Financial Services: where the frameworks are already built.
UK financial services already runs on SS1/21 and SS2/21 — operational resilience and third-party risk management. AI governance here is extending that existing discipline to AI specifically, not building a parallel one.
Last reviewed: 2026-07-29
Why Financial Services is the core industry hub
A regulatory spine that already exists
PRA SS1/21 (operational resilience) and SS2/21 (outsourcing and third-party risk) already tell firms what good looks like. AI governance here is applying that discipline to AI specifically, not inventing a parallel framework.
A worked example, not a hypothetical
The Thought Experiment is a live investigation into whether a small human core can govern a UK-regulated retail bank's AI — built on the FCA's own Mills Review, not a synthetic scenario.
The risks that show up first
Vendor due diligence, impact-tolerance mapping, and cross-border data transfer dominate the FS-tagged risk set — third-party and operational-resilience concerns, not novel AI-only ones.
Can four people actually govern and steward a bank's AI?
The Thought Experiment is a UK-regulated retail bank scenario, built on the FCA's Mills Review: an evolving public investigation into whether a small human core can govern AI agents performing the rest of the operation, tested against a named organisational structure, a regulatory floor, and a ledger-integrity model.
Everything tagged Financial Services.
Pulled live from the library — assembled by the financial-services facet, not a hand-maintained list.
7 risks
5 resources
- The Mills Review: AI and the future of retail financial services UK FCA
- SS1/21: Operational Resilience Bank of England PRA
- SS2/21: Outsourcing and Third-Party Risk Management Bank of England PRA
- SS1/23: Model Risk Management Principles for Banks Bank of England PRA
- UK Critical Third Parties Regime Bank of England / PRA / FCA
Frequently asked questions
Why is Financial Services the core industry hub, not just one of several?
Because the regulatory spine already exists — PRA SS1/21 and SS2/21 already define operational-resilience and third-party-risk expectations that AI governance can extend rather than invent, and the Thought Experiment gives the hub a genuine worked example rather than a hypothetical.
What is the Thought Experiment, and why is it the flagship exhibit here?
An open investigation into whether a small human core can effectively govern and steward a UK-regulated retail bank's AI, with AI agents performing the rest — built on the FCA's own Mills Review. It's the flagship exhibit because it's a worked FS scenario, not an abstract one.
What FS-specific risks does the library currently track?
Vendor due diligence, business-service impact-tolerance mapping, untested failure scenarios, vendor concentration and exit strategy, and cross-border AI data transfer — reflecting SS1/21 and SS2/21 obligations applied to AI specifically.
This is one of the areas Andrew advises on.
Board & Executive Risk Reporting and Third-Party & Operational Resilience Risk are both grounded in exactly this UK financial-services regulatory context.