Why the Mills Review demands the attention of financial services firms

The FCA published the Mills Review on 6 July, setting out how artificial intelligence (AI) could reshape retail financial services through to 2030 and beyond. A fortnight later, the government appointed Kanishka Narayan as Minister for Artificial Intelligence, with a role attending Cabinet.

The two developments were separate, but their timing is telling. AI has moved towards the centre of government policy, while the FCA is examining whether financial regulation can keep pace as technology takes on a greater role in decisions and customer journeys. While the Review carries no legislative force, it indicates where regulatory attention is heading, as Joe Norburn, CEO at TCC Group (TCC, Momenta and Recordsure), explains.

Why the Mills Review matters now

Although the Review looks towards 2030, it is grounded in changes already under way. It draws on 140 submissions and research involving more than 5,000 UK adults, covering the possible effects on firms, customers, competition and the regulator. Customers already use general-purpose AI tools to explore financial choices, while firms use AI across service, fraud prevention, data analysis and day-to-day operations.

The important change is the movement from assistance towards delegation. AI systems can recommend actions, prepare decisions and, within set limits, initiate activity. A consumer could progress from using AI to compare savings accounts to allowing it to move money automatically. A firm might move from using AI to identify signs of vulnerability to helping staff determine the most appropriate support pathway.

As that responsibility grows, accountability, consent and redress become harder. One of the recommendations is that the FCA should examine, within three to six months, how consumers use general-purpose AI tools for savings, investments, pensions, mortgages and debt management. The findings could lead to amended guidance or recommendations to the government about the regulatory perimeter. That makes the Review important groundwork for future policy.

Accountability still sits with the firm

AI sits squarely within the obligations firms already have. The Review points back to the Consumer Duty, the Senior Managers Regime (SMR) and operational resilience. When an AI system shapes a process or customer outcome, the firm remains accountable, even if the service comes from an outside supplier.

Proving that accountability may be difficult. A customer journey can involve several models, datasets and providers, each influencing the result. If something goes wrong, the firm must establish what happened and whether its controls were working. Models supplied by third parties, or those whose behaviour changes as data and market conditions evolve, make that task more demanding.

The consumer position adds another concern. One in five UK adults told the Review they would consider using AI that acts autonomously within preset goals. Only 40 per cent correctly recognised that they have no formal recourse when acting on advice from a general-purpose AI service. Customers may assume financial protections apply even when the tool influencing them sits outside the FCA’s perimeter.

For human oversight to be meaningful, the person involved needs sufficient information to assess outcomes, challenge decisions and intervene where necessary. Firms must decide what the reviewer sees, which warning signs require attention and when an automated process should be stopped.

Governance needs evidence behind it

Firms should understand where AI is being used across the organisation, including less visible, informal or team-level adoption of general-purpose AI tools. Boards need to understand which systems support routine work, which influence decisions and which can initiate actions.

When several teams and suppliers are involved, ownership can easily become blurred. Compliance may set the controls, technology may manage the model, and operations may handle the customer. But responsibility for the outcome still needs to be clearly assigned. Firms should also decide who monitors performance and who can pause or alter the process, as well as create arrangements that give them enough information to investigate concerns properly.

Of course, monitoring will have to evolve too. A model that performs well at launch may behave differently as customer behaviour, data or economic conditions change. As AI becomes more embedded, firms will need confidence that its use supports good customer outcomes and helps avoid foreseeable harm, particularly where it influences customer understanding, decision-making or access to support. Firms also need continuing evidence that models remain accurate, fair and aligned with their purpose, supported by decision records, outcome testing and clear escalation routes.

Where AI influences large volumes of interactions, firms may need monitoring approaches that complement periodic reviews and sample testing. Monitoring should reflect the scale and speed of the activity, giving boards and the C-Suite information they can use before isolated problems become wider customer harm.

A reason to act now

The Review’s influence is likely to emerge through FCA guidance, supervisory expectations, changes to the regulatory perimeter and the application of existing rules. The appointment of an AI minister who attends Cabinet reinforces that direction, with the government treating AI as an economic and public policy priority.

Solid evidence gives a business more freedom to use AI sensibly. Weak oversight stores up a more expensive problem, with controls having to be rebuilt later under greater regulatory pressure. Boards now need a practical account of where AI affects decisions, who carries responsibility and how the firm knows customers are being treated fairly.