The FCA is building AI agents to supervise firms. What that means for you.

The FCA will supervise firms with AI agents and read their data directly. Here is what the 19 October speech means for the people running regulated UK organisations, and what to do this month.

On 19 October 2026 the FCA set out how it intends to regulate in the age of AI. Here is what the speech actually said, who it lands on, and what to do about it in the next month.

Who this is for

CEO, CFO, Board Chair and NEDs, Head of Risk, Head of Compliance, CIO and CTO of a regulated UK organisation.

Part of what we do at The Human CTO now is translate news like this into what it means for people in the real world. We say who we think a piece is for because it helps you decide whether to give it five minutes. It does not mean it is not for everyone. If you see your title, give it some attention. If you do not, it is still worth the read.

What happened

Jessica Rusu, the FCA’s Chief Data, Information and Intelligence Officer, spoke at the Bloomberg UK Policy Series on Monday 19 October. The speech was the FCA’s answer to the Mills Review, published in July, and she was blunt about the approach: “Our response to the review is not to consult, study and report progress.”

Instead the FCA is becoming what she called an “agentic regulator”. A “market first responder” agent will supervise around 9,000 small wholesale markets transaction reporting firms, so human supervisors can concentrate on more complex work. From 2028 the FCA takes on oversight of some 60,000 anti-money laundering firms, and it is building machine-readable data collection APIs as the way to do that.

She also previewed a joint FCA and Bank of England survey, due the following week, which found 86% of firms now use AI. In her words: “Adoption is not coming. It is here.”

The expectations on firms were spelt out too. Senior managers personally accountable for AI systems. Incident reporting that already covers major incidents “must extend to significant AI failures and near-misses”. And firms should “understand supplier concentrations and dependencies, including reliance on a single model”. Alongside the speech, the FCA published a set of good and poor practice examples for AI in financial services.

What it actually means

The regulator is going to read your data directly, with software, at a scale no team of supervisors could manage. That changes the cost of untidy data. A submission that is late, inconsistent or hand-assembled used to sit in a queue. Soon it will be the thing that flags you.

Accountability is personal. “The AI team” is not an owner. Each AI system that touches customers, money or regulated decisions needs a named senior manager who can explain why it exists, what it is allowed to do and when a human steps in.

Near-misses now count. Most firms have an incident process for things that went wrong. Very few have one for “the model did something odd and we caught it before it mattered”. The FCA wants that logged and reported.

Concentration is a board question. If one model or one vendor sits under three or four processes, a change to that model is a change to all of them. Someone should know, in advance, what happens when it changes or disappears.

What to do this month

Pick the AI systems that matter and name a senior owner for each, in writing. Add near-misses to your incident process, with a plain definition staff can use. List which model and which vendor sits under each process, and ask what the fallback is. Then look at the data you send the FCA and ask whether it would survive being read by a machine with no patience.

None of this needs a programme. It needs a short list, named owners and an honest look at where the dependencies are.

Sources

FCA, Building the future of finance in the age of AI, speech by Jessica Rusu, 19 October 2026.

FCA, AI in financial services: good practice and areas for improvement, 19 October 2026.