On 15 May 2026, the FCA, Bank of England, and HM Treasury published a joint statement on frontier AI models and cyber resilience.[1] It is not a consultation paper. It is not a call for input. It is a statement of concern from the three bodies that govern your firm’s operating environment, and it says something that should land clearly: the regulators now consider frontier AI models to be creating cyber vulnerabilities faster than existing defences can address them.

That is worth sitting with for a moment before we get to the practical implications.

What does the joint statement actually say?

The statement’s central claim is that frontier AI models, meaning the large, capable systems from providers like OpenAI, Anthropic, and Google, have outpaced the cyber resilience capabilities currently in place across the financial sector.[1] The regulators describe this as a material risk, not a theoretical one.

The statement is framed around three concerns. First, that AI is expanding the attack surface for cyber threats, both by giving adversaries better tools and by introducing new vulnerabilities in the systems firms are building on top of AI providers. Second, that firms may not have mapped their exposure to AI-related operational risk with the same rigour they apply to other third-party dependencies. Third, that governance around AI use is inconsistent across the sector, and the regulators want to see that change.

The FCA, Bank of England, and HM Treasury have stated plainly that frontier AI models now exceed current cyber resilience capabilities across financial services. That is the starting point for every subsequent question your firm needs to answer.

This is not the FCA saying AI is bad or that firms should stop using it. It is the FCA saying that if you are using it, or your suppliers are using it on your behalf, you need to understand and govern that use with the same seriousness you bring to any other material operational risk.

What does this mean for a small or mid-sized advice firm?

The statement applies to the full range of FCA-regulated firms, not just large banks and asset managers. If you run an IFA practice, a financial planning business, or a wealth management firm, this concerns you directly, even if no one on your team has deliberately adopted an AI tool.

The reason is third-party exposure. Your back-office system, your CRM, your document management platform, your compliance monitoring tool: each of these is likely already using AI features, whether or not you selected them. The providers making your data available to their AI-powered features may constitute a material third-party dependency under the FCA’s existing operational resilience rules. The joint statement strengthens the expectation that you have mapped and assessed those dependencies.[1]

This is not new territory for the FCA. Operational resilience has been a standing expectation since the PS21/3 policy statement came into force. What the joint statement does is explicitly place AI-related risk inside that existing framework, so the question shifts from “do we have an AI policy?” to “is our existing operational resilience mapping current and honest about AI?”

What are the practical steps a firm should take now?

The honest answer is that most of the response to this statement is work firms can start themselves, without outside help. Here is the practical shape of it.

First, map your AI exposure. This does not need to be a formal project. It needs to be honest. Go through your current suppliers and ask, for each one, whether they use AI to process, analyse, or generate content involving your client data. Check the terms of service and data processing agreements you signed, which may have been updated since you last read them. The goal is a simple list: which systems touch client data, which of those use AI features, and do your agreements with those suppliers cover how that data is handled in an AI context.

Second, check your data processing agreements. The statement’s emphasis on cyber resilience means data handling is now a more visible regulatory variable.[1] If a supplier’s AI features are processing client data, you need a data processing agreement that reflects that, and you need to know where the data goes, whether it is used to train models, and how long it is retained. Clients and counterparties are increasingly asking these questions directly; regulators will not be far behind.

Third, document what you find and what you decided. Under Consumer Duty and SMCR, the expectation is that senior managers can demonstrate they have considered material risks and taken reasonable steps to address them. A short, dated record of the mapping exercise and the decisions that followed is more useful than a lengthy policy document that no one updates. Regulators are not looking for perfection. They are looking for evidence that you took the question seriously.

Fourth, review your incident response plan. If a supplier’s AI system were compromised or produced a material error affecting client outcomes, does your firm have a clear process for identifying it, containing it, and reporting it? The operational resilience framework already requires this, but the specific scenario of an AI-related failure may not be explicitly included. Add it.

Is this a signal of what is coming next?

The statement says the three bodies are working together on these questions and will continue to engage the sector.[1] That is not a specific commitment to legislation or a binding rule change on any particular timetable. Reading it as a countdown to a named deadline would be going further than the document supports.

What is fair to say is that this is not a one-off communication. The pattern across the FCA’s AI-related output over the past two years has been consistent: voluntary frameworks first, then guidance, then rules. Firms that treat voluntary and guidance-level signals seriously tend to find the transition to binding requirements straightforward. Firms that wait for the rule tend to find the implementation window uncomfortably short.

The more immediate and certain point is that the joint statement makes AI governance a visible senior management responsibility right now, under frameworks that are already binding. Consumer Duty, SMCR, and operational resilience rules do not wait for new AI-specific legislation to apply. The statement is, in large part, a reminder of that.

What you should not do

Two things are worth flagging explicitly.

Don’t confuse activity with governance. Writing an AI policy document and filing it is not the same as understanding your exposure. The mapping exercise described above is more valuable than any policy template, because it tells you what you are actually dealing with.

Don’t assume that because your firm is small, the statement is aimed elsewhere. The FCA has been explicit in recent years that Consumer Duty and operational resilience expectations apply to firms of all sizes. A 10-adviser firm with a single back-office system and a document management tool that uses AI features is still a regulated firm with obligations to understand and manage the risks in its operating environment.

The joint statement is available in full on the FCA’s website, and reading it directly is a better use of fifteen minutes than relying on a summary, including this one.[1]

If you want to think through what your firm’s specific exposure looks like and what a proportionate response would involve, a conversation with Cordrey Consulting is one place to start. Cordrey Consulting provides strategic and operational guidance for advice firms on AI adoption and workflow, not regulated financial or compliance advice, but if you’re trying to work out where to direct your attention, that’s the kind of question these conversations are for.

Sources

[1] FCA, Bank of England, and HM Treasury — Joint statement on frontier AI models and cyber resilience (15 May 2026) — https://www.fca.org.uk/news/statements/fca-boe-treasury-joint-statement-frontier-ai-models-cyber-resilience