Expected · 2027 ICO statutory code of practice on AI and automated decision-making expected
Required by 2026 regulations; drafting and consultation point to 2027. The ICO's updated ADM guidance itself is due winter 2026 after the spring consultation.
Expected · Late 2026 FCA 'AI good and poor practice' publication promised
Committed alongside the Mills Review: the closest thing to AI-specific FCA guidance yet. The Treasury Committee has pressed for comprehensive guidance by end-2026.
Jul 2026 Mills Review of AI in retail financial services published NEW
The FCA's landmark review (6 July): seven recommendations, from perimeter adaptation to scaling the AI Lab, and the promise of a good and poor practice publication later in the year.
Apr 2026 AI Live Testing second cohort; regulators answer the Treasury Committee NEW
Eight firms enter Live Testing (21 April, reporting early 2027), and the FCA and Bank respond (16 April) to the committee's January report, defending the no-new-rulebook approach.
Jan 2026 Treasury Committee: current approach 'risks serious harm' NEW
The committee's AI in financial services report (20 January) presses the FCA to publish comprehensive practical guidance, including on SM&CR accountability for AI harm, by end-2026.
May 2026 FCA, Bank of England and HM Treasury publish a joint statement on AI NEW
A coordinated signal of the UK's supervisory posture on AI in financial services: engagement and monitoring within existing frameworks.
Spring 2026 ICO consults on automated decision-making and profiling guidance NEW
The consultation on updated guidance under the reformed regime; a statutory code of practice on AI and ADM is in preparation behind it.
Feb 2026 DUAA automated-decision regime takes effect NEW
Articles 22A–22D replace the old Article 22 of UK GDPR: more permissive on solely automated decisions, with the safeguards now the compliance surface.
Feb 2026 FCA updates 'AI and the FCA: our approach' (still no bespoke rules)
The FCA maintains its position: no extra regulations for AI; existing frameworks apply, with individual accountability under SM&CR unchanged.
Jan 2026 FCA launches its review of AI in retail financial services
The review that became the Mills Review, published July 2026. No new rulebook signalled at launch, and none recommended.
Jan 2026 Supercharged Sandbox first cohort showcased; AI Live Testing continues
The AI Lab's first Supercharged Sandbox cohort is showcased and a second opens; AI Live Testing moves into its second cohort.
Nov 2024 PS16/24: critical third parties to the UK financial sector
The Bank of England and PRA finalise the regime allowing major technology providers to be designated for direct regulatory oversight, the concentration-risk backdrop to every firm's AI vendor list.
Apr 2024 FCA AI Update: the founding position
AI is a technology, not a regulated activity: the FCA will not write an AI rulebook, and existing obligations apply from the moment a firm uses AI. Everything above is elaboration.
The most useful thing to understand about UK AI regulation for financial firms is that there is no AI rulebook coming, and that this is not the same as there being no rules. The FCA’s position, set in April 2024 and maintained since, is that existing frameworks apply: Consumer Duty, SM&CR, SYSC, record-keeping. What changes over time is the elaboration: statements, statutory reform, supervisory programmes and guidance that sharpen how those existing obligations bite on AI.
That is what this page tracks. Newest first, updated when events land rather than on a schedule, with the entries kept deliberately short. For what the position means for your firm in practice (the controls mapped to each regulatory hook), see the UK AI governance guide; for the wider picture across jurisdictions, the cross-border map.
How to read the direction of travel
Three threads run through the timeline. First, the FCA’s consistency: every update since April 2024 has restated the same position rather than revised it; firms waiting for a compliance date are waiting for something that is not coming [1][2]. Second, the law that did change is data law: the DUAA’s automated-decision regime is the one genuine statutory shift, and its safeguards (decision logic, human intervention, the right to contest) are now the compliance surface for anything approaching automated decisions. Third, supervision is getting closer to the technology: the AI Lab, live testing and the critical third parties regime all put the regulator nearer to how AI is actually run [3][4][5].
This page is for informational purposes only and does not constitute regulated financial advice, legal advice, or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.
Sources
[1] Financial Conduct Authority, ‘AI Update’, 22 April 2024. Available at: https://www.fca.org.uk/publication/corporate/ai-update.pdf
[2] Financial Conduct Authority, ‘AI and the FCA: our approach’, updated 13 February 2026. Available at: https://www.fca.org.uk/firms/innovation/ai-approach
[3] Financial Conduct Authority, ‘AI Lab’. Available at: https://www.fca.org.uk/firms/innovation/ai-lab
[4] Financial Conduct Authority, ‘Supercharged Sandbox’. Available at: https://www.fca.org.uk/firms/innovation/supercharged-sandbox
[5] Bank of England / PRA, ‘PS16/24 — Operational resilience: Critical third parties to the UK financial sector’, November 2024. Available at: https://www.bankofengland.co.uk/prudential-regulation/publication/2024/november/operational-resilience-critical-third-parties-to-the-uk-financial-sector-policy-statement
