TL;DR

UK financial services regulators — the Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA) and Bank of England — are holding to a technology-neutral, principles-based approach to AI in 2026 rather than introducing AI-specific rules. But supervisory expectations are tightening, and a January 2026 Treasury Committee report warned that a “wait-and-see” posture “risks serious harm to consumers and the wider financial system”.

The regulatory picture

The FCA launched its “Mills Review” in January 2026 to assess how AI is reshaping retail financial services. The regulator is running three parallel support mechanisms: a Supercharged Sandbox offering computational resources for AI testing, AI Live Testing for controlled real-world trials, and an AI Sprint convening industry and regulators on specific questions. These are all voluntary, but take-up is a useful signal of which firms the FCA wants to see moving.

The Treasury Committee’s January report called for AI-specific stress testing, practical Consumer Duty guidance and the designation of major AI providers as critical third parties — which would bring hyperscalers and frontier labs inside the Bank of England’s operational resilience regime. A March 2026 FCA perimeter report flagged growth in unregulated AI financial-guidance tools, particularly chatbots giving advice without oversight, signalling where the enforcement line may eventually be drawn.

Why principles-based is getting harder to defend

The consistent UK line since 2023 has been that existing principles — Consumer Duty, Senior Managers and Certification Regime (SMCR), operational resilience rules — are flexible enough to cover AI. That has structural merit: it avoids the Brussels-style risk of regulation lagging technology. But the Treasury Committee’s intervention shows the political patience for that stance has limits, especially as retail AI advice tools proliferate outside the perimeter. The EU AI Act is now being enforced across the Channel and firms operating on both sides are already building to the stricter regime.

Looking forward

For UK financial firms, the practical takeaway is that nothing in the rulebook has changed — but supervisors will expect stronger AI governance, clearer SMCR accountability for AI-influenced decisions and evidence of meaningful human oversight. Firms that wait for explicit rules before acting will find themselves behind both their peers and their supervisors.