On 6 July 2026, the FCA published the Mills Review, its long-term assessment of how AI will reshape retail financial services. It made seven priority recommendations to the FCA Board: secure and adapt the regulatory perimeter, strengthen system-wide coordination, monitor the transition to autonomous models, scale the AI Lab, build the foundations for agentic finance, adopt an AI-enabled agentic supervisory model, and develop a public-interest financial capability service. The Board was asked to consider which to take forward.

Seven weeks later, that consideration has produced no public timeline, no confirmed adoption of any single recommendation, and very little coverage asking what happened to the document at all. The initial wave of law firm briefings and consultancy analysis that greeted the Review in July has moved on. The Review itself has not been implemented, rejected, or scheduled. It sits in the state every strategic review sits in before someone decides what to do with it, except this one concerns exactly the accountability question this newsletter has spent two months examining.

It is worth being precise about what the Mills Review did and did not propose, because both matter for what a senior manager should do now. The Review does not recommend new AI-specific rules. It concludes that the existing framework, the Consumer Duty, the Senior Managers and Certification Regime, operational resilience requirements, remains a sound foundation. It also states plainly that this foundation will come under increasing pressure as AI moves from an assistive role toward greater autonomy, and that approval at launch followed by periodic review will no longer be sufficient. Governance, the Review says, will need to operate closer to real time.

That is not a future state contingent on the Board adopting recommendation six, the agentic supervisory model. It is a statement about the framework that already governs senior managers today. The Review's most quoted recommendation describes where FCA supervision is heading. Its least quoted sentence describes what SM&CR already requires.

Here the picture gets more specific, and more useful. While recommendation six, the AI-enabled agentic supervisory model, awaits a Board decision on formal adoption, the FCA has separately been reported as running active, direct supervisory engagement with 750 firms on exactly the questions that model would formalise: how firms test their AI systems, how they monitor outcomes, and who is accountable when something goes wrong. That is not agentic supervision in the technical sense the Review describes. But it is a regulator behaving, in practice, ahead of a recommendation it has not yet formally adopted, testing the same accountability question the Review flagged as the one existing governance will struggle to answer at speed.

A senior manager waiting for the FCA Board to formally adopt recommendation six before building an evidence practice is waiting for a decision the regulator has already started acting on informally. The formal timeline and the practical exposure are no longer the same thing, if they ever were.

The absence of a Board announcement is not evidence that nothing is happening. It has been eleven months since the Treasury Committee first asked for senior manager guidance under SM&CR, and seven weeks since the Review that inherited part of that question was published. In that time, the regulator's own supervisory practice has moved, even where its formal policy machinery has not yet caught up to itself.

The senior manager building a dated, anchored record of their AI oversight decisions now is not preparing for a recommendation that might eventually be adopted. They are building evidence against a standard the Review has already described as necessary, and that supervisory practice appears to already be testing, whether or not the Board has formally said so.

The report published in July did not need implementing to start mattering. It described what already applies. The senior managers positioned well when the Board does eventually announce something will be the ones who read that sentence correctly the first time.

Regulatory references: FCA, Mills Review (published 6 July 2026), seven priority recommendations to the FCA Board; SM&CR (SYSC, FCA Handbook); Companies Act 2006 section 174; House of Commons Treasury Committee, AI in Financial Services, HC 684 (20 January 2026).

The Roche-Review is the weekly publication of Dr Ivan Roche FRSS FRSA MInstP, Founder of Otopoetic Limited. Subscribe at roche-review.com.