Who checks the AI when the regulator admits it can’t keep up?

The Financial Conduct Authority’s Sheldon Mills has called it an “arms race” to stay abreast of AI in financial services. Read that plainly. A regulator saying it cannot keep pace is a regulator telling you that documented controls no longer bind what actually happens at the point of decision.

And here is the part most firms have not absorbed. The FCA has been clear it will not write an AI rulebook. It will lean on the frameworks you already have. Consumer Duty. SM&CR. Operational resilience. Which means the whole model now rests on one question a supervisor can ask on any given Tuesday: show us your AI governance working in practice.

Not the policy. Not the committee minutes. The behaviour.

Most firms can produce a control library. Far fewer can show that a single one of those controls changed an outcome, stopped a bad decision shipping, or would survive contact with an examiner asking “and then what happened.” That distance, between a control that is written down and a control that demonstrably changes what people and systems do, is where the real exposure sits.

The Treasury Committee has already accused the regulators of wait-and-see. The regulators have pushed the same test back onto firms. No rulebook to hide behind means no checklist to hide behind either.

Capability has a leaderboard. Whether a competent check can stop the wrong thing from shipping does not. Mills is asking firms to evidence the second thing. Adoption has raced ahead of anyone’s ability to prove it.

So the question is not whether your AI is powerful. It is whether anyone competent checks the output, and whether that check can actually stop the thing from shipping.

If you cannot answer that with evidence, you do not have governance. You have documentation.

Full FT piece in the comments. I’ve also dropped a one-page practitioner’s guide for finserv teams on what a “show us in practice” supervisor actually looks at.