FCA Wants AI Failures and Near-Misses Added to Incident Reporting

TL;DR

• The UK’s Financial Conduct Authority says its existing major incident reporting rules must extend to significant AI failures and near-misses.
• The push is tied to financial firms adopting more autonomous AI agents, which the FCA says can cause harm at greater speed and scale.
• Financial services contributed £223.6 billion to the UK economy in 2025, or 8 percent of national output.
• The UK government hasn’t yet committed to AI-specific measures in the Cyber Security and Resilience (Network and Information Systems) Bill.

The FCA wants close calls on the record

The FCA’s message is simple. Firms already have to report major incidents, and the regulator wants that duty stretched to cover significant AI failures and near-misses. According to The Register, Jessica Rusu, the FCA’s chief data, information and intelligence officer, made the case at Bloomberg’s UK Policy Series.

Her words were direct: “Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses.” She also tied it to government thinking, noting that the AI Minister has recognised near-miss reporting for agentic AI as a national security priority. “It is a regulatory priority too,” the speech continued.

The reasoning is about speed. The FCA’s line was that poorly governed AI can create consumer harm, cyber vulnerabilities and operational failures, “potentially at much greater speed and scale.” A human error tends to stay local. An autonomous agent making the same mistake can repeat it thousands of times before anyone looks up.

UK AI Minister Kanishka Narayan has previously said the government plans to strengthen reporting regimes for serious AI incidents and near misses. So the regulator and the minister are, at least in rhetoric, pulling the same way.

Why near-misses are the real story

Reporting a disaster is the easy part. Everyone knows when a bank’s systems fall over or customers get hurt. The harder, more useful question is what happened the other 99 times when an AI agent nearly did something awful and somebody caught it.

That’s what makes this proposal more interesting than a routine compliance tweak. Counting only major failures is like mapping potholes using only the cars that lost an axle. You’d know where the worst damage happened, but you’d miss the stretch of road that’s been quietly shredding tyres for months. Near-miss data is the tyre-shred map.

The source also carries an aviation comparison, and it’s a good one. Aviation learns from the crashes, but it also wants to hear about the close calls, because those can be studied and prevented before anyone gets hurt. Finance is being asked to adopt the same habit.

I’ve sat through enough post-incident reviews to know the near-miss is where the honest information hides. Nobody wants to file one. That’s precisely why a regulator has to ask.

But a few awkward questions sit underneath. Who decides what counts as “significant”? What exactly is a near-miss for an AI agent: a bad output that got caught, a transaction that got blocked, a model that drifted? The material available so far doesn’t answer any of that, and the definitions will decide whether this becomes a useful safety signal or a pile of defensive paperwork.

There’s a cultural cost too. Firms that fear regulatory heat for admitting close calls will under-report them. A regime that punishes candour gets silence. Would you volunteer your own near-misses if the reward was extra scrutiny?

And there’s the accountability angle. The FCA’s framing, alongside the wider push for clearer accountability as AI agents get more autonomous, suggests the regulator wants a named human answerable when software acts on its own. Reporting is the first step toward that. It makes the failure visible, and visibility is what makes blame, and fixes, possible.

Where this sits in UK policy

This isn’t coming out of nowhere. In January 2026, the House of Commons Treasury Committee called on financial regulators to run stress tests for AI-driven market shocks and to set clear lines of accountability. The FCA’s comments on reporting fit neatly alongside that pressure.

The stakes explain the attention. UK financial services contributed £223.6 billion to the economy in 2025, which is 8 percent of national output and fourth highest among OECD countries. When a sector that size starts handing decisions to autonomous agents, regulators don’t get to wait for the first spectacular failure.

The legislative picture is less settled. The UK government has yet to commit to adding AI-specific measures to the Cyber Security and Resilience (Network and Information Systems) Bill, though amendments remain under consideration. So the FCA is signalling a direction through its own incident reporting expectations while the wider law is still undecided.

It’s worth keeping the status clear. This is a regulator stating that existing rules must extend, not a published rulebook with thresholds, templates and deadlines. The details we have don’t include a start date or penalties.

Three things to track from here

First, watch for definitions. If the FCA publishes guidance on what counts as a significant AI failure or a near-miss, that’s the moment this stops being a speech and starts being a compliance project for every firm running AI agents.

Second, keep an eye on the Cyber Security and Resilience (Network and Information Systems) Bill. Amendments are under consideration, and whether AI-specific measures land there will show how far government is willing to back the regulator’s stance with statute.

Third, listen for how firms respond. Quiet acceptance, or loud complaints about burden and confidentiality, will tell you how much near-miss data they’re prepared to hand over. And if the Treasury Committee’s earlier call for AI stress tests gets a formal answer, expect reporting and testing to be discussed together.