Bank of England elevates frontier AI risk: no new rule, stronger resilience signal

What changed on 30 September

The FPC has moved frontier AI from a general technology concern into its current assessment of interconnected financial-system risks. It calls on firms to prepare for AI-related cyber and operational disruption and to engage with regulatory, NCSC and sector guidance. The record does not name a provider or make an enforcement finding about any particular incident.

The Bank's 2026 H2 Systemic Risk Survey reinforces that signal. Sixty-three per cent of respondents cited risks surrounding AI among their five greatest potential risks to the UK financial system, up 32 percentage points from the previous survey and making AI the third most cited category. Thirty-seven per cent cited AI among the risks most challenging for their firm to manage, while 32 per cent included it among those most likely to materialise.

Those figures describe respondents' perceptions. They are not the Bank's probability forecast, an estimate of expected loss or proof that an AI event will occur. Geopolitical risk and cyberattack remained the two most frequently cited risk categories.

The FPC also records a financing channel. It cites external analyst estimates that global AI-related debt issuance had reached about $450 billion by early September and that AI hyperscalers accounted for 47 per cent of sterling corporate-bond issuance so far in 2026. These are analyst estimates reported in the FPC record, not a new regulatory threshold or a Bank certification of individual issuers.

Andrew Bailey argues that society should retain an effective ability to intervene as frontier systems become more capable. His proposed starting point is rigorous testing before and after deployment, combined with learning from incidents and near misses. He expressly says testing is not a complete solution and that a formal regulatory framework may emerge later. His suggestion that testing could eventually be codified into standards is therefore a future possibility, not a standard in force.

What is already binding in the UK

The 30 September publications build on an existing regime. A May 2026 joint statement by the Bank, FCA and HM Treasury says regulated firms and financial-market infrastructures need to plan for frontier-AI cyber risk through governance, vulnerability management, third-party controls, protection, response and recovery. The statement expressly says it does not introduce new expectations; it reinforces existing messages as the operating environment becomes more complex.

For firms within scope, operational-resilience rules and expectations are technology-neutral. PRA Supervisory Statement 1/21 covers important business services for which firms are required to set impact tolerances. The corresponding FCA framework requires in-scope firms to identify important business services, set tolerances and test their ability to remain within them. Calling an outage or unsafe action an 'AI incident' does not place it outside that framework.

PRA Supervisory Statement 2/21 sets expectations for PRA-regulated firms' compliance with outsourcing and third-party risk requirements. Its current version covers matters including data security, business continuity and exit planning. The statement is supervisory guidance and expectations; the underlying PRA Rulebook requirements and other applicable rules must be identified separately.

The UK's Critical Third Parties regime can impose direct resilience duties on providers designated by HM Treasury. It does not automatically regulate every model developer, cloud provider or AI startup. The regime complements rather than replaces the responsibilities of regulated firms to manage outsourcing and third-party risk.

New FCA, PRA and Bank operational-incident and material-third-party reporting regimes were published in March 2026 but are due to apply from 18 March 2027. Firms in scope should prepare now; it would be inaccurate to describe those reporting rules as already in force on 1 October 2026.

The EU position remains separate

For EU financial entities, the Digital Operational Resilience Act is already binding. DORA addresses ICT risk management, incident management and reporting, resilience testing and ICT third-party risk. Its scope includes a wide range of technology services, including software, data analytics, cloud and data-centre services.

Many DORA obligations fall on the regulated financial entity, but they affect suppliers through due diligence, contractual terms, audit and access rights, incident cooperation, testing, subcontracting controls and exit arrangements. Direct EU oversight applies to ICT third-party providers designated as critical under DORA, not to every AI supplier.

The EU AI Act is another, separate analysis. Whether its provider, deployer, general-purpose-model or high-risk-system obligations apply depends on the system, intended purpose, role and market. Nothing in the Bank of England publications classifies a product under the AI Act or proves conformity with it.

Practical actions for AI founders and financial-sector suppliers

1. Map the service dependency. Identify the regulated customer, jurisdictions, important business service or critical function supported, data and systems reached, transaction or decision affected, and maximum tolerable disruption. Do not rely on the label 'copilot' or 'experimental' if the system is operationally important.
2. Define the authority of every agentic function. Use allowlisted systems and actions, unique identities, least privilege, short-lived credentials and human approval for payments, trading, authentication, privilege changes, production writes and changes to security controls.
3. Test before and after deployment. Cover prompt injection, model and tool failure, compromised credentials, unsafe autonomous action, data leakage, supplier outage, latency, model update, rollback, recovery and degraded manual operation. Record the model, version, safeguards, environment, results, limitations and remediation.
4. Treat near misses as evidence. Preserve reconstructable logs of instructions, tool calls, policy decisions, approvals, external connections, data transfers, errors and overrides. Define who can stop the service and exercise that mechanism under realistic conditions.
5. Prepare a financial-services assurance pack. Include architecture and data flows, sub-processors and important nth parties, hosting locations, security controls, evaluation evidence, recovery objectives, service levels, incident history, change-management process, business-continuity evidence and exit support.
6. Contract for resilience, not only performance. Address rapid incident notice, evidence preservation, regulatory cooperation, audit and testing, vulnerability remediation, material changes to models or safeguards, subcontracting, data return or deletion, portability, transition assistance and continued service during exit.
7. Assess concentration and substitutability. Identify common dependencies across models, cloud, identity, data and tooling; test a supplier or regional outage; maintain a safe fallback; and confirm that configurations, logs and necessary data can be exported in usable form.
8. Prepare for the March 2027 UK reporting regime if your customer is in scope. Agree now how the supplier will provide information needed for incident reports, third-party registers and notifications of new or materially changed arrangements.
9. Keep regulatory claims narrow. Do not describe the FPC record, the Governor's article, participation in a sector forum or successful testing as regulatory approval. Map UK operational resilience, DORA, data protection, cybersecurity and the AI Act separately.

The compliance conclusion

The immediate development is supervisory direction, not a new AI statute. The Bank has made clear that frontier-model capability, agentic behaviour, cyber risk, operational dependencies and AI financing now sit within its financial-stability analysis.

It is reasonable to expect this to sharpen supervisory questions and procurement evidence for financial-sector AI. That is an inference from the FPC's assessment and existing rules, not a new obligation announced on 30 September. Suppliers that can demonstrate bounded authority, rigorous testing, incident evidence, recoverability and workable exit will be better placed to answer those questions.