Speaking at Bloomberg's UK Policy Series on Oct 19, the FCA's chief data, information and intelligence officer Jessica Rusu said: "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses. As the AI Minister has recognised, near-miss reporting for agentic AI is becoming a national security priority. It is a regulatory priority too." She said agentic systems need "continuous, conditional assurance" because "a system that is safe at deployment may behave differently at scale, under stress or as the models beneath it change". She said the FCA will work with industry, other regulators and frontier labs on a framework for agentic finance covering agent identity and delegated authority. She also urged firms to stress-test AI, plan for failure, keep fallbacks and understand supplier concentration, "including reliance on a single model". She criticized firms that "retrofit governance after technology has already been deployed".

This is a speech, not a rule change or consultation, and it sets no reporting thresholds or timelines. It points the same way as the joint NIST/NSA/CISA incident-practices paper, which defines AI control near-misses and asks for incident reporting. For UK financial firms: make sure your incident taxonomy and operational-resilience mapping already cover agent misbehavior (unauthorized actions, runaway transactions, prompt-injection-driven data exposure) and model-provider outages, so you can report them under existing rules.