Mills Review: the scope and nature of control in wealth management AI

A practical reading of the FCA's Mills Review for wealth management firms planning where, and how far, to let AI into the advice process.

A practical reading of the FCA’s Mills Review for wealth management firms planning where, and how far, to let AI into the advice process.

The Mills Review did something quietly unusual for a regulator facing a fast-moving technology. Published by the FCA on 6 July 2026 and led by executive director Sheldon Mills, it did not write a new rulebook. It concluded that the UK’s principles-based, outcomes-focused framework remains sound and needs progressive adaptation rather than replacement. No AI-specific rules. No new Senior Management Functions. The work of governing AI stays with firms.

That places a heavier burden on how you think, and the most useful contribution of the Mills Review is a way of thinking. It is called the autonomy spectrum, and for wealth managers it turns a vague worry (“is this AI safe to use?”) into two precise design questions: what is the nature of the control a human retains, and how far are you willing to extend the scope of what the machine may do? Answer those two questions well, function by function, and most of the governance follows.

The autonomy spectrum, in one paragraph

The Mills Review frames AI deployment as five roles for the human, arranged by how much of the work has been handed over. As an operator, the human uses AI as a tool on demand: summarising a fact-find, drafting a letter. As a collaborator, human and AI plan and act together. As a consultant, AI weighs the options and recommends while the human decides. As an approver, AI prepares or initiates an action that the human authorises. As an observer, AI acts continuously within agreed limits and the human monitors outcomes, intervening by exception. Autonomy rises as you move along the scale, and so does the character of the risk. Placing each use case on that scale is the first practical step the Mills Review asks of a firm.

Why the character of the risk changes

This is the point most firms miss. At the operator and collaborator end, the hard questions are about accuracy, output quality and over-reliance: is the draft correct, and is the human checking it properly? Move towards approver and observer and the questions change entirely. They become about consent, accountability and redress. Did the client understand and agree to what the system did on their behalf? When something goes wrong, who is answerable, and can they explain what happened?

The central regulatory claim of the Mills Review rests on exactly this shift. The existing framework, including the Consumer Duty and the Senior Managers Regime, works well while AI sits in the operator, collaborator and consultant modes. The pressure emerges at approver and observer, where opacity and model drift can make it genuinely hard to identify a de facto responsible senior manager, and where meaningful human control becomes difficult to evidence. Credit and underwriting are flagged as areas where this is already sharpest. The accountability model does not break; the ability to prove control does.

For a wealth manager, that has a practical edge. Suitability, vulnerability identification, complaints handling, money movement and financial-crime monitoring are precisely the activities where consent, accountability and redress carry the most weight. They are the functions where the position you choose on the Mills Review spectrum matters most, and where a careless drift rightwards costs you the most.

The nature of control is a design choice, not a default

The first discipline the Mills Review encourages is to stop treating autonomy as something that simply happens as a tool improves. It is a choice, and it should be made deliberately for each function.

A reliable way to make that choice is to look for the hinge between two very different kinds of task. On one side sit retrieval, extraction, citation and drafting: the system reads, finds, summarises and proposes, and a human owns the output. On the other side sit inference, decision and action: the system judges, chooses or acts. The first kind is verifiable by construction, because a human can check the AI’s work against a visible source. The second kind is where control genuinely transfers, and where it has to be designed in rather than assumed.

In practice this means classifying every use case by where the human actually decides, not by how impressive the technology sounds. A suitability engine that assembles adviser-provided inputs into a draft, leaving the paraplanner to author the rationale and the adviser to approve, is an operator-level tool no matter how capable the model behind it. A monitoring capability that surfaces timestamped anomalies for a trained human to assess is a consultant, not an autonomous decision-maker. The label follows the operating model, and the operating model is yours to design.

There is a counter-intuitive lesson worth carrying into any board discussion. In a recent portfolio assessment mapped against the Mills Review, the use cases that first looked too risky to touch did not become acceptable because the technology improved. They became acceptable because each one was deliberately held at consultant level or below: AI surfaces and recommends, a human decides, and any irreversible action stays human-authorised. The risk did not disappear; it was placed. Choosing your position on the spectrum, below the point where consent and accountability outrun capability, is the control.

The scope of control: set the autonomy ceiling deliberately

The second discipline is about reach. If the nature of control is which role the human plays, the scope of control is how far you allow any function to travel along the spectrum, and where you draw a firm line.

The Mills Review does not ask firms to ban higher autonomy. It asks them to permit it only under a defined package. Practitioner guidance emerging since publication is consistent on what that package looks like: a named senior owner who stays accountable under the Senior Managers Regime, a bounded and revocable mandate, retained approval gates on any irreversible or high-consequence action, full traceability of what the AI produced and what the human changed, a tested fallback and kill switch, and formal, documented acceptance of the residual risk.

Applied to a wealth business, the Mills Review points most firms today towards a sensible ceiling: a deliberate line drawn before approver for anything that touches a client outcome or moves money. That still leaves an enormous amount of value on the near side of the line. The bulk of the addressable workload, evidence search, document and data handling, review preparation, cost and charges extraction, provider correspondence, audit-pack assembly and management information, sits comfortably at operator level. A smaller set of genuinely valuable, sensitive capabilities can run at consultant level with the controls above.

Autonomous money movement, self-releasing payments and any always-on optimisation agent stay explicitly out of scope, monitored as the market and the rules mature rather than adopted early.

The point is not caution for its own sake. A clearly stated ceiling lets you move quickly and confidently everywhere below it, because you have already decided, and can show you decided, where the human stays in charge.

What wealth managers should do now

The Mills Review reads less as a warning than as a planning document, and a handful of actions translate it into practice.

Start by placing every live and proposed AI use case on the spectrum, using the retrieve-versus-act hinge to sort them honestly. Set an explicit autonomy ceiling for each function and record the reasoning, so that “we operate at consultant level here, and here is why” is written down before a regulator or a client ever asks. Attach a named accountable owner to each material use case and make sure their Statement of Responsibilities reflects it. Build approval gates and evidence capture into the workflow itself, so that what the AI generated, what the human altered, and what was flagged and resolved are all recorded as decisions are made, not reconstructed afterwards. And treat monitoring as continuous rather than a point-in-time validation, because model drift and reliance on third-party providers are exactly the conditions under which control quietly erodes.

None of this requires waiting for new rules, and that is the deeper message of the Mills Review. As legal analysis of the report has noted, it does not change the rules that apply to firms today; its value lies in the direction of travel it sets. The regulator has said it trusts the existing framework and expects firms to apply it thoughtfully as autonomy increases. For wealth managers, that trust converts directly into a design responsibility. Decide the nature of the control you keep, decide the scope you are willing to grant, do it function by function, and be able to prove both. The firms that treat autonomy as a deliberate position rather than an accidental drift will be the ones still comfortably inside the framework when everyone else is trying to explain how they ended up outside it.