SECTOR INTELLIGENCE BRIEFING, BASED ON DOCUMENTED PUBLIC EVIDENCE, RESEARCH DOCUMENT
01The Documented Picture
◈ This briefing draws exclusively on documented, publicly available evidence from UK regulators, parliamentary committees, and authoritative surveys. The predictive findings in Section 04 are inferences from this evidence base, not assertions of findings BreakPoint has made in this sector.
◈ SMCR · The central tension
Under SMCR, accountability is personal. A senior manager who certifies accountability for a process in which AI is materially influencing investment decisions, but who cannot evidence that they have exercised genuine decision-level authority over those AI outputs, does not hold accountability in any meaningful sense. They hold liability. The Treasury Select Committee made exactly this distinction in January 2026, calling on the FCA to publish guidance on the minimum expected standard of senior manager challenge to AI-influenced decisions by end of 2026. That guidance has not yet been published. Every day before it is published, liability sits in the gap.
75%
of UK financial services firms using AI in some form
BoE/FCA Survey, Nov 2024
55%
of AI use cases include automated decision-making
BoE/FCA Survey, Nov 2024
33%
of AI use cases are third-party implementations
BoE/FCA Survey, Nov 2024
0
published studies measuring PM AI override rates in UK AM
Research gap: documented absence
AI is embedded across UK asset management in three primary roles: portfolio construction and automated rebalancing (often third-party quant or factor-model tools), risk analytics and breach monitoring, and compliance surveillance and triage. In each case, the SMCR framework assigns accountability to named senior managers, the CIO, CRO, Head of Compliance, whose certification rests on governance frameworks describing human oversight. What the frameworks do not demonstrate is that the oversight is exercised at the point where AI is making or shaping material decisions.
PRA SS1/23, effective May 2024, places model risk on the same supervisory footing as credit risk. It requires independent validation, a named senior manager challenge function, and explicit governance for third-party models, including models supplied by external quant platforms. Many asset managers have interpreted SS1/23 as primarily applying to banking prudential models. The PRA does not share that interpretation.
02The Governance Gap, What the Evidence Shows
The Treasury Select Committee January 2026 report found that the current approach, assigning AI accountability to existing SMFs without specifying what genuine exercise of that accountability looks like, risks serious harm. The Committee recommended the FCA publish, by end of 2026, guidance stating the minimum expected level of senior manager challenge required for AI-influenced decisions. It also recommended AI stress-testing be incorporated into the supervisory framework. In asset management, where portfolio construction AI, risk analytics AI, and compliance surveillance AI all sit under named SMCR functions, the absence of this guidance leaves every certification in a structurally ambiguous position.
PRA Supervisory Statement SS1/23, effective May 2024, establishes that model risk must be managed with the same rigour as financial risk. It requires: an independent model validation function (not the team using the model); a named senior manager function for model risk; explicit identification of the risk owner for third-party models; and ongoing monitoring of model drift and performance degradation, not just initial validation. In asset management, third-party factor models, quant platform tools, and externally sourced risk analytics constitute a significant share of AI deployment. SS1/23 requires these to be brought under the same governance standard as internally built models. The question BreakPoint asks is whether the validation that has been performed meets the SS1/23 standard of independence, or whether it is peer review within the team that uses the model.
84% of surveyed firms report having a named accountable person for their AI framework. This is widely cited as a positive governance indicator. It is not. Having someone named for the framework, who certifies the policy document and the governance structure, is categorically different from having someone who can evidence that they exercised decision-level challenge to specific AI-influenced outcomes. SMCR does not ask whether you have a framework. SMCR asks whether you have a person who exercised accountability. In a framework-level certification, if the AI is wrong and the outcome is harmful, the named person's accountability defence is a document. That is insufficient under SMCR, and the Treasury Select Committee's 2026 report confirms the FCA will need to say so explicitly.
MiFID II Article 27 requires firms to take all sufficient steps to obtain the best possible result for clients when executing orders. Best execution is a continuing obligation, it applies at the point of execution, not only in the review of outcomes. Where AI execution algorithms determine the timing, venue, and routing of orders, and where human oversight operates through post-execution TCA (Transaction Cost Analysis) review, there is a structural gap: no named human authority at the pre-execution stage. Post-execution monitoring identifies when best execution was not achieved. It does not constitute the exercise of authority over the decision that determined whether it was achieved. The FCA has noted this gap in guidance without resolving it.
The FCA has confirmed that Consumer Duty applies where AI shapes decisions affecting retail investors, including in asset management contexts where retail-facing model portfolios or fund products are delivered through advised platforms. The FCA AI Update 2024 confirms that no AI-specific rules apply, existing frameworks govern. This means Consumer Duty accountability for AI-influenced outcomes sits with the firm without additional regulatory specificity about what "good AI governance for retail outcomes" looks like. That is an accountability obligation the sector is holding without a clear compliance standard to work to.
03The Regulatory Framework
FCA SM&CR
Named senior managers accountable for AI-active processes. Treasury Select Committee has called for minimum challenge standard guidance by end 2026. Currently, framework certification accepted, but insufficient under SMCR's accountability standard.
CIO (portfolio AI), CRO (risk analytics AI), Head of Compliance (surveillance AI). Framework-level certification vs. decision-level exercise is the documented gap.
PRA SS1/23 (May 2024)
Model risk managed as financial risk. Independent validation required. Named senior manager. Third-party model risk explicitly in scope. Model drift monitoring required, not just initial sign-off.
Third-party quant/factor models. Externally sourced risk analytics. Compliance AI where model logic influences triage. Any AI where validation was performed by the using team, not an independent function.
MiFID II Article 27 (UK)
Best execution at point of execution. AI execution algorithms must operate under human authority that constitutes genuine pre-execution oversight, not post-execution review.
Algorithmic order execution. Venue selection AI. Any AI-driven routing where TCA review is the primary governance mechanism, without pre-execution authority.
FCA Consumer Duty (retail scope)
Outcomes for retail investors must be demonstrably good. AI-influenced model portfolio or fund construction in scope where retail investors are end beneficiaries. No AI-specific rules, Consumer Duty applies.
Retail model portfolios. AI-influenced asset allocation in retail-facing funds. AI used in selection or monitoring of assets in retail-accessible vehicles.
04What BreakPoint Would Predict
Epistemic note: The following are indicative and predictive inferences from the documented evidence base above - not assertions of findings BreakPoint has made in this sector. Each prediction identifies a specific gap type that the evidence strongly suggests is present. BreakPoint's role is to determine, for a specific organisation, whether the gap exists and its severity. Note that BreakPoint is not limited to these factors however, and will often surface unexpected risks or risks that were not fully articulated.
Every asset manager with SMCR since 2019 has a named senior manager certifying accountability for AI-active processes. The governance documentation is, by now, well-constructed. What it does not contain, and cannot contain, because it does not exist, is an evidentiary record of that senior manager exercising decision-level authority over specific AI-influenced outcomes. The certification says "I am accountable." The evidentiary standard SMCR implies, and which the Treasury Select Committee has now explicitly called for the FCA to specify, is "I can demonstrate I exercised accountability at the point where AI was making decisions." Those are not the same thing.
Evidence basis: FCA SM&CR; Treasury Select Committee Jan 2026 (SMCR accountability standard for AI harm guidance called for); BoE/FCA Survey 2024 (84% framework accountability, cited as positive, is structurally insufficient).
Portfolio managers in AI-assisted construction environments receive AI recommendations, factor model outputs, or pre-rebalanced portfolio proposals. Their professional judgement then applies, but it applies to a set of options and weightings the AI has already shaped. Genuine independent assessment would require the portfolio manager to form an investment view from first principles before consulting AI output, and then test AI output against that prior view. No firm has documented this sequence as standard operational practice. The AI input comes first; the human assessment follows. This is not independent assessment; it is AI-anchored assessment.
Evidence basis: PRA SS1/23 (independent challenge required at model level); BoE/FCA Survey 2024 (55% automated decision-making; 33% third-party models); BoE/FCA Survey 2024 (46% partial understanding, including of the models shaping portfolio construction).
MiFID II Article 27 places best execution as an obligation at the point of execution. In the vast majority of AI execution environments, the human control mechanism is post-execution TCA review, which identifies when best execution was not achieved, not who held authority over the decision that determined the outcome. TCA is an audit trail. It is not an authority structure. There is, in almost every AI-driven execution environment, no named individual whose role is to exercise pre-execution authority over the AI's routing, timing, and venue decisions. The governance framework describes best execution as a firm obligation. The operational reality is that AI makes the execution decision and humans review the outcome.
Evidence basis: MiFID II Article 27 (best execution continuing obligation); BoE/FCA Survey 2024 (automated decision-making in investment processes); FCA AI Update 2024 (no AI-specific rules, MiFID II applies).
AI surveillance and compliance triage tools classify potential breaches, rank them by severity, and present a prioritised queue for human review. Human compliance officers then investigate the items the AI has surfaced. What they do not do, because the workflow does not require or support it, is challenge the AI's classification framework itself: whether the categories are right, whether the thresholds are calibrated, whether the AI is systematically missing a class of breach because its training data doesn't represent it. The compliance function's accountability under SMCR includes accountability for the framework within which AI is triaging. Exercising that accountability requires a named challenger to the classification model, not a reviewer of the model's outputs.
Evidence basis: FCA SM&CR (compliance accountability); PRA SS1/23 (model challenge independent of using team); Treasury Select Committee Jan 2026 (accountability for AI-shaped harm must be evidenced); FCA Consumer Duty (in scope for retail-facing funds).
PRA SS1/23 requires independent validation, meaning validation performed by a function that does not benefit from the model performing well. In many asset management firms, model validation is performed by the quantitative research team or a model oversight committee that includes the portfolio management team. This is not independent validation under SS1/23; it is peer review. The condition is not that validation has not occurred, it almost certainly has. The condition is whether the validation performed meets the structural independence requirement the PRA has now specified, or whether SS1/23 requires a revision of the validation function.
Evidence basis: PRA SS1/23 effective May 2024 (independent validation function; third-party model risk; named senior manager for model risk); BoE/FCA Survey 2024 (33% third-party models, SS1/23 applies to these explicitly).
05Source References
BoE/FCA 2024
Bank of England / FCA,
Artificial Intelligence in UK Financial Services 2024, November 2024.
bankofengland.co.uk →Treasury Committee 2026
House of Commons Treasury Select Committee,
Artificial Intelligence in Financial Services, January 2026. Recommendations include FCA SMCR minimum challenge standard guidance for AI harm, and AI stress-testing incorporation.
parliament.uk →PRA SS1/23
PRA,
Supervisory Statement SS1/23: Model Risk Management Principles for Banks, effective May 2024. Model risk on a par with credit risk. Independent validation, named senior manager, third-party model risk in scope.
bankofengland.co.uk →MiFID II Art 27
MiFID II Article 27, Best execution obligation. Continuing duty at point of execution. Retained in UK law. FCA COBS 11.2A implements domestically. Post-execution TCA review does not discharge pre-execution authority obligation.
FCA SM&CR
FCA Senior Managers and Certification Regime (SM&CR). No dedicated AI Senior Manager Function. AI accountability sits within existing SMFs. Treasury Select Committee 2026 calls for minimum standard guidance by end of 2026.
FCA AI Update 2024
FCA,
AI Update, 2024. No AI-specific rules. Consumer Duty, SM&CR, and existing conduct frameworks govern AI. Confirms FCA is monitoring and will engage sector.
fca.org.uk →FCA Consumer Duty
FCA, Consumer Duty Final Rules and Guidance, PS22/9, July 2022. Effective July 2023. Applies to AI-influenced investment decisions affecting retail investors. Outcomes-based: framework description of human oversight is insufficient evidence of good outcomes.
Luminary Diagnostics · BreakPoint: AI Control Gap Assessment
SMCR says accountability is personal.
AI says execution is automated.
Something has to give - and right now, it's the accountability.
BreakPoint determines whether SMCR-certified accountability is exercised at decision level or asserted at framework level. The difference is the difference between accountability and liability.
Book a BreakPoint conversation →