The Financial Conduct Authority (FCA) has long positioned itself as a pro-innovation regulator, but a recent intervention from one of its most senior officials suggests that the line between encouraging technology and protecting consumers may need to be redrawn. Sheldon Mills, an executive director at the FCA, has argued that the United Kingdom should consider regulating large language models — such as OpenAI’s ChatGPT, Anthropic’s Claude, and Google’s Gemini — directly, rather than simply overseeing the firms that use them. His comments, made in a public address, represent a notable shift in tone from a regulator that has typically stuck to a principles-based, light-touch approach.
Mills’s core concern is both specific and systemic. He pointed to data showing that more than a quarter of UK consumers already trust general-purpose AI tools for financial advice, often without understanding that these systems operate outside the FCA’s regulatory perimeter. When a regulated financial adviser provides poor guidance, consumers have recourse through ombudsman schemes and compensation protections. When a chatbot does the same, the lines of accountability are far less clear, and consumers may have no effective remedy at all. This gap, Mills argued, is unsustainable as AI becomes more embedded in everyday financial decisions.
The Regulatory Perimeter and Its Limits
Under current UK law, the FCA regulates specific financial activities and the firms that carry them out. The technology used to deliver those services — including software — is generally assessed through the lens of the firm’s obligations. A bank using an AI model to approve loans, for example, remains responsible for that model’s outcomes. However, a general-purpose chatbot that is not itself a financial service provider, and whose maker is not regulated by the FCA, operates outside this framework. Mills has now suggested that this distinction may no longer be fit for purpose, as consumers increasingly turn to these models directly for financial guidance as if they were trusted advisors.
The problem is compounded by the fact that the largest and most widely used language models are developed by a handful of American technology companies — OpenAI, Anthropic, Google — that the FCA does not regulate. Even if the FCA wanted to exert control over these models, its jurisdictional reach is limited. This raises a fundamental question about how to govern technology that knows no borders and whose influence on financial decisions is growing rapidly. Mills’s proposed remedy is procedural but pointed: he recommended that the FCA decide, within the next three to six months, whether to “secure and adapt” the regulatory perimeter by reviewing the scale, nature, and impact of the general-purpose models that currently fall outside it. That stops short of demanding immediate rules, but it puts a clock on the question of whether foundation models belong inside financial regulation at all.
Proposed Powers and the Challenge of Explainability
Mills went further by outlining what oversight might eventually look like. He floated new powers that would allow the FCA to require firms to explain how their AI models reach decisions, to audit algorithms for fairness, and to impose fines on systems that cause consumer harm. Each of these touches on the hardest problem in AI governance: the opacity of the models. Many large language models are so complex that even their developers struggle to fully explain specific outputs. The term “black box” is frequently used to describe this phenomenon. If the FCA were to demand explainability, it would be asking companies to do something that is currently technically difficult and, in some cases, impossible.
The fairness audit also presents challenges. Biases in training data can lead to discriminatory outcomes, but proving that a model is systematically unfair — and distinguishing that from legitimate factors — is a non-trivial exercise. Mills acknowledged these difficulties but argued that they should not be a reason to avoid action altogether. The question is not whether regulation would be easy, he suggested, but whether the risks of inaction outweigh the costs of intervention. Given that consumers are already acting on AI-generated advice, the status quo carries its own dangers.
Government Posture and Sector-by-Sector Regulation
Mills’s intervention sits awkwardly alongside the UK government’s broader posture on AI regulation. The government has explicitly avoided introducing a bespoke AI law, preferring instead to hand oversight to existing sectoral regulators like the FCA, the Competition and Markets Authority, and the Information Commissioner’s Office. The hope is that this agile, pro-innovation approach will give the UK a competitive edge over the European Union, which is moving toward a comprehensive AI Act. Mills is not calling for a UK AI Act, but he is suggesting that the sector-by-sector model has a hole in it where general-purpose systems are concerned, and that the FCA may need to fill that gap itself.
The tension is clear: the government wants to encourage AI development and deployment, but it also expects regulators to protect consumers from harm. When a technology is as fast-moving and cross-cutting as large language models, the lines between sectors blur. A chatbot might give legal advice, medical information, or financial guidance in the same conversation — yet each of those uses is governed by a different regulator with a different mandate. Mills’s comments are a signal that the FCA is beginning to think beyond its traditional boundaries, and that it recognizes the need for a coordinated response, possibly involving new primary legislation or at least expanded secondary powers.
Systemic Risk and Concentration
The point that Mills raised about concentration is arguably the more serious of the two arguments. If most regulated financial firms come to depend on the same two or three general-purpose model providers — as many already do through cloud-based APIs — then a failure or a flaw in one of those systems could ripple across the entire financial sector at once. This is the kind of correlated risk that regulators usually try to design out. A widespread outage, a sudden change in model behavior after an update, or an inadvertent data leak could affect thousands of regulated institutions simultaneously. The financial system already runs on a small number of cloud providers; that dependency is now migrating to the AI models built on top of those clouds.
Mills’s warning echoes lessons learned from the financial crisis of 2008, when overdependence on a few systemically important institutions caused cascading failures. In the AI context, the risk is not just operational but also reputational and legal. If a model gives bad advice that harms consumers, the companies that integrated it may be held liable, even if they did not fully understand the model’s limitations. The FCA’s own principles require firms to treat customers fairly and to manage outsourced services prudently. Mills is effectively saying that those principles may need to be updated to explicitly address the unique nature of AI models, and that regulators may need to look beyond the firms they regulate to the technology providers themselves.
For now, Mills’s comments are a signal rather than a policy. But they land at a moment when governments everywhere are conceding that AI is outpacing the rules meant to govern it. The UK’s light-touch approach has attracted praise from tech companies, but it has also drawn criticism from consumer groups who argue that it leaves people exposed. Mills’s intervention suggests that even within the regulator, the balance is being reconsidered. The next few months will show whether the FCA treats this as a genuine review or merely a talking point. The outcome will have implications not just for financial services, but for how the UK approaches the regulation of general-purpose AI across all sectors.
As the technology continues to evolve, the question Mills has placed on the table is a fundamental one: should the rules be adapted to cover the models, or should they remain focused on the firms? His answer is cautiously leaning toward the former, and the debate he has started is likely to intensify as reliance on these tools grows.
Source:TNW | Government-Policy News