A protection fact find is the most sensitive conversation a broker ever has. Someone tells you about the lump they had checked, the antidepressants, the father who died at fifty-eight. You write it down because you have to. That file note contains health data, and health data is special category data under UK GDPR, which means it carries a higher bar than anything else you handle.
Now ask yourself an ordinary question. In the last month, has any part of that conversation passed through an AI tool? A summary of the call. A tidy-up of the notes. A drafted covering letter to the insurer.
Hold that thought, because on 6 July the regulator published something that changes how you should answer it.
What the Mills Review actually is
The FCA published AI and the future of retail financial services, led by its executive director Sheldon Mills and commissioned by the FCA Board. It is a 147-page look at what AI does to this industry out to 2030, and the FCA calls it "the first work of its kind initiated by a regulator globally".
Most of the coverage has reported the reassuring half, and the reassuring half is real. The review creates no new rules. Its underpinning conclusion is that "the regulatory framework remains fit for purpose". The principles-based, outcomes-focused approach you already work under, the Consumer Duty and the Senior Managers Regime, is the approach the FCA intends to carry into an AI-enabled market.
Nor did anyone ask for a new rulebook. The review records that industry respondents "did not seek changes to this system. They wanted clarity on how to interpret and govern increasing use of AI within the existing regime."
So if you have been waiting for the FCA to tell you the rules for AI, stop waiting. It just did. The rules are the rules you already have.
That is the half that made the headlines. The other half is the one that matters to you.
The idea worth stealing from it
The review's organising insight is a spectrum, and it is defined not by what the AI does but by where the human stands.
You are an operator when AI is a tool that helps you complete a defined task. You are a collaborator when you and the machine plan and act together. You become a consultant when the AI compares options, recommends actions and prepares decisions while you give guidance. Then an approver, when the AI prepares or initiates the action and you authorise the key steps. Finally an observer, when the system acts continuously inside boundaries you set in advance, and you monitor outcomes rather than decide them.
Read those five words again, because the FCA has quietly drawn a line through the middle of them.
"existing regulatory levers continue to operate effectively at the Operator, Collaborator and Consultant stages... Complexity and pressure points emerge as AI moves to the Approver or Observer stage."
That is the whole review in one sentence. While you are still the one deciding, the framework holds comfortably. The moment the machine starts preparing the decision and you start approving it, the ground gets harder.
And here is the uncomfortable part. Most brokers assume they are operators. Summarising a call is operator work. But a tool that reads the fact find and drafts the suitability rationale is not summarising, it is preparing the decision. That is consultant work, drifting toward approver. Nobody announces the crossing. You do not get an email. You simply notice, eventually, that the first draft of your thinking is no longer yours.
Where the pressure lands
The review is blunt about the cost of that drift. Firms, it says, will need "senior managers who can evidence reasonable steps in automated environments". As AI spreads through a workflow, it warns, this "makes it more difficult to evidence how outcomes were delivered, demonstrate reasonable steps, or identify the source of errors, bias or harm".
Not harder to behave well. Harder to show that you did.
For a sole trader or a small firm, the senior manager is you. Under SM&CR you take reasonable steps to control the business, and reasonable steps are not a state of mind, they are something you can point to. The FCA's April 2024 AI Update was already explicit, at section 3.40, that AI use falls inside that responsibility. The Mills Review has now said the same thing from the other end of the telescope: as the human role moves along that spectrum, evidencing your control gets harder, not easier.
Which brings us back to the protection fact find. It is the file where health data lives. If an AI tool touched that conversation, the question is not whether you were careful. The question is what you would show.
What to do about it, starting this week
What you can control is knowing where you stand on that spectrum, because everything else follows from it. A firm that cannot say where the human sits cannot evidence reasonable steps, and cannot answer a Consumer Duty question about outcomes.
So here is the one thing to do, and it takes twenty minutes.
Write down every AI tool you use, and next to each one, name the human role: operator, collaborator, consultant, approver or observer. Be honest about it. If a tool drafts something a client eventually reads, you are not an operator, whatever you have been telling yourself. If you cannot decide between two words, write both and note why the boundary is unclear, because that ambiguity is precisely the exposure.
That list is not a compliance document. It is the map you need before you can write one. Most brokers have never drawn it, and the ones who do are usually surprised by how far along the spectrum they already are.
Getting from that map to something you could hand a regulator, a policy that genuinely holds, the vendor checks that matter, the audit trail you will still be keeping in six weeks, is a longer job, and a fiddlier one than it looks. That is the gap I am building for. Stay subscribed and you will be first to know when it lands.
For now, draw the map. Twenty minutes, one sheet of paper. Then look at the protection files and ask the question this article opened with, knowing what the answer needs to be.