In the same month the Article 50 transparency obligations became live, the FCA published the Mills Review, its long-term examination of how AI could reshape retail financial services. Most coverage has treated it as a document about how firms will use AI. The more consequential half is about how the regulator will.

The Review sets out a move toward AI-enabled, agentic supervision: a supervisory model in which the FCA analyses firm and market data quickly, systematically and at scale, and in which governance, accountability and risk management face that scrutiny directly. It states plainly that as AI systems take on more decision-making, approval at launch followed by periodic reviews will no longer be sufficient, and that governance will need to operate closer to real time.

Read as a board member rather than a technologist, those are not statements about technology. They are statements about the speed at which evidence will be tested.

What reconstruction has always depended on

Compliance by reconstruction has a quiet dependency that is rarely stated because it has never needed to be. It depends on supervision moving at human speed. A written request arrives. A deadline sits some weeks out. In the interval, documents are located, gaps are identified, narratives are assembled, and what is produced is coherent because time existed to make it coherent. None of that is necessarily dishonest. It is simply how organisations that did not evidence decisions contemporaneously respond when asked to demonstrate that they made them.

Every step of that process assumes the interval. A supervisor that queries firm records systematically and at scale does not offer one. The question stops being what can the firm assemble by the deadline and becomes what exists in the record as of now. Those are different questions, and only one of them can be prepared for after it is asked.

The SM&CR dispute that makes this personal

The parliamentary record this summer contains a disagreement worth every board’s attention. The FCA’s executive director for payments and digital finance told the Treasury Committee that the Senior Managers and Certification Regime keeps individuals on the hook for harm caused to consumers through AI. Innovate Finance, giving evidence for the industry, argued that senior managers in reality struggle to assess this risk, because the lack of explainability of AI models conflicts directly with what the regime requires of them.

Both positions are right about different things, and the gap between them is where a named senior manager currently stands. The regulator is correct that the accountability attaches to a person. The industry is correct that no senior manager can fully explain a frontier model’s internals. What resolves the tension is neither deeper technical understanding nor regulatory retreat. It is the distinction this newsletter has argued from the start: the duty is discharged by evidencing the decisions actually taken, what was reviewed, what was asked, what was accepted and on what conditions, dated at the moment they happened. A senior manager cannot be expected to explain the model. They can be expected to hold a contemporaneous record of their own oversight of it. The first is impossible. The second is merely unusual.

A regime with nobody named under it

One further detail from the Treasury Committee’s report deserves more attention than it has had. The Critical Third Parties regime, created to give the FCA and the Bank of England powers over the cloud and AI providers the sector depends on, has been established for more than a year. No organisation has yet been designated under it.

A named-accountability mechanism with nobody named under it is not a safety net. It is a charter without a record, at the level of the regulatory architecture itself. Firms mapping their dependencies on model providers, as the FCA has told them to, are mapping onto a regime that does not yet hold anyone. Whatever assurance a board has taken from the regime’s existence should be re-examined against that fact.

What this means before the supervision arrives

The Mills Review is a direction of travel, not a switch that has been flipped. Agentic supervision will arrive incrementally, and no firm will receive a machine-speed query tomorrow. That is precisely why this is the moment the gap is cheapest to close. A firm that begins evidencing decisions contemporaneously now builds the record the future supervisor will query. A firm that waits until the supervisory model changes will discover that the one thing a real-time record cannot be is retroactive.

The FCA has said what supervision is becoming. The only open question is whether a firm’s evidence practices are built for the supervisor it used to have.

Regulatory references: FCA Mills Review (July 2026); SM&CR (SYSC, FCA Handbook); House of Commons Treasury Committee, AI in financial services (2026); DORA Article 5; EU AI Act Article 50 for continuity of the evidentiary argument.

The Roche-Review is the weekly publication¹ of Dr Ivan Roche FRSSy FRSA MInstP, Founder of Otopoetic Limited. Subscribe at roche-review.com.