Transcript: Regulatory focus on frontier AI and cyber risk

Transcript

Hugo Rousseau: The FCA published a multi-firm review on frontier AI and cyber resilience, while the Bank of England published reflections from its Frontier AI Information Sharing Forum on 2 September 2026.

The FCA found that vulnerability discovery is accelerating faster than firms’ ability to respond, increasing pressure on remediation processes. It also highlights frontier AI as a test of organisational resilience - whether firms have the governance, risk ownership and engineering capacity to act effectively on AI-generated findings.

The Bank of England stresses that firms need to look beyond the underlying model to the wider AI 'harness' - the tools, data, permissions, workflows and controls that determine what the model can access and do.

Both publications highlight the need for human oversight and adapting vulnerability management and operational resilience processes as frontier AI capabilities evolve.

This is not just a UK or firm-level issue. There is also increasing international attention to the potential financial stability and systemic implications.

The Financial Stability Board Chair, Andrew Bailey, warned G20 Finance Ministers and Central Bank Governors in a letter on 31 August 2026 that, among the implications of frontier AI for the financial system, its potential impact on cyber risk is the most immediate concern. He highlighted the potential for frontier AI to increase the speed and scale of cyber threats and create wider risks through critical third-party providers.

While these publications do not introduce new regulatory requirements, they signal growing regulatory focus on frontier AI and cyber. Firms need to assess the full AI environment around the model, stress-test their vulnerability management and remediation capacity, and strengthen governance, human oversight and third-party resilience.Looking ahead, by the end of 2026, the FCA plans to publish examples of good and poor practice for AI, while the Bank of England intends to consult on the management of ICT and cyber risks. They are also expected to continue engaging with industry on frontier AI and cyber risk.