Two Regulators, One Evidence Base
On 8 July 2026, the Financial Conduct Authority published the Mills Review, the first regulator-initiated review of its kind setting out how AI will reshape retail financial services through to 2030. Two weeks later, on 23 July, the EU AI Act’s finalised high-risk classification guidelines reached their compliance milestone. Two jurisdictions and two different instruments point in the same direction.
Both look for the same thing. A firm using AI inside a regulated process should be able to show how that process operates: which decisions the system makes, which controls constrain it, where the data came from and who is accountable when it acts.
That is a process articulation task, and it rewards firms that start it early. One well-built evidence base serves both regimes.
What the Mills Review Signals for UK Firms
The Mills Review is a review, not a rulebook. It introduces no binding requirements. What it gives firms is a clear direction of travel, and for a regulator, direction of travel rarely reverses.
It is the first regulator-initiated review of its kind globally, which tells UK firms that the FCA is forming its supervisory position ahead of AI-related harm. The review examines how AI is reshaping decisions, resilience and accountability across retail financial services. Those themes map onto existing supervisory priorities: consumer outcomes, operational resilience and clear lines of responsibility under the Senior Managers and Certification Regime.
Read it as an early indicator of the questions supervisors will ask. When AI shapes a lending decision, a pricing outcome or a fraud intervention, the FCA will expect firms to explain what the system did, why, and under what controls. Firms that treat AI governance as a live property of how their processes run will be well placed.
This is where risk and compliance teams can usefully look now, ahead of any formal consultation. The distance between a documented control and an executed control is the one the Mills Review points at, and it is one you can close.
The EU AI Act’s 23 July Milestone
The EU regime is a dated obligation. As analysed by Wolters Kluwer, Pinsent Masons and JD Supra through July 2026, the high-risk classification guidelines are finalised, with a 23 July compliance milestone. For AI systems in high-risk categories, which include many uses in creditworthiness assessment, insurance pricing and employment, the Act brings documentation and accountability obligations.
For risk functions, the important point is what conformity draws on. Documenting the model, its training data, its performance metrics and its intended purpose is one part. Conformity also draws on documented, traceable control over the process the model sits inside: how the AI system is used, monitored and overseen in operation.
UK financial services firms operating across both markets can take encouragement from that. The two regimes point to the same evidence requirement, which is why process articulation as EU AI Act evidence is the practical starting point for both, in place of two separate compliance exercises.
Start With Process Articulation
Control over a process is evidenced from a process that is written down. Most firms know what their AI systems are meant to do. The next step is showing what the surrounding process does: where the human decision points are, which controls fire and when, how a given output was reached and who authorised the configuration behind it. Regulators are asking for the why alongside the what: the decisions, the controls, the provenance and the accountability behind each outcome.
IGX360 Insights supports that. It shows the provenance, ownership, confidence and freshness of the process knowledge behind AI-embedded processes and adds governance and control context, so the record reflects how the process is meant to run and who is responsible for it.
A policy that asserts control is a good start. A record that shows, for a specific transaction on a specific date, which controls applied and which human gate resolved it, is evidence. When an FCA supervisor or an EU conformity assessor asks how a high-risk process operates, the record answers in the terms they use.
Build it once, and it serves the FCA’s supervisory questions and the EU’s documentation obligations from the same source. For a fuller account of how this maps to audit and provenance requirements, see the method behind it and the compliance manager view of what evidencing looks like in practice.
Be Ready Before the Audit
The 23 July milestone has passed, and supervisory attention continues to build. The FCA has shown its direction and the EU has set its date. A firm that can show how its AI-embedded processes operate walks into scrutiny with evidence.
A useful question for your next review: when the regulator asks how your AI-embedded processes operate, will you be reading the answer from the record?
Talk to IGX about one evidence base for FCA and EU AI Act scrutiny.
This article is commentary on regulatory developments and does not constitute legal advice. Firms should consult qualified counsel on their specific obligations under the EU AI Act and FCA rules.