Financial Services: where the frameworks are already built.
UK financial services already runs on SS1/21 and SS2/21, covering operational resilience and third-party risk management. AI governance here is extending that existing discipline to AI specifically, not building a parallel one. For how those regimes interact with the EU AI Act and UK GDPR, see AI governance in UK financial services. For what AI tools can and cannot do for the SS2/21 third-party function itself, see AI in Third-Party Risk Management.
Last reviewed: 2026-07-29
Why Financial Services is the core industry hub
A regulatory spine that already exists
PRA SS1/21 (operational resilience) and SS2/21 (outsourcing and third-party risk) already tell firms what good looks like. AI governance here is applying that discipline to AI specifically, not inventing a parallel framework.
A worked example, not a hypothetical
The Thought Experiment is a live investigation into whether a small human core can govern a UK-regulated retail bank's AI — built on the FCA's own Mills Review, not a synthetic scenario.
The risks that show up first
Vendor due diligence, impact-tolerance mapping, and cross-border data transfer dominate the FS-tagged risk set — third-party and operational-resilience concerns, not novel AI-only ones.
Can four people actually govern and steward a bank's AI?
The Thought Experiment is a UK-regulated retail bank scenario, built on the FCA's Mills Review: an evolving public investigation into whether a small human core can govern AI agents performing the rest of the operation, tested against a named organisational structure, a regulatory floor, and a ledger-integrity model.
Everything tagged Financial Services.
Pulled live from the library — assembled by the financial-services facet, not a hand-maintained list.
7 risks
2 articles
5 resources
- The Mills Review: AI and the future of retail financial services UK FCA
- SS1/21: Operational Resilience Bank of England PRA
- SS2/21: Outsourcing and Third-Party Risk Management Bank of England PRA
- SS1/23: Model Risk Management Principles for Banks Bank of England PRA
- UK Critical Third Parties Regime Bank of England / PRA / FCA
Frequently asked questions
Why is Financial Services the core industry hub, not just one of several?
Because the regulatory spine already exists — PRA SS1/21 and SS2/21 already define operational-resilience and third-party-risk expectations that AI governance can extend rather than invent, and the Thought Experiment gives the hub a genuine worked example rather than a hypothetical.
What is the Thought Experiment, and why is it the flagship exhibit here?
An open investigation into whether a small human core can effectively govern and steward a UK-regulated retail bank's AI, with AI agents performing the rest — built on the FCA's own Mills Review. It's the flagship exhibit because it's a worked FS scenario, not an abstract one.
What FS-specific risks does the library currently track?
Vendor due diligence, business-service impact-tolerance mapping, untested failure scenarios, vendor concentration and exit strategy, and cross-border AI data transfer — reflecting SS1/21 and SS2/21 obligations applied to AI specifically.
This is one of the areas Andrew advises on.
Board & Executive Risk Reporting and Third-Party & Operational Resilience Risk are both grounded in exactly this UK financial-services regulatory context.