UK FCA Review Warns AI Concentration Risk Demands Action
The Financial Conduct Authority published The Mills Review on July 6, 2026, a board-commissioned study of how advanced AI will reshape retail financial services by 2030. The review, led by FCA executive director Sheldon Mills, identifies four systemic shifts: how firms operate, how consumers make decisions, how competition and market power are distributed, and how fraud and cyber risks evolve.
The concentration risk finding is the most actionable for U.S. insurers. The review warns that widespread adoption of AI across financial services could leave firms dependent on a small number of technology providers for critical capabilities. Shared reliance on the same cloud infrastructure and model providers is where the review expects common points of failure to emerge, and it puts those in a category of their own: ecosystem-level risks that sit outside the scope of firm-level resilience frameworks. Its seven priority recommendations all address the FCA Board rather than firms, and the second of them is to strengthen system-wide coordination and oversight.
Third-party AI due diligence has to reach past model accuracy and data handling. A vendor risk assessment should now ask whether a carrier and its competitors are running the same foundation model, whether the underlying cloud provider is the same, and what happens if that provider withdraws service or changes terms. Business continuity plans and concentration limits should be part of the AI governance file, not just the enterprise risk management exercise.
The review also highlights a gap in consumer awareness. Its commissioned survey of more than 5,000 consumers found that 26 percent see tools such as ChatGPT as a reliable source of financial information or advice, while only 40 percent correctly recognize that there is no formal route to recourse when that advice goes wrong. Mills recommended that the FCA secure and adapt the regulatory perimeter, which today leaves publicly available large language models outside it. That question is less urgent for U.S. insurers than the operational concentration risk, but it signals where regulator attention is heading.
Inventory where the concentration actually sits. A carrier should know which AI vendors share the same cloud backbone, which underwriting or claims models are built on the same foundation model, and whether a single provider outage could affect multiple business lines. That inventory should feed into the AI governance program and be reviewed at the same cadence as model risk assessments.
Boards and risk committees should treat the inventory as a standing agenda item, not a one-time exercise. The review also suggests that concentration risk is not only about outages. If many firms rely on the same model provider, a single update or policy change by that provider could move market behavior or pricing assumptions in the same direction. That correlation is harder to model than a service interruption, but it is the risk that systemic regulators worry about most. For a carrier, the question is whether its own AI vendor map is robust enough to spot those dependencies before a regulator or an outage forces the issue.
Cloud concentration announces itself through outages, which are visible and bounded. A model provider changing a policy or shipping an update moves many firms’ behavior at once and leaves no incident to report, which is the harder version of the problem and one a per-vendor risk assessment is not shaped to catch.