FCA to extend incident reporting rules to AI near-misses, ahead of Parliament's own plan

The UK's Financial Conduct Authority plans to stretch its existing incident reporting rules to cover AI failures and near-misses, a move that would turn informal lessons-learned conversations into mandatory disclosures with regulatory consequences attached.

Jessica Rusu, the FCA's chief data, information and intelligence officer, set out the plan at Bloomberg's UK Policy Series on Monday. "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses," she said, adding that "poorly governed AI can create consumer harm, cyber vulnerabilities, and operational failures, potentially at much greater speed and scale."

The mechanism is not new. The FCA already compels regulated firms to flag major operational incidents under its existing rulebook. What changes is scope: near-misses involving autonomous or agentic AI systems, events where no customer was harmed but a system acted outside its intended bounds, would become reportable in the same way a payments outage or data breach already is. Rusu framed the extension as a response to AI systems gaining autonomy faster than firms' governance structures have adapted.

That timing matters because the obligation would arrive before Parliament has settled a parallel, harder-edged version of the same idea. AI minister Kanishka Narayan told MPs last week that the government is examining whether to strengthen the Cyber Security and Resilience (Network and Information Systems) Bill with provisions for identifying and reporting serious AI incidents and near-misses, including risks to essential services. Alexandra Jones, Director General for Growth, Science and International at the Department for Science, Innovation and Technology, told the same committee that amendments remain under consideration rather than confirmed, leaving open whether AI-specific reporting ends up as a statutory duty under the Bill or stays a sector-specific requirement enforced by the FCA alone.

That gap leaves financial firms facing two possible reporting regimes with different triggers, timelines and enforcement routes, one rooted in FCA supervisory rules and one that could eventually sit in primary legislation. Narayan described near-miss reporting for agentic AI as a national security priority, not just a financial-stability one, which raises the question of which regulator firms would need to notify first if an incident touches both categories.

Steven Adler, co-founder and chief scientist of the nonprofit Guidelight AI Standards, pointed MPs to aviation as a model worth copying. "The way this works in aviation is that you not only want to learn about the serious crashes where someone has in fact died; you want to learn about the near-misses, because you can learn from those and help avoid them in the future," he told the committee last week.

The push follows a January report from the House of Commons Treasury Committee, which told financial regulators to run stress tests confirming firms can withstand AI-driven market shocks and called for clear lines of accountability when AI systems produce harmful or unfair outcomes. Rusu's comments suggest the FCA intends to answer that accountability question through its incident reporting regime rather than through new primary rulemaking, at least for now.

Financial services contributed £223.6 billion to the UK economy in 2025, 8 percent of national output and the fourth-highest share among OECD countries, a scale that explains why the FCA is moving to codify near-miss reporting even as Parliament has not yet decided whether to back it with statutory force.