance on the accountability and level of assurance expected from senior managers, under the Senior Managers regime, for harm caused through AI. The government and regulators responded in the spring. The designation of the first critical third parties in July delivered another of the report's recommendations. The accountability guidance has not yet appeared.
Seven months on, it is worth examining what that recommendation will require when it lands, because guidance on the assurance expected from senior managers has to answer a question the report itself left open. Assurance is demonstrated with records. Which records, held by whom, anchored how? This piece proposes an answer the guidance could adopt: a register of named accountable owners, one person, per system, on record, and the two properties that decide whether such a register is worth anything under challenge.
The two questions the guidance will have to answer
The January recommendation had the right instinct and stopped one layer short of the operative detail, in exactly the way most accountability proposals do. A register of named owners answers who. It does not answer the two questions that decide whether the register is worth anything under challenge.
First, who holds the register? A register maintained by the organisation it describes is a self-asserted record. The organisation writes the names, the organisation dates the entries, and the organisation can, in principle, rewrite both. That is not a hypothetical weakness. It is the precise gap that separates governance documentation from forensic evidence, and it is the gap a regulator or a claimant's counsel is professionally instructed to probe. A register held or anchored by someone other than the organisation, a regulator's filing system, an external attestation, any mechanism the organisation does not administer, makes a categorically different claim.
Second, what anchors its dates? An entry that says a named individual took ownership of a system in March is only as strong as the evidence that the entry was made in March rather than assembled the week before the inspection. The Senior Managers regime already understands this: a Statement of Responsibilities is filed with the regulator, which is why it works. The date is fixed by the act of filing, outside the firm's control. A register recommendation that does not specify the anchoring mechanism recommends a document, not a control.
Why the machinery question is now the whole question
In January there was an obvious answer to who would hold such a register: the department responsible for AI policy. That answer no longer exists in the same form. AI strategy now sits with the Cabinet Office, sector supervision with the regulators, business policy with an enlarged industry department. A register recommendation revived today has to name its holder from a menu that was redrawn last month, and each candidate carries a different evidentiary weight. A register held at the Cabinet Office is a policy instrument. A register filed with a sector regulator, on the SM&CR model, is an enforcement instrument. The committee's recommendation survives the reorganisation. Its implementation now requires a decision nobody has yet been asked to make.
What a firm should do while nobody decides
The absence of a mandated register does not leave a board without a move. It leaves it with a cheaper version of the same move. A firm that maintains its own named-owner register, and anchors it, dates fixed by external attestation, entries tied to board filings, any mechanism outside its own administrative reach, has built the thing the committee recommended before being required to. If a register requirement arrives, the firm is already compliant. If it never arrives, the firm holds contemporaneous evidence of exactly the accountability regulators keep saying they expect. And if the firm is ever asked to demonstrate its governance, the difference between producing a register anchored eighteen months ago and assembling one in the fortnight after the request is the difference this newsletter has spent five months setting out.
The committee asked the right question in January. The reorganisation has made the answer harder and the need clearer. The firms that move before the machinery decides will own the strongest records in the room when it does.
Regulatory references: House of Commons select committee recommendation (January 2026); SM&CR (SYSC, FCA Handbook); FSMA 2023 critical third parties regime (first designations July 2026); FCA Mills Review (July 2026); EU AI Act Article 50 for continuity.
The Roche-Review is the weekly publication of Dr Ivan Roche FRSS FRSA MInstP, Founder of Otopoetic Limited. Subscribe at roche-review.com.
