FCA review: AI is speeding up flaw-finding faster than firms can respond, firms report

In a multi-firm review published on 2 September 2026, the UK Financial Conduct Authority (FCA) set out what financial firms told it about how frontier AI is changing their cyber resilience. Its headline theme is that firms reported vulnerability discovery "is accelerating faster than firms' ability to respond".

What the review is, and is not

The FCA says the publication "summarises observations reported by firms during our engagement" and "does not introduce new rules, guidance or regulatory expectations". It says it is publishing the insights so that "particularly small to medium-sized firms" can learn from others and prepare for AI-enabled cyber threats.

The review does not say how many firms took part or what kinds of firm they were. It describes its sources only as firms it has "been engaging with". It names no AI model or developer.

The FCA defines frontier AI as "the most advanced AI models available at any given time", and says it looked at such models "in the context of cybersecurity and resilience".

Why the FCA looked

The regulator frames the risk in two directions. Frontier models "can help firms identify and analyse their cyber vulnerabilities more quickly", it says, "but if used maliciously, amplify cyber threats to firms' safety and soundness, customers, market integrity, and financial stability."

It points back to a joint statement with the Bank of England and the Treasury in May 2026, which described these models as "a step-change in capability, with significant implications for cyber security and operational resilience". On firms' own use, the review adds that the models' capabilities "can outpace existing regulation and risk management practice", so firms using them "should apply extra caution around consumer protection, governance and oversight".

What firms reported

The FCA summarises five themes from its engagement. Points firms reported include:

• A remediation bottleneck. Firms said they can now find weaknesses rapidly. Firms noted that even where "a substantial proportion of model outputs are ultimately discounted through expert review", what is left "can still put considerable pressure on remediation teams, engineering resources, and change management processes".
• The setting matters more than the model. Firms said the value they get "is determined less by the models themselves and more by the technical and operational environment they're deployed in". The FCA calls this environment "the harness". Without it, firms report that models "can generate large numbers of findings that are technically possible but difficult to validate, prioritise or act upon".
• Chained flaws. Firms highlighted that frontier models "can combine multiple lower-rated security flaws (vulnerability chaining)", which is pushing some towards prioritising by business impact rather than severity ratings alone.
• A stress test. "Several firms characterised frontier AI as a stress test of their existing cyber-resilience capabilities," the FCA says. Its summary states: "Organisational readiness is the primary challenge."
• People stay in charge. Firms report that "human oversight remains critical" for validating findings and making risk decisions.
• Suppliers. Some firms said they are asking suppliers how they use AI-enabled vulnerability discovery and whether they can remediate quickly.

What firms are asked to consider

Consistent with its stated status, the FCA puts this as questions firms "should consider" rather than requirements. They include:

• Who owns decisions about using frontier AI in cyber-resilience work?
• Can the firm tell outputs that are "technically plausible" apart from findings an attacker could actually exploit?
• Where are the likely bottlenecks in validation, remediation, patch testing and change implementation?
• "Have you asked key suppliers how they are preparing for AI-enabled vulnerability discovery and increased patch volumes?"

The review also suggests that senior leaders "may need greater visibility" of how AI affects remediation capacity and their firm's ability to keep delivering important business services.

Further reading

Under further reading, the FCA links to the National Cyber Security Centre's "Frontier AI: what you need to know", firm guidance on frontier AI from the Cross Market Operational Resilience Group (CMORG), its own Cyber Coordination Group insights, a G7 cyber experts statement, and the 2025 CBEST thematic from the Bank of England, the PRA and the FCA.

Why it matters

The review gives no direct message for bank or insurance customers. The FCA's stated concern is that malicious use of these models could amplify threats to firms, customers and financial stability. On our reading, the practical upshot for UK financial firms is that the regulator's questions focus on whether they can fix what AI finds, not only whether they can find it. It has stopped short of making that a rule.