The Mills Review

The FCA published the Mills Review this July. It is a Board-commissioned examination of how AI will transform retail financial services by 2030, led by Sheldon Mills, former FCA executive director. It draws on 140 written submissions and extensive engagement across financial services, technology, consumer groups and academia.

The foundational regulatory position is unchanged. The FCA remains principles-based and technology neutral. Consumer Duty, SM&CR and existing financial promotions rules apply in full. We have covered what that means in practice in our AI Governance Guide and executive briefing.

What the Mills Review adds is a new way of thinking about how governance requirements evolve as AI becomes more embedded in how firms operate and how consumers engage with financial services.

The autonomy spectrum

The review introduces a five-level framework describing how the human role changes as AI systems become more capable and more trusted with tasks.

At one end, the human is the operator. AI is a tool used on demand: drafting, summarising, explaining. The human directs every step.

Moving along the spectrum, the human becomes a collaborator, then a consultant, then an approver. Each shift transfers more of the decision-making to AI. 

The human still sets direction and authorises key actions, but is no longer the primary originator of content or process.

At the far end, the human is an observer. AI executes tasks continuously within parameters set in advance. The human monitors outcomes and intervenes by exception.

As firms move along the spectrum, accountability shifts from direct instruction to setting the conditions under which AI operates. Firms remain responsible for outcomes at every stage. That means being able to explain how their AI works, what risks it introduces and how those risks are controlled.

The review is explicit about the value of the spectrum as a framework: it is specifically designed to make evolving risks visible. Early questions of accuracy and reliability give way, as delegation increases, to more complex questions of consent, accountability and redress. The spectrum shows how those risks change in character, not just in degree.

For financial promotions teams, the approver stage is where the governance question sharpens. Authorising a financial promotion is a regulatory act. Under SM&CR, the named individual who signs it off is personally accountable for it. As AI takes on more of the drafting, checking and routing work, the question is whether that individual has sufficient visibility of what they are authorising to discharge that accountability. What did the AI produce? What did the human change? What was flagged and resolved before the approval was given?

Those questions have straightforward answers when a human authors content from scratch. When AI is involved, they require deliberate workflow design and a system capable of capturing evidence as decisions are made.

The review does not predict that financial promotions will reach the observer end of the spectrum soon. What it makes clear is that many firms are already operating at the collaborator or consultant stage without having redesigned their approval processes to reflect that. 

Why this matters for financial promotions teams

The critical governance point in the review is this: as you move along the spectrum, accountability does not diminish. It becomes harder to demonstrate.

When AI is a tool the human directs, the evidence trail is relatively straightforward. The human made each decision and can account for it.

When AI prepares content, routes it through a workflow, applies checks and produces a near-final asset for sign-off, the question changes. It is no longer simply whether someone approved the promotion. It is whether the firm can show that the human who approved it understood what they were signing off, what the AI had produced and changed, what was flagged during the process and how it was resolved. The review confirms that SM&CR accountability sits with a named individual throughout, at every point on the spectrum, even as AI takes on more of a role.

The review is direct on what this requires in practice. It is no longer sufficient to say that a human is in the loop. Firms must be able to demonstrate what information the reviewer received, how they challenged the output and how escalations were handled.

That level of demonstrability does not emerge from a sign-off process alone. It requires a system that is deliberately integrated into the financial promotions workflow: one that captures what happened at each stage, records the decisions made and makes that information available without reconstruction. The governance record is only as complete as the system that builds it.

The operational challenge is scale too. The review notes that agentic AI, effectively absent from industry surveys two years ago, is now being piloted or deployed by more than half of respondents. A 2026 survey found 81% of firms are adopting AI at some level. Most financial promotions approval processes were built for lower-volume, static, human-authored content. A human writes something, it moves through a defined review sequence and it is approved. The audit trail follows naturally from the process.

That model does not hold when AI is involved in generating, adapting or checking content across a high volume of assets, especially when agentic systems are deployed. 

When a campaign produces multiple variants, when content is personalised for different audiences, when agencies and third-party tools contribute to assets before they reach a compliance review, reconstructing an evidence trail after the fact becomes unreliable. Emails are searched. People are asked to recall decisions they made weeks earlier. Documents are assembled from multiple systems.

The firms that are best placed to manage this are those that have moved away from reconstruction entirely. Evidence of control needs to be generated within the workflow itself: version histories that show exactly how content changed, named approvals with timestamps, substantiation links attached to specific claims, recorded responses to flagged issues. When that infrastructure is in place, the answer to a supervisory question about any given financial promotion is immediate. The trail exists because the system built it as decisions were made.

That requires more than an approval sign-off process. It requires a platform that manages assets, workflows and audit trails at the volume and pace that AI-enabled marketing now operates at. The governance architecture and the operational system are the same thing.

bethebrand is built for exactly that purpose. Our platform manages financial promotions workflows, approvals and asset lifecycles for regulated firms, generating a permanent audit trail as content moves through each stage of the process.

The four tests we have previously set out in our governance guide remain the right diagnostic for understanding how ready firms for an AI enabled world: visibility, deterministic enforcement, structured judgement and embedded evidence. 

The autonomy spectrum adds an important dimension to each. The question is not only whether your governance architecture satisfies those tests today, but whether it will hold as AI involvement deepens.

The direction of travel

The Mills Review makes recommendations to the FCA on how regulation should evolve. It does not create new mandates for firms now.

Its direction is directly relevant to financial promotions teams. It calls for firms and regulators to work through how SM&CR operates as AI systems become more autonomous. It identifies the approver and observer stages as the points where evidencing meaningful human control becomes most challenging. It also recommends that the FCA strengthen expectations on evidencing outcomes, with continuous monitoring displacing periodic review as AI spreads through workflows. 

Firms that build structured governance architecture now, designed for AI-influenced content at scale, will be better placed as expectations develop. The Treasury Select Committee has called for clearer guidance on AI accountability by the end of 2026. 

Our Governing AI in Financial Promotions Guide sets out the full control architecture, including the four tests and how to apply them to your financial promotions workflows. 

If you would like to discuss what this means for your firm specifically, get in touch.