TL;DR:

• The Bank of England has confirmed to MPs that it is running scenario analysis and simulations of how AI agents could behave in financial markets, with a focus on “herding” behaviour amplifying volatility.
• Treasury Committee chair Dame Meg Hillier said she remains “perplexed at the apparent inertia” in the Critical Third Parties regime, whose powers for cloud and technology oversight are “sitting unused”.
• The FCA’s AI Live Testing, led by Ed Towers, pulls governance, controls and operational context into a single validation exercise — effectively making AI testing a regulatory artefact rather than an internal practice.

The shift matters because it reframes AI compliance from a document-based exercise into ongoing, evidenced validation — the same trajectory cyber resilience took over the past decade.

Herding, not just hallucinations

The Bank’s herding-behaviour work focuses on the risk that multiple AI trading systems act in correlated ways under the same stress signal, amplifying volatility rather than dampening it. The framing is closer to systemic-risk stress tests than model risk management. Bank governor Andrew Bailey has separately warned that Anthropic’s Mythos release may have “found a way to crack the whole cyber risk world open” — linking capability risk, cyber resilience and AI validation into a single supervisory frame.

That alignment matters for UK banks running multi-vendor AI stacks. If supervisors expect evidence that correlated failures across models, cloud providers and third-party tooling have been tested, the scope of assurance widens beyond what internal model-risk functions typically cover.

Critical Third Parties and unused powers

Hillier’s criticism of the Critical Third Parties regime is the sharpest public signal yet that Parliament is prepared to push regulators harder. The framework was designed to bring major cloud and AI providers — realistically AWS, Microsoft, Google and a handful of foundation-model labs — under supervisory oversight. The Committee’s position is that the powers exist and are not being used.

For banks and insurers, this translates into a harder compliance requirement: you cannot assume a cloud or AI vendor is unsupervised territory, even if the regulator has not yet reached them. Third-party resilience, API robustness and AI-driven dependency testing all now sit inside internal audit scope, not on the outside.

Looking forward

STAR-FS and the Bank’s cyber recovery guidance already require firms to prove resilience continuously. Applying the same evidentiary bar to AI systems — outputs, governance, explainability and drift — will force a material upgrade in internal QA and audit capability. UK banks that have so far staffed AI governance as a policy committee rather than a testing function will be the ones forced to catch up fastest in the next two quarters.