On 15 May 2026 the FCA, the Bank of England and HM Treasury published a joint statement on frontier AI models and cyber resilience.[1] It isn’t a consultation or a call for input. It’s a statement of concern from the three bodies that shape your firm’s operating environment, and its message is plain: the regulators think frontier AI is creating cyber vulnerabilities faster than existing defences can deal with them.
What the joint statement says
The statement’s central claim is that frontier AI models, meaning the large, capable systems from providers like OpenAI, Anthropic and Google, have outpaced the cyber resilience currently in place across the financial sector.[1] The regulators describe this as a material risk, not a theoretical one.
It sets out three concerns. AI is widening the attack surface, both by giving attackers better tools and by adding new weak points to systems that firms build on top of AI providers. Firms may not have mapped their exposure to AI-related operational risk as carefully as their other third-party dependencies. Governance of AI use is inconsistent across the sector, which the regulators want to see change.
None of this is the FCA saying AI is bad or that firms should stop using it. It’s the FCA saying that if you use AI, or your suppliers use it on your behalf, you need to understand and govern that use as seriously as any other material operational risk.
Why it applies to small and mid-sized advice firms
The statement covers the full range of FCA-regulated firms, not just large banks and asset managers. An IFA practice, a financial planning business or a wealth manager is in scope even if nobody on the team has deliberately adopted an AI tool.
The reason is third-party exposure. Your back-office system, CRM, document management platform and compliance monitoring tool are likely already using AI features, whether or not you chose them. A provider putting your client data through its AI features may be a material third-party dependency under the FCA’s existing operational resilience rules, and the joint statement strengthens the expectation that you’ve mapped and assessed those dependencies.[1]
That isn’t new territory. Operational resilience has been a standing expectation since PS21/3 came into force. What the statement does is put AI risk explicitly inside that existing framework, so the question moves from “do we have an AI policy?” to “is our operational resilience mapping current, and honest about AI?”
What the statement expects firms to be able to show
Read against the existing rules, the statement expects a firm to have four things it could show a supervisor, and most of them a firm can produce itself.
A map of AI exposure: which suppliers process, analyse or generate content from your client data using AI, checked against terms of service and data processing agreements that may have changed since you last read them.
Data processing agreements that match reality: if a supplier’s AI features touch client data, the agreement should say so, and you should know where the data goes, whether it trains models and how long it’s kept. Clients and counterparties are already asking these questions directly.
A dated record of what you found and what you decided. Under Consumer Duty and SM&CR, senior managers are expected to show they considered material risks and took reasonable steps. A short dated note of the mapping and decisions is worth more than a long policy nobody updates.
An incident plan that includes AI. If a supplier’s AI system were compromised, or produced a material error affecting client outcomes, the firm should be able to spot it, contain it and report it. Operational resilience already requires this, but the AI scenario often isn’t written in.
For the wider UK picture these sit inside, see the UK AI governance guide.
Whether new AI rules are coming
The statement says the three bodies are working together on these questions and will keep engaging with the sector.[1] That isn’t a commitment to legislation or to binding rules on any timetable, and reading it as a countdown to a deadline goes further than the document does.
What’s fair to say is that it isn’t a one-off. The FCA’s AI-related output over the past two years has followed a consistent pattern: voluntary frameworks first, then guidance, then rules. Firms that take the earlier signals seriously usually find the move to binding requirements straightforward. Firms that wait for the rule usually find the implementation window uncomfortably short.
My read
The more immediate point is that AI governance is already a senior management responsibility under rules that are already binding. Consumer Duty, SM&CR and operational resilience don’t wait for AI-specific legislation, and the statement is largely a reminder of that.
I think the firms most exposed are the small ones that assume it’s aimed at banks. A ten-adviser firm with one back-office system and a document tool that has quietly switched on AI features is still a regulated firm that’s expected to understand its operating risks. The firms that come out well won’t be the ones with the longest AI policy. They’ll be the ones that can produce a dated list of every supplier using AI on their client data, because that’s the first thing a supervisor following this statement will ask for.
The statement is short and worth reading in full on the FCA’s website rather than relying on any summary, this one included.[1]
Cordrey Consulting provides strategic and operational guidance for advice firms on AI adoption and workflow, not regulated financial or compliance advice. Consult a qualified compliance professional for advice specific to your firm.
Sources
[1] FCA, Bank of England, and HM Treasury: Joint statement on frontier AI models and cyber resilience (15 May 2026), https://www.fca.org.uk/news/statements/fca-boe-treasury-joint-statement-frontier-ai-models-cyber-resilience