UK financial regulator demands AI failure and near-miss reporting from firms

The UK’s Financial Conduct Authority has stated that financial services firms must expand their incident reporting obligations to include significant failures of artificial intelligence systems and associated near-misses. Jessica Rusu, the FCA’s chief data, information and intelligence officer, made this clear during a speech at Bloomberg’s UK Policy Series on Monday. She emphasised that as financial institutions adopt increasingly autonomous AI agents, the need for clear accountability becomes paramount. Rusu argued that the current regulatory framework, which mandates the reporting of major incidents, must now explicitly extend to these new technological risks.

Root cause

The drive for stricter reporting stems from the growing autonomy of AI systems within the financial sector. Rusu noted that poorly governed AI can generate consumer harm, cyber vulnerabilities and operational failures. Crucially, she warned that these issues can occur at much greater speed and scale than traditional system errors. The underlying concern is that without rigorous oversight, the rapid deployment of agentic AI could outpace the ability of firms to manage risks effectively. This shift requires a fundamental change in how organisations monitor and report on system behaviour.

Attack path

There is no specific technical attack path described in the source material. The focus of the regulator’s statement is on governance and operational resilience rather than a specific exploit or vulnerability. The risk identified is systemic: the potential for autonomous agents to act in ways that cause widespread disruption or harm due to inadequate controls. Rusu framed this as a regulatory and national security priority, rather than a direct cyber-attack vector. The ‘attack’ is effectively the unmanaged expansion of AI capabilities without corresponding oversight mechanisms.

Affected versions

The guidance applies broadly to financial services firms operating in the UK that utilise AI systems. There are no specific software versions, products or CVE identifiers mentioned in the report. The FCA’s statement targets the industry sector as a whole, given its significant contribution to the UK economy. The sector contributed £223.6 billion to the national output in 2025, representing eight percent of total production. This economic weight underscores the regulator’s interest in ensuring stability across all major financial institutions using such technologies.

Mitigation

The primary mitigation strategy outlined by the FCA is enhanced reporting. Firms are expected to identify and report serious AI incidents and near-misses. The UK government, via AI Minister Kanishka Narayan, plans to work with Parliament and technical experts to strengthen the regulatory regime. This includes ensuring that serious AI incidents can be properly reviewed. The aim is to reduce AI-driven risks across essential services by creating a more robust feedback loop between firms, regulators and technical experts.

Why it matters

For security teams, this shift signals that operational resilience now includes AI behaviour. Teams usually treat near-misses as internal learning opportunities, but regulators now view them as critical data points for systemic risk. Check whether your incident response plans define what constitutes an ‘AI failure’ or ‘near-miss’. Consider how autonomous decisions are logged and reviewed. Ensure that governance frameworks can capture anomalies before they become failures. This approach mirrors aviation safety protocols, where mandatory reporting of minor deviations prevents major catastrophes. Focus on visibility and accountability.

What to do and how to stay safe: FCA

• Review existing incident reporting policies to determine if they explicitly cover AI-driven operational failures.
• Establish clear definitions for what constitutes a ‘near-miss’ in the context of autonomous agent behaviour.
• Ensure logging mechanisms capture decision-making trails for AI systems to facilitate post-incident review.
• Monitor for regulatory updates regarding the specific thresholds for mandatory reporting of AI incidents.

Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which organisations are affected by this new reporting requirement?

Financial services firms operating in the UK that use AI systems are expected to extend their incident reporting to include AI failures and near-misses.

What types of incidents need to be reported?

Significant AI failures and near-misses that could cause consumer harm, cyber vulnerabilities or operational failures must be reported.

Is this a new law or a regulatory expectation?

It is a regulatory priority expressed by the FCA, stating that existing rules requiring major incident reporting must extend to AI issues.