UK FCA Calls for Reporting of Significant AI Failures and Near Misses

The UK Financial Conduct Authority says financial firms’ existing major-incident reporting obligations must extend to significant AI failures and near misses. FCA chief data, information and intelligence officer Jessica Rusu warned that increasingly autonomous, poorly governed AI can amplify consumer harm, cyber vulnerabilities and operational disruption. She called for continuous assurance of agentic systems and clear controls over agent identity, delegated authority, accountability and execution. Reporting thresholds remained unclear, leaving firms uncertain about which AI incidents and close calls would qualify.

Security experts highlighted dependence on a single AI supplier and provider-driven model changes that can alter production behavior after testing. They also warned that weak enforcement or poorly designed reporting requirements could undermine effectiveness or penalize firms with stronger monitoring. For financial-sector security leaders, the priorities are to incorporate AI failures into incident-response processes, assign accountable owners and continuously assess supplier and model-change risks. The UK government plans to assess stronger protections against AI-driven cyber threats and loss-of-control risks, but has not committed to AI-specific provisions in its Cyber Security and Resilience Bill; parliamentary scrutiny has also called for AI-related financial stress tests and clear responsibility for harmful or unfair outcomes.