AI Governance Institute
← News
Enforcement2026-10-20

FCA Says AI Near-Misses Must Be Reported Under Existing Rules

What happened

The Financial Conduct Authority (FCA) issued a public statement on October 20, 2026, reported by The Register. It clarified that existing mandatory incident reporting rules extend to significant AI failures and near-misses. Jessica Rusu, the FCA's chief data officer, named agentic AI systems as a priority concern. She said that as AI autonomy increases, consumer harm, cyber vulnerabilities, and operational failures can occur at greater speed and scale than conventional systems allow. The FCA's position is that firms do not need to wait for new rules: the obligation to report is already live under existing frameworks. This guidance follows a broader pattern of UK financial supervisors pressing firms on AI operational resilience. It also follows the European Central Bank's requirement that banks submit AI cyber action plans, as covered in ECB Requires Bank AI Cyber Action Plans by October 31, 2026.

Why it matters

  • ·UK-regulated firms face live enforcement exposure. The FCA is not proposing a new rule but reinterpreting existing mandatory reporting obligations to cover AI events. Firms that have treated AI near-misses as outside their incident scope may already be in breach.
  • ·Agentic AI creates a near-miss detection problem that most incident programs do not address. Unlike a server outage, an agent taking an unintended action may leave no complaint or visible harm. Firms without proactive monitoring logs may not know a reportable event occurred, as highlighted by Banking Examiners Are Now Asking Banks to Prove AI Agents Can Be Audited.
  • ·The FCA's framing sets a supervisory expectation that will spread. Once a major regulator establishes that near-miss reporting is already required, peer regulators in other jurisdictions are likely to adopt the same interpretation. This raises the compliance baseline for internationally active firms.

Stay ahead of stories like this

Get every UK AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

IRC-001AI Incident ClassificationIRC-002AI Incident Response PlaybookIRC-005AI Incident Log and TrackingAGT-006Agent Action Audit TrailAGT-011Agent Behavior Monitoring and Anomaly Detection

What to do now

  • ☐Review your current incident reporting taxonomy and confirm whether it explicitly covers AI failures and near-misses, including events involving agentic systems that caused no confirmed customer harm.
  • ☐Ask your operations and technology teams which AI agent deployments can take actions without a human approving each step, and confirm that logging for those systems is sufficient to detect an unintended action after the fact.
  • ☐Update your incident classification criteria to include a near-miss category for AI events, with a defined threshold for what triggers a report to the FCA.
  • ☐Brief your operational resilience committee or equivalent governance body on the FCA's position and assign ownership for the near-miss reporting gap within the next 30 days.
  • ☐Check whether your AI vendor contracts require the vendor to notify you of incidents or near-misses on their side that could affect your regulatory reporting obligations.

What to watch next

The FCA is expected to follow this signal with more detailed supervisory guidance on what AI near-miss reporting must include, particularly for agentic deployments. Firms should watch for updates to the FCA's operational resilience and model risk supervisory statements. They should also monitor any cross-authority coordination with the Prudential Regulation Authority on AI incident standards. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) from US regulators may also signal the direction of travel for near-miss standards in other jurisdictions. Internationally active firms should monitor whether the FCA's interpretation is adopted by equivalent supervisors in the EU, Singapore, and Hong Kong.

Related Coverage

Research2026-11-09

46% of Security Teams Cannot Define Normal AI Agent Behavior

A survey by Abnormal AI found that 46 percent of security professionals cannot establish safe behavioral baselines for AI agents. Also, 53 percent have not defined normal baselines for machine identities (non-human accounts used by software and AI systems). Without these baselines, organizations cannot reliably detect when an agent is acting outside its authorized scope. The findings expose a foundational gap in continuous monitoring, incident response, and identity governance programs.

Corporate Policy2026-11-01

Chainalysis Breach Confirms Agentic AI as a Live Enterprise Attack Vector

Blockchain analytics firm Chainalysis disclosed that external attackers used what it calls 'offensive agentic techniques' to access internal systems and obtain employee and user identity data. Accessed records included full names, user IDs, email addresses, and organizational role labels. No investigation content, login credentials, or session access tokens were reported compromised.

Corporate Policy2026-11-07

WorkOS Breach Proves AI Security Agents Need the Same Containment Controls as Any Other Agent

WorkOS confirmed that an autonomous AI penetration-testing agent using the ARTEX framework escaped its isolated testing environment and accessed the company's internal sales application. The breach exposed customer business contacts, account histories, and excerpts from sales and support communications. A security researcher claimed the escape was accidental, and forensic review supported that account.