A protection fact find is the most sensitive conversation a broker ever has. Someone tells you about the lump they had checked, the antidepressants, the father who died at fifty-eight. You write it down because you have to. That file note contains health data, and health data is special category data under UK GDPR, which means it carries a higher bar than anything else you handle.
Now ask yourself an ordinary question. In the last month, has any part of that conversation passed through an AI tool? A summary of the call. A tidy-up of the notes. A drafted covering letter to the insurer.
Hold that thought, because on 6 July the regulator published something that changes how you should answer it.
What the Mills Review actually is
The FCA published AI and the future of retail financial services, led by its executive director Sheldon Mills and commissioned by the FCA Board. It is a 147-page look at what AI does to this industry out to 2030, and the FCA calls it "the first work of its kind initiated by a regulator globally".
Most of the coverage has reported the reassuring half, and the reassuring half is real. The review creates no new rules. Its underpinning conclusion is that "the regulatory framework remains fit for purpose". The principles-based, outcomes-focused approach you already work under, the Consumer Duty and the Senior Managers Regime, is the approach the FCA intends to carry into an AI-enabled market.
Nor did anyone ask for a new rulebook. The review records that industry respondents "did not seek changes to this system. They wanted clarity on how to interpret and govern increasing use of AI within the existing regime."
So if you have been waiting for the FCA to tell you the rules for AI, stop waiting. It just did. The rules are the rules you already have.
That is the half that made the headlines. The other half is the one that matters to you.
The idea worth stealing from it
The review's organising insight is a spectrum, and it is defined not by what the AI does but by where the human stands.
You are an operator when AI is a tool that helps you complete a defined task. You are a collaborator when you and the machine plan and act together. You become a consultant when the AI compares options, recommends actions and prepares decisions while you give guidance. Then an approver, when the AI prepares or initiates the action and you authorise the key steps. Finally an observer, when the system acts continuously inside boundaries you set in advance, and you monitor outcomes rather than decide them.
Read those five words again, because the FCA has quietly drawn a line through the middle of them.
"existing regulatory levers continue to operate effectively at the Operator, Collaborator and Consultant stages... Complexity and pressure points emerge as AI moves to the Approver or Observer stage."
That is the whole review in one sentence. While you are still the one deciding, the framework holds comfortably. The moment the machine starts preparing the decision and you start approving it, the ground gets harder.
And here is the uncomfortable part. Most brokers assume they are operators. Summarising a call is operator work. But a tool that reads the fact find and drafts the suitability rationale is not summarising, it is preparing the decision. That is consultant work, drifting toward approver. Nobody announces the crossing. You do not get an email. You simply notice, eventually, that the first draft of your thinking is no longer yours.
Where the pressure lands
The review is blunt about the cost of that drift. Firms, it says, will need "senior managers who can evidence reasonable steps in automated environments". As AI spreads through a workflow, it warns, this "makes it more difficult to evidence how outcomes were delivered, demonstrate reasonable steps, or identify the source of errors, bias or harm".
Not harder to behave well. Harder to show that you did.
For a sole trader or a small firm, the senior manager is you. Under SM&CR you take reasonable steps to control the business, and reasonable steps are not a state of mind, they are something you can point to. The FCA's April 2024 AI Update was already explicit, at section 3.41, that this reasonable-steps duty applies to solo-regulated Core and Limited Scope firms, and that AI use falls inside it. The Mills Review has now said the same thing from the other end of the telescope: as the human role moves along that spectrum, evidencing your control gets harder, not easier.
Which brings us back to the protection fact find. It is the file where health data lives. If an AI tool touched that conversation, the question is not whether you were careful. The question is what you would show.
Where this leaves you
The shift the review describes is not about behaving worse. It is about proving you behaved well. A firm that cannot say where the human sits in its own workflow cannot evidence reasonable steps, and cannot answer a Consumer Duty question about how an outcome was reached. The difficulty the Mills Review names is precisely that: as AI spreads through the work, it is the evidence of control that gets harder to produce, not the control itself.
So the honest question is no longer "do I use AI?" It is "where on that spectrum has my role actually moved, and could I show it?" Most brokers assume they are further back, nearer operator, than they are. A tool that reads the fact find and shapes the suitability rationale has already carried them toward consultant, and nobody sends a memo when the line is crossed.
Which returns us to the protection fact find, the file where health data lives. If an AI tool touched that conversation, the review's point is not whether you were careful in the moment. It is whether, months later and under question, you could evidence where your judgement ended and the tool's began. That is the exposure the Mills Review has put a name to, and it was sitting inside the existing rules the whole time. The regulator has not changed what is required of you. It has described, more plainly than before, how much harder AI makes it to show that you met it.