The FCA's Mills Review: Why AI Makes Communications Archives More Important Than Ever

Introduction

Artificial intelligence is often described as a technology that will automate financial services. The FCA's Mills Review¹ paints a more nuanced picture.

Rather than simply replacing human activity, the report describes a future where AI becomes embedded throughout customer interactions, compliance, fraud detection and operational decision-making. As organisations increasingly rely on AI to support regulated activities, the challenge shifts from adopting AI to governing it responsibly.

Viewed through that lens, one implication stands out for communications compliance. The role of communications archives is evolving.

Communications archives have traditionally served as repositories for retained communications. The Mills Review points towards a role that goes well beyond that: a critical source of evidence for demonstrating how AI-assisted decisions were made, how human oversight was exercised and how governance operated in practice.

Although the report is not about communications archiving, its conclusions have profound implications for compliance recording, surveillance and governance.

AI changes what firms need to prove

One of the most reassuring conclusions of the Mills Review is that the FCA does not believe artificial intelligence requires an entirely new regulatory framework.

The report concludes that existing principles, including the Consumer Duty, the Senior Managers and Certification Regime (SM&CR) and operational resilience requirements, remain appropriate foundations for an AI-enabled financial system (p.79). The challenge is not replacing regulation, but ensuring organisations can continue to demonstrate compliance as AI becomes increasingly involved in customer interactions and operational decision-making.

That distinction is important.

Many discussions around AI governance focus on technical topics such as model selection, prompt engineering or explainability. The FCA takes a broader view. Throughout the report, it repeatedly returns to themes such as accountability, meaningful human oversight, continuous monitoring, auditability and good consumer outcomes.

These are not new regulatory obligations. They are existing obligations applied to a changing operating model.

The report puts it directly: the further a system sits along the autonomy spectrum, the more the human role shifts from carrying out individual tasks to setting the conditions within which AI systems operate, and accountability becomes harder to trace as models change over time (p.6).

As AI becomes more deeply integrated into financial services, organisations must be able to demonstrate not only what decisions were made, but how they were reached, who remained accountable and how appropriate oversight was exercised. That changes the nature of compliance.

Communications become part of the governance story

The continued importance of communications recording is not in question. As we explored in our analysis of FCA CP24/24 and PS25/13, the UK's recent regulatory reforms preserved the substance of communications recording and record-keeping obligations while consolidating them into the FCA Handbook. The Mills Review looks beyond those obligations, highlighting why the information captured by compliance archives is becoming increasingly valuable as AI becomes embedded across regulated activities.

Traditionally, communications archives existed to answer relatively straightforward questions: what was said, who participated, when the conversation took place, and whether the record could be retrieved during an investigation.

Those questions remain important, but they are no longer sufficient.

Imagine a customer complaint five years from now. The conversation may have been summarised by AI. A surveillance model may have identified potential conduct risks. A large language model may have recommended escalation. A compliance officer may have reviewed those findings before deciding no further action was necessary. If the customer later challenges that outcome, investigators will need far more than the original recording.

Investigators will need to understand what information the AI analysed, what conclusions it reached, whether those conclusions were challenged by a human reviewer and why the final decision was considered appropriate. The report's own framing is blunt on this point: a useful answer is not enough if the basis for it cannot be reconstructed (p.17).

The communications archive becomes the starting point for reconstructing that entire process.

Increasingly, organisations will need to preserve not only the communication itself, but also the evidence surrounding it.

The archive becomes more valuable because AI creates more evidence

One of the themes running throughout the Mills Review is that AI does not reduce governance requirements. It increases them.

The report explains that as organisations move from using AI as an assistant towards allowing it to perform increasingly complex operational tasks, human responsibility shifts from carrying out individual activities to supervising AI-enabled processes. That changes the questions regulators, auditors and compliance teams are likely to ask.

Instead of simply asking whether a conversation was recorded, they may increasingly ask:

• How did AI contribute to this outcome?
• Who reviewed the recommendation?
• Was human judgement exercised?
• How was the system monitored?
• Could the organisation demonstrate that governance operated effectively?

These questions all require evidence. Communications become one part of a much broader evidential chain that includes transcripts, AI-generated analyses, alerts, investigation notes, supervisory decisions and audit history.

AI does not reduce the need for evidence; if anything, the volume and variety of evidence a firm needs to hold onto expands considerably.

Communications surveillance enters a new era

The Mills Review also describes a broader transformation in how organisations monitor risk.

Historically, communications surveillance has relied heavily on manual review, sampling and predefined keyword lists. These approaches remain valuable, but they inevitably cover only a fraction of the communications generated within large financial institutions.

AI changes that equation.

Modern language models can analyse conversations in context, identify behavioural patterns, detect emerging risks and prioritise the interactions that genuinely require human attention. Instead of searching for individual words or phrases, surveillance increasingly focuses on understanding intent, behaviour and risk across much larger volumes of communications.

The report describes firms moving away from relying only on periodic review, manual sampling or fixed workflow rules, towards monitoring activity continuously and responding as patterns emerge (p.27). For communications surveillance, that is perhaps the most significant implication of the entire report. AI enables compliance teams to spend less time searching for potential issues and more time investigating the issues that matter.

Importantly, the report never suggests that AI replaces compliance professionals. If anything, it argues the opposite. As AI becomes more capable, human judgement becomes even more important.

Meaningful human oversight requires evidence

One of the most interesting aspects of the Mills Review is how it discusses human oversight. The report deliberately avoids reducing oversight to the popular phrase "human in the loop."

Instead, it asks more practical questions.

• What information does the reviewer receive?
• When should they intervene?
• How should disagreements be handled?
• How should accountability be maintained?

It states plainly that this will not be enough: firms need to be clear about what the person is expected to do, what information they receive, when they can intervene, how challenge is recorded and how escalation works (p.30).

These are operational questions rather than technical ones. From a communications compliance perspective, they also become evidential questions. Demonstrating meaningful human oversight requires organisations to preserve evidence showing where AI assisted a process, where people intervened and how final decisions were reached. Without that evidence, oversight becomes difficult to demonstrate after the event.

Communications archives therefore play an increasingly important role; not because they contain every answer, but because they preserve the factual record from which those answers can be reconstructed.

AI governance also needs governance

Many organisations are already introducing AI into their compliance operations. Speech transcription, conversation summarisation, quality assurance, policy detection and semantic search are rapidly becoming standard capabilities rather than emerging technologies.

The Mills Review reminds us that these AI systems also become part of the regulated control environment.

If AI contributes to compliance decisions, organisations need confidence that those systems continue to operate consistently over time. Models evolve. Prompts change. Policies are updated. Customer behaviour shifts.

This is also why AI assurance is becoming an increasingly important discipline. Governance is about defining policies, roles and accountability. AI assurance focuses on providing evidence that AI systems continue to perform as expected through testing, evaluation, continuous validation and traceability. We explored this distinction in our recent article, AI Assurance Explained, and how these practices help organisations build confidence in AI systems over time.

Governance therefore extends beyond the communications being analysed. It increasingly includes the AI used to analyse them.

That means evaluating models before deployment, monitoring performance continuously, validating policy changes and maintaining audit trails showing how compliance decisions were reached.

Communications archives become an important source of evidence supporting that governance process.

Preparing for AI-enabled supervision

Perhaps the most forward-looking recommendation in the Mills Review is directed not at financial institutions, but at the regulator itself.

The report recommends that the FCA develop an Agentic Supervisory Model, moving supervision away from something largely episodic, document-based and human-mediated, and towards continuous, intelligence-led oversight capable of identifying emerging harms and systemic risks across the financial sector (p.111).

Whether or not that vision is realised in exactly the form described, the direction of travel is clear. Supervision itself is likely to become increasingly data-driven. For firms, this suggests that future regulatory enquiries may extend beyond requests for recordings or transcripts.

Organisations may increasingly be expected to demonstrate how AI contributed to regulated activities, how governance operated over time and how meaningful human oversight was maintained.

The ability to retrieve a recording will remain essential.

The ability to reconstruct an AI-assisted decision may become equally important.

Frequently Asked Questions

Does the FCA's Mills Review introduce new communications recording requirements?

No. The report does not propose new communications recording or archiving rules. Instead, it explains how AI changes the way firms demonstrate compliance with existing regulatory frameworks, increasing the importance of accountability, evidence and governance.

Why does AI make communications archives more important?

As AI participates in customer interactions, compliance monitoring and operational decision-making, organisations increasingly need to demonstrate how decisions were reached, how AI contributed and where human oversight occurred. Communications archives provide much of the evidence needed to reconstruct that process.

How does AI change communications surveillance?

AI enables surveillance systems to analyse conversations in context, identify behavioural patterns and prioritise higher-risk interactions for human review. Rather than replacing compliance professionals, it allows them to focus their expertise where it adds the greatest value.

What is meaningful human oversight?

The Mills Review describes oversight as more than simply approving AI outputs. It involves defining when humans intervene, what information they receive, how decisions are challenged and how accountability is maintained. Demonstrating that oversight requires reliable evidence.

What does AI-enabled supervision mean for regulated firms?

The report recommends that the FCA develop AI-assisted supervisory capabilities. While this recommendation is aimed at the regulator, it signals a future in which firms may need to provide richer, more structured evidence showing how AI-supported decisions were governed and reviewed.

How should firms prepare?

The report points towards strengthening governance rather than introducing entirely new compliance programmes. For communications compliance teams, that means ensuring communications, transcripts, AI-generated analyses, supervisory decisions and audit trails can be preserved and reconstructed as part of a coherent evidential record.

Our perspective

At Argus Archive, this shift has shaped how we think about the future of communications compliance.

Recording and retaining communications remain fundamental. But they are no longer the end goal. Modern compliance platforms also need to help organisations understand communications, apply AI responsibly, generate meaningful alerts, support investigations and preserve the evidence needed to demonstrate governance.

That is why we see AI as more than an analytics capability. It is becoming part of the compliance control environment itself. As organisations introduce AI into transcription, surveillance, quality assurance and policy monitoring, they also need confidence that these systems are operating as intended—and they need evidence to prove it.

The Mills Review reinforces a direction that many compliance teams are already experiencing. Communications archives are evolving beyond systems of record. They are becoming an increasingly important part of how organisations govern AI, support investigations and demonstrate accountability.

As AI becomes embedded across financial services, trust will depend not only on the quality of AI models, but on the quality of the evidence organisations can produce to show that those models were used responsibly.

References