AI autonomy spectrum: the FCA's five levels explained

Where the spectrum comes from

On 6 July 2026 the FCA published the Mills Review, its 147-page look at how AI could reshape retail financial services by 2030 and beyond. It was led by Sheldon Mills, an FCA executive director, at the request of the FCA Board. Its central device is the AI autonomy spectrum: five levels that describe how far a system has taken over work a person used to do.

The spectrum does not grade how clever a model is. The Review says it "should be understood through the changing role of the human". Each level is named after what the person does, not what the machine does. That choice matters for compliance, because the FCA's rules are written around people: who decides, who approves, who is accountable.

The spectrum is an analytical lens, not a rule. The FCA has said its approach to AI is principles-based and focused on outcomes, and that it relies on existing frameworks such as the Consumer Duty and the Senior Managers and Certification Regime. But it is now the vocabulary in which the regulator thinks about AI, and firms that classify their systems against it will be speaking the same language as their supervisor.

The five roles of the human

L1: human as operator

AI supports on demand. It is mainly a tool that helps a person understand, analyse or complete a defined task, and the person carries out the next step. The Review's consumer example is a tool that summarises product terms. Inside a firm, think of a complaints handler asking a model to summarise a long case file. The risks the Review names here are accuracy, evidence and appropriate reliance.

L2: human as collaborator

Human and AI plan and act together, iterating on the same piece of work. The Review's example is comparing savings products with user input and refinement; in a compliance team it might be drafting a gap analysis with a model and refining it over several rounds.

L3: human as consultant

AI leads and the human gives guidance. The system compares options and recommends, and the person decides. The Review's illustration from risk and compliance is AI recommending lending decisions while underwriters guide the edge cases. From L2 onwards the Review flags advice-like influence and the risk of over-reliance or weak challenge.

L4: human as approver

AI acts and the human signs off key steps. The system prepares or initiates actions and a person authorises them; control shifts towards setting permissions and boundaries. One of the Review's examples is AI investigating suspicious activity and drafting a suspicious activity report that an analyst approves. The risk moves to how well those permissions and safeguards were set in advance.

L5: human as observer

AI executes and the human monitors. The system acts continuously within limits agreed in advance, and the person watches outcomes rather than deciding each case. The Review says this creates deeper risks around consent, accountability, auditability and redress, because the human is setting parameters and overseeing results afterwards.

Autonomy is not the same as automation

The Review draws a distinction that many firms will find useful. Where AI is added to a process that was already automated, such as an automatic assessment of a loan application, the role of the human has not changed, so the AI has limited effect on autonomy. A scorecard that has declined applications without a person for years does not jump up the spectrum because a newer model replaces it.

That does not make it low risk. An automated decision is still subject to the rules that govern automated decisions, including UK GDPR Articles 22A to 22D where a significant decision about a person is taken with no meaningful human involvement. The spectrum describes delegation from people to machines; it does not replace the legal tests that already apply.

Nor does every system move along the whole spectrum. In the Review's words, "Not every use case will move along the full length of this spectrum, and few parts of financial services will become entirely autonomous." Its own summary of what matters is practical: the regulatory significance depends on what the system is allowed to do, how much it decides for itself, and where human approval sits.

How the AI autonomy spectrum maps to FCA regimes

The Review tests each major regime against the five levels. Its findings follow a consistent pattern: "Early questions of accuracy and reliance give way to more challenging questions about consent, accountability and redress."

• Senior Managers Regime. Robust at L1 to L3. At L4, accountability remains clear but oversight of AI-enabled processes becomes more challenging. At L5, meaningful human control is likely to be difficult to evidence.
• Consumer Duty. Operates effectively at L1 to L3, although personalisation at L3 raises questions on fair value. At L4, consent and understanding become harder to evidence. At L5, the existing consent model may be insufficient.
• Advice and guidance boundary. Pressure starts at L3, where personalised recommendations may blur the boundary.
• Operational resilience. Complexity rises at every level, because firms depend on a small number of providers and shared infrastructure.

None of this suspends the rules at any level. Every firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems (PRIN 2.1.1R). Every senior manager must take reasonable steps to ensure that the business they are responsible for is controlled effectively (COCON 2.2.1R). Firms serving retail customers must monitor the outcomes those customers receive (PRIN 2A.9.8R). What changes as autonomy rises is how hard it becomes to show those obligations are being met.

Classifying your own systems

A level is only useful if it is assigned consistently. Four habits make the classification defensible.

• Classify the use case, not the product. The same vendor tool can be L1 in one team and L4 in another, depending on what it is allowed to do there.
• Classify what happens in practice. An approval step that never changes an outcome is closer to observation than approval. Look at the data, not the process map.
• Classify the riskiest step. A journey that drafts at L1 but sends at L4 is an L4 journey.
• Record the reasoning and the date. A level changes when a vendor updates a model, a threshold moves or a review team is cut. A dated rationale lets you show when and why it changed.

What to do

1. List your AI use cases. Include tools embedded in supplier platforms and tools staff use informally, not only systems the firm built.
2. Assign each one a level from L1 to L5. Ask one question per use case: what does the person actually do, and can the system act without them?
3. Name an accountable owner for every L4 and L5 use case. Map each one to a senior manager's responsibilities.
4. Match controls to the level. Output checks for L1 and L2; documented challenge for L3; permission design and override data for L4; boundaries, monitoring and a stop mechanism for L5.
5. Review the classification on change. Make re-levelling part of change control and vendor management.

Our view

In our view the spectrum is the most useful thing the Review gives practitioners, because it turns a vague question about AI risk into a precise one about delegation. Firms that can say, for each system, where the human sits and how they know will find every later governance step easier. Firms that cannot will be classifying under pressure.

Published by compliance monitoring software for FCA firms. Every Handbook reference in this article was checked against the provision text in our FCA Handbook mirror before publication. This is general information, not legal advice.