AI is becoming central to financial services operations, with growing autonomy and limited transparency over how the models work. In this insight, Grant Thornton's Supriya Manchanda and Tim Reid examine what the Mills Review means for AI governance and board oversight.
For most boards, the difficult part isn't deciding whether to embrace AI — that decision has largely been made for them by the pace of the market. The harder question is how to keep oversight credible as systems become more autonomous, more embedded in core decision-making, and harder to interrogate.
The FCA's Mills Review is a useful marker in that conversation: it doesn't propose a new rulebook, but it does set out clearly how the regulator expects existing accountability structures to flex around AI. That puts the onus back on boards to understand where they stand today, and where the gaps are likely to open up.
This deep-dive article from Grant Thornton covers:
- Why new AI regulation isn't needed: Exploring why the FCA is relying on existing frameworks — SM&CR, Consumer Duty, SYSC — rather than AI-specific rules, and what that means for where accountability sits.
- How the market's changing: The four shifts the Mills Review expects by 2030, including: more autonomous operations, agent-led consumer journeys, evolving competitive dynamics, and faster-moving financial crime and cyber threats.
- The autonomy spectrum and key implications for AI governance: The Review's five-stage model of human involvement in AI decisions, from operator to observer, and why rising autonomy makes it harder for boards to secure the evidence they need to challenge management effectively.
- How to manage the risks: The key exposures boards should be alert to — outcome evidencing, third-party model reliance, systemic and financial crime risk, and demonstrating reasonable steps under SM&CR.
- How to maximise the opportunity: Why strong AI governance isn't just defensive — it can support Consumer Duty outcomes and become a source of competitive advantage for firms that treat it as more than a compliance exercise.
- Practical steps for the Board: Five concrete actions boards can take now, from demanding better management information to embedding AI oversight across the three lines of defence.
Learn More:
Read the full article here.