On July 6, 2026, the Financial Conduct Authority published the Mills Review and closed a door many firms had hoped was open. Accountability in retail financial services, the Review finds, "does not shift as AI takes on more of the work." A senior manager "remains answerable for outcomes" even when the behavior and updates of the model sit partly outside the firm's control. The executive who signs the deployment owns a system that someone else keeps changing.
Governing Evidence
Sheldon Mills led the FCA's review of how AI could reshape retail financial services by 2030. The engagement paper opened in January 2026 and closed on February 24, 2026, and the final report followed on July 6, 2026. As summarized by the law firm Bratby, no respondent argued that the accountability model should change, and the Review recommends no AI-specific regulation. Freshfields, in its July 16, 2026 briefing, records the Review's central observation: "AI becomes more significant for financial services when it moves from supporting action to taking action." It also records the evidentiary test: "a useful answer is not enough if the basis for it cannot be reconstructed." Stakeholders asked the FCA for guidance on the "reasonable steps" expected of senior managers and told the Review that evidencing "meaningful human control" is hard. The Review recommends that the FCA launch a perimeter review of general-purpose large language models within three to six months of publication, which places it between October 2026 and January 2027 (a date range inferred from the report's timing, not stated by the FCA). The Treasury Select Committee has separately asked for practical FCA guidance on accountability by the end of 2026.
The Rulebook Did Not Change. The Exposure Did.
The FCA left the Senior Managers Regime exactly where it was. That sounds like stability. It is a transfer of risk.
When a human adviser made a recommendation, the senior manager's oversight attached to people the firm trained, supervised, and could remove. When an agent acts, the oversight attaches to a model whose training data, update schedule, and drift belong to a supplier. The accountability stayed. The control did not follow it.
A board that hears "no new rules" and concludes "no new work" has misread the document. The Review says the opposite. The obligation is unchanged and the thing it now covers is harder to see.
Point-in-Time Sign-Off Is the Wrong Instrument
Most firms approve an AI deployment once, at launch, with a validation pack. The Review observes that this approach does not catch model drift, data bias, or hallucination after go-live, and it calls for more dynamic monitoring and assurance across the AI lifecycle.
Read that as a statement about evidence. A regulator reviewing an outcome in 2027 will not ask whether the model passed a test in 2026. It will ask whether the firm can reconstruct why the system did what it did on the day it did it, and who was watching the system between the sign-off and the incident. A launch memo answers the first question about a different version of the model. It does not answer the second at all.
The Governance Boundary Principle Applies to the Supplier Contract
Touch Stone's Governance Boundary Principle holds that a board owns the standard and management executes against it. A firm that monitors its suppliers only because a supervisor will check has not yet owned the standard.
The Review makes this concrete. It extends model risk management to deeper reliance on third-party model providers, where the accountability trail is hardest to trace, and it points to concentration in a few model, cloud, and infrastructure providers as a system risk. Procurement will negotiate the contract. Only the senior manager can decide what change notice, what logging access, and what right to pause a model the firm must hold before it will answer for the outcome. That decision is a statement of how much unobserved change the executive is willing to defend, and it cannot be handed to the vendor whose product is changing.
What a Senior Manager Does Before the Guidance Arrives
Three actions are available now, and each fits inside a quarter.
Write down, for every AI system that influences a customer outcome, who holds the Senior Manager responsibility, which supplier controls the model, and how the firm learns when that model changes. If the third column is blank, the accountability has no instrument behind it.
Replace the launch-time sign-off with a standing review. Set the drift and error measures the firm will watch, name who reads them, and record each time the senior manager looked and what was decided. "Reasonable steps" will be judged against that record, and a record that begins after an incident carries little weight.
Decide, in a recorded session, which decisions an agent may take on its own and which require a person who can later explain the basis. The FCA has said the answer must be reconstructable. A firm that writes the answer before the guidance lands will read the guidance as confirmation. A firm that waits will read it as a list of its own gaps.
The senior manager who builds this now leaves a successor a system whose changes were watched by someone with the authority to stop them. That is a different inheritance from one assembled after the first customer harm, with the supplier's release notes as the only evidence.