The big question for any firm is what to do about the development of AI. There is a large literature already in relation to this from the Financial Conduct Authority's (FCA) various papers in the last couple of years and much industry literature. I think it's worth taking stock of where we are at on the debate and I would pick out two points.

Regulatory reaction - where are we at?

The first is that the regulatory reaction is still not clear. There remains a divide between the arguments in favour of bespoke AI regulation, for example those put by the Treasury Select Committee and the philosophy that AI should not change the fundamentals of regulation and just be an applied case. That is very much the historic view of the FCA. Clearly, the latter view has been based on the idea that regulation should be technology neutral and, therefore, the fundamental concerns around consumer behaviour, market structure, firm operations and regulatory oversight should be the same and the application of the regulatory regime should be applied by firms in the normal way.

My personal view and we will see what comes out of the Mills Review is that this “neutral” view is not going to be enough. It seems clear to all of us, both in the legal and the financial services industries, that we are at the beginning of a revolution in the way that products and services are delivered, and the idea that regulation will not take specific account of this, with pretty detailed rules seems unlikely to be how things will turn.  The policy decisions are, in any event, ultimately a matter in the UK context for HM Treasury and FCA.

What to do now?

I think the second question, which in many ways for firms is more important, is what you need to do now. Again, there is a fair amount of literature, but I think it is worth stepping back and saying where we have got to.

So, here's my starter for 10. I think firms need a clear programme for dealing with the regulatory challenges of AI, and that manifests in various ways. This is not comprehensive, but to name a few.

Documenting internal operations

First, the implications of the use of different aspects of AI for the firm's internal operations need to considered and documented. This can come in various shapes and forms. 

It can be the first line, traders or managers, for example, using AI for purposes of their work, and it also applies to the second line in relation to knowledge gathering, advice giving and all the other functions for the second line. I think the firm has to have some prudent policies in relation to which type of AI it uses, which systems, what know-how to use as inputs, how to permit the external use under internet sources and what the limits should be. 

I think the interesting question here is the extent to which the firm centralises not just the systems it uses, whichever ones those are, but also the data sources. I think that is a fundamental question which has not been debated enough in the market. That is the whole internal facing debate and, clearly, there is the governance around that as to which systems to use. I think many firms are quite focused on these issues.

External use of AI

The second issue, which has arguably occupied the regulators more, is the external use of AI. 

I think the main point to make here is that firms cannot wait for the regulatory regime to catch up. It seems clear that every firm needs a policy in relation to usage, how to use AI in relation to the services given to investors or consumers, depending on the particular market, how it is used for trading purposes and all the other myriads of uses to which it could be put. I think it is urgent now, given the speed of technology change, for firms to have clearly articulated written policies in all of these areas. It is simply not going to be enough to wait for regulation to catch up.

In this context, I think there are a number of key aspects:

1. The documentation governing the use of AI in relation to the firm’s services and products: This needs to cover which AI is to be used and how and when and to set out all applicable limits.
2. The governance around the process: This is a key question and this ultimately comes down to who makes which decisions and how the decision making levels fit together.
3. The monitoring and oversight of the process: This relates to the process of change which is particularly important given the pace of evolution in relation to AI.
4. Particularly important here are efficient feedback loops, where the firm is constantly reassessing the usage of AI in relation to delivery to the market, investors or consumers, depending on its precise business. 

There is an enormous amount of detail in this area to consider, but my main message is that time waits for no one, and speaking personally, I find the pace of change really quite astonishing in the last 12 months. We can see that it will be just as great, if not greater, in the coming year. So, really, the main message is a clarion call for firms to take control and not wait for regulatory developments.

The most obvious point here is to consider where the relationship between senior management and the technical experts will sit. As always with new technology at this time, there is a danger that, particularly in larger firms, the 'experts' take over the delivery of the product and I think firms, particularly large ones, need to calibrate this carefully so that senior management a) have enough training and b) have enough control to make the big decisions whilst taking proper advice from the experts internally.

Further reading

We have a whole series of briefings, podcasts and other events on AI related regulation, but I wanted to just bring out these few points. In many ways they are very obvious, but, as always, getting the obvious things right is often one of the, if not the biggest challenge, in the world of regulation.

• AI Regulation in Financial Services: FCA Developments and Emerging Enforcement Risks
• Global Asset Management Review – Issue 4
• AI mini-series - Episode 1 - AI in UK financial services - What the Treasury Committee found | Global law firm
• AI mini-series – Episode 3 – Agentic AI
• AI mini-series – Episode 2 – Mills Review