Frontier AI and cyber resilience for financial services

The FCA published its frontier AI and cyber resilience multi-firm review on 2 September 2026. It summarizes observations reported by firms and expressly states that it does not introduce new rules, guidance, or regulatory expectations. Firms should use it as a current view of emerging operational practice, not mislabel it as a new legal obligation.

PS26/2 is different. Published in March 2026, it establishes final FCA rules and guidance for operational-incident and material third-party reporting. The regime applies from 18 March 2027 to the firms specified in the policy statement. Scope differs between incident reporting and third-party reporting, so firms need a legal-entity assessment.

The FCA reports that frontier AI is accelerating vulnerability identification, validation, and prioritization faster than some firms can respond. More findings do not create resilience when validation, ownership, remediation, testing, and change implementation remain constrained.

This changes the risk question. Firms must test how a continuous increase in findings affects people, engineering queues, emergency change, evidence of closure, supplier coordination, and the continued delivery of important business services.

The FCA uses harness engineering to describe the environment, controls, and processes around a model that make outputs useful, safe, and reliable. Firms told the FCA that value depends less on the model alone than on technical and organizational context.

For vulnerability work, the harness should connect model output to assets, dependencies, important business services, existing controls, exposure, exploitability, validation evidence, remediation ownership, and change constraints. It should restrict permissions and sensitive access, require approval for higher-risk actions, and retain complete traces.

A controlled stress test should increase plausible and validated findings without exposing production systems to uncontrolled action. The objective is to locate the first constraint in validation, triage, engineering, patch testing, supplier response, change approval, and closure evidence.

Model the service impact of remediation as well as the impact of the vulnerability. Accelerated change can itself create outages, regressions, or control failures. The exercise should preserve normal incident, operational resilience, and change-management authority.

The FCA reports that frontier models can connect multiple lower-rated weaknesses into alternative paths to compromise. Traditional severity ratings remain useful, but firms need service and attack-path context to make proportionate decisions.

Frontier AI can expose weaknesses in asset mapping, access management, dependency mapping, risk ownership, and remediation. A firm that cannot connect a finding to an owner and important business service will produce faster uncertainty, not faster resilience.

Use targeted deployments to test organizational readiness. The FCA reports that some firms use bounded use cases to identify constraints in post-discovery validation, remediation ownership, change absorption, and the ability to distinguish theoretical weaknesses from credible exploitation.

The Bank of England and FCA's 2024 survey found that one third of reported AI use cases were third-party implementations. The top three providers represented 73% of named cloud providers, 44% of model providers, and 33% of data providers. The survey also found critical third-party dependency was expected to be the fastest-growing systemic AI risk.

Ask key suppliers how they use AI-enabled vulnerability discovery, validate and prioritize findings, notify customers, handle accelerated patch volumes, coordinate shared dependencies, and preserve evidence. Assess what happens when several suppliers and internal teams face the same vulnerability wave.

PS26/2 defines operational incidents and reporting thresholds, introduces a standardized reporting process, and provides standard and enhanced reporting routes. For material third-party arrangements, it requires firms within scope to notify the FCA of new arrangements and significant changes, maintain a register, and submit it annually.

Do not build the reporting process only around cyber tooling. Connect operational resilience, incident management, third-party inventory, legal entities, business services, materiality decisions, regulatory reporting, and governance. Use the FCA's policy statement, finalised guidance, and templates as the authoritative implementation sources.

The FCA observes that senior leaders may need clearer visibility of how frontier AI affects remediation capacity, operational resilience, risk, and the continued delivery of important business services. Reporting should show whether the firm's response system can absorb discovery volume, not celebrate the number of findings produced.

Keep experimentation bounded until the firm can show that findings are valid, access is controlled, remediation can keep pace, important services remain protected, and incidents can be contained and reported. Model capability should expand only with demonstrated operating capacity.