> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # UK FCA mandates AI failure and near-miss reporting for financial firms - URL: https://f4n6.co.uk/security-feed/uk-fca-mandates-ai-failure-and-near-miss-reporting-for-financial-firms/ - Published: 2026-10-20T21:19:16.000Z - Updated: 2026-10-20T21:19:16.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary The FCA's chief data, information and intelligence officer, Jessica Rusu, said on 20 October 2026 that firms' existing major-incident reporting must extend to significant AI failures and near-misses, and that near-miss reporting for agentic AI is now a regulatory priority. The statement was made at Bloomberg's UK Policy Series; no rule change, consultation paper or supervisory notice has been published, so the obligation described rests on the FCA's existing incident-reporting rules as the regulator interprets them. UK AI minister Kanishka Narayan said the same week that the government is assessing how to strengthen the regime for serious AI incidents and near-misses, but the government has not committed to AI-specific measures in the Cyber Security and Resilience (Network and Information Systems) Bill. For EMEA financial services clients with UK-authorised entities or UK-facing agentic AI deployments, the exposure is supervisory rather than technical: an unreported AI failure or near-miss is now framed by the regulator as a reporting gap, and the absence of a defined threshold means firms must set and document their own. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain This is a supervisory policy statement, not an incident. There is no exploited component, no malware and no attack chain to reconstruct. What follows is how the reporting expectation is being framed and what it implies for firms running autonomous or agentic systems. The FCA position, as stated by Rusu, is that poorly governed AI can create consumer harm, cyber vulnerabilities and operational failures at greater speed and scale than manual processes, and that greater autonomy requires clear accountability. Her formulation is that existing rules already require firms to report major incidents and that this "must extend to significant AI failures and near-misses". The regulator has not published a definition of "significant AI failure" or "near-miss" in the reporting, so the boundary between a reportable event and an internal observation is currently a firm-level judgement. That is the operative gap: firms that wait for a published threshold will be making that judgement retrospectively, after an event. The government track is separate and unresolved. Narayan said the plan is to work with Parliament and technical experts on identifying and reporting serious incidents and near-misses, reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed. Alexandra Jones, Director General for Growth, Science and International at DSIT, told MPs that amendments to the Cyber Security and Resilience (Network and Information Systems) Bill remain under consideration. No commitment has been made to add AI-specific measures to that Bill. Firms should not assume the legislative position will settle before the supervisory expectation is applied. Two external inputs sit behind the direction of travel. Steven Adler of Guidelight AI Standards told MPs that AI oversight could learn from aviation, where near-miss reporting is mandatory in most jurisdictions, on the basis that near-misses carry the lessons that prevent fatal events. In January 2026 the House of Commons Treasury Committee called on financial regulators to run stress tests for AI-driven market shocks and to establish clear lines of accountability when AI systems produce harmful or unfair outcomes. Neither is binding, but both indicate the scrutiny a firm's AI incident record will face. The source gives no technical detail on agentic AI architectures, no failure modes, no control frameworks and no examples of reportable events. Any advisory that supplies those specifics for this item would be inventing them. The practical content is procedural: what a firm records, how it classifies an AI failure, and who signs off that classification. ## 4\. Mitigation & containment P1 (within 24h) - Confirm whether the firm's incident taxonomy has a category that captures AI system failure, degraded model output and agentic action taken without human authorisation. If it does not, add one and route it through the existing major-incident process rather than a parallel AI-only channel. - Identify every production system where an AI component can take an action with customer, market or payment effect without a human in the loop, and record the accountable owner for each. Rusu's statement ties autonomy to accountability; an unowned agentic workflow is the first thing a supervisor will ask about. - Brief the incident-management and operational-resilience functions that near-misses are now in scope for reporting consideration, so that near-miss capture starts before the next event rather than after it. P2 (within 72h) - Write down the firm's working definition of "significant AI failure" and "near-miss" and the criteria used to escalate each to a reportable incident. The FCA has not published thresholds, so the definition must be the firm's own and must be defensible. Record the date and the approver. - Extend the incident log to capture AI-specific fields: model or agent identifier, version, the action taken, whether a human authorised it, the customer or market effect, and the detection method. Without these fields a near-miss cannot be reconstructed later. - Review whether existing third-party contracts for AI models and agent platforms oblige the provider to notify the firm of model failures, behaviour changes or safety incidents within a period that lets the firm meet its own reporting timeline. Where they do not, raise it at the next contract review. P3 (within 7 days) - Run a tabletop on an agentic AI failure that caused no customer loss, and test whether the firm's process would have classified and recorded it as a near-miss. The aviation comparison in the source is the test: the events worth capturing are the ones that did not cause harm. - Track the Cyber Security and Resilience (Network and Information Systems) Bill for AI-specific amendments. Jones confirmed they are under consideration and not committed, so the position can change with little notice. - Where the firm operates under DORA, check that AI-system failures are reachable by the ICT-related incident management and classification processes already in place, since the FCA expectation attaches to the firm's incident reporting rather than to a new standalone regime. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ## 6\. Detection Insufficient indicators to author detection rules. ## 7\. Sources - The Register, "UK finance watchdog wants firms to report AI failures and close calls", 20 October 2026\. https://www.theregister.com/ai-and-ml/2026/10/20/uk-finance-watchdog-wants-firms-to-report-ai-failures-and-close-calls/5304078 ## 8\. Adverse Trace position This is a policy and supervisory item with no technical severity to assign: no CVE, no exploitation and no threat actor are involved, and the source is a single trade-press report of public remarks, so the quotations and the government positions should be checked against the FCA and DSIT publications before they are relied on in a regulatory submission. The client impact is concentrated in UK-authorised entities and any EMEA firm running agentic AI against UK customers, and it is a reporting and governance exposure rather than a security one: the regulator has stated an expectation without publishing a threshold, which shifts the burden of defining "significant AI failure" and "near-miss" onto the firm. We will monitor for an FCA consultation, supervisory notice or finalised guidance that sets that threshold, and for AI-specific amendments to the Cyber Security and Resilience (Network and Information Systems) Bill, and will issue a follow-up if either changes what clients must report. --- [Read the original source →](https://www.theregister.com/ai-and-ml/2026/10/20/uk-finance-watchdog-wants-firms-to-report-ai-failures-and-close-calls/5304078?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*