On 27 January 2026 the Financial Conduct Authority launched a major forward-looking review into how advanced AI will reshape retail financial services by 2030 and beyond. Led by Executive Director Sheldon Mills, the review is not introducing new rules — it is a Call for Input designed to help the FCA prepare for profound changes already underway. For UK financial advisers and operations teams, this is a clear signal: the regulatory lens on AI is sharpening.
What Is the Mills Review?
The Mills Review — formally titled “Review into the long-term impact of AI on retail financial services” — builds on the FCA's earlier AI Discussion Paper and AI Lab work but takes a deliberately long-term view to 2030 and beyond.
- →Led by Sheldon Mills, Executive Director of Consumer and Competition
- →Call for Input, not new rules — the FCA will continue using its principles-based framework and Consumer Duty
- →Four themes: AI evolution (including agentic systems), market impact, consumer impact, and regulator evolution
- →Deadline for responses: 24 February 2026
- →Final recommendations to the FCA Board expected summer 2026
Why This Matters for Advisory Firms
Most advisory firms are already experimenting with AI for suitability reports, annual review preparation, pension transfer analysis, or client onboarding. The Mills Review puts three critical issues under the spotlight:
- Agentic AI — systems that act autonomously rather than simply generate text. The review asks how firms will maintain human oversight and explainability when AI starts making chained decisions.
- Data control and outsourcing — the majority of popular AI tools are cloud-based and send client data to third-party servers, often overseas. The review highlights risks around data sovereignty, international transfers, and concentration in a few large providers.
- Consumer Duty implications — firms must still deliver good outcomes. If an AI-generated recommendation cannot be fully explained in a file review, demonstrating compliance becomes significantly harder.
The Cloud AI Problem
The convenience of cloud AI (ChatGPT, Copilot, Gemini) comes with hidden compliance costs. When client data leaves your firewall:
- →You create a data processor relationship requiring detailed contracts and ongoing monitoring
- →International transfers trigger Schrems II considerations and potential ICO scrutiny
- →Audit trails become fragmented between your systems and the provider's
- →Market concentration risk grows — a handful of US tech giants dominate the infrastructure
The Mills Review explicitly flags these outsourcing and data-sovereignty concerns. Firms using cloud tools will almost certainly face extra questions during file reviews, PI insurance renewals, and any future FCA visits.
The On-Premises Alternative
On-premises AI runs entirely on your own servers or private infrastructure. No client data ever leaves the building. Benefits that directly address the Mills Review themes:
- ✓Zero third-party data transfers — simplified DPIAs and full accountability under UK GDPR
- ✓Complete audit trails and explainable outputs — every decision can be logged and defended
- ✓No vendor lock-in or recurring cloud subscriptions
- ✓Consistent performance without internet dependency
- ✓Full customisation to your exact workflows and regulatory obligations
What Your Firm Should Do Now
With the response deadline days away and the final report due in summer 2026, three practical actions will put you ahead of the curve:
- Audit your current AI tools — map exactly where client data flows. Ask every vendor: “Does this tool ever send personal data outside our firm?”
- Document explainability processes — for any AI-assisted output used in client files, ensure you can show how the recommendation was reached
- Evaluate on-premises alternatives before the summer 2026 report — early movers will have time to integrate solutions future-proofed against whatever recommendations emerge
Take the next step
Find out where your firm stands with our free AI Readiness Quiz, or book a 15-minute demo to see on-premises AI in action.
This article is for information purposes only and does not constitute regulated advice.