The second quarter of 2026 will be read, in retrospect, as the moment the UK supervisor architecture finished translating "AI is here" into operational expectations. Three threads worth carrying into Q3.
1. Frontier AI moves into the cyber resilience perimeter
The joint statement from the FCA, Bank of England and HM Treasury this quarter does not introduce new rules. It signals what every regulated firm will be expected to evidence at the next operational resilience review: AI-paced threat modelling, agentic-attack detection signatures, recovery plans built for correlated incidents rather than idiosyncratic ones. Six months after the GTG-1002 disclosure, the supervisor framing has caught up with the threat surface.
Our detailed read of the joint statement and what good 2026 cyber-resilience looks like is published as a standalone insight on the website.
2. Model risk perimeter formally expands
The PRA's SS1/23 expectations, the FCA's Consumer Duty fair-value standards and the EU AI Act's coming-into-force milestones have, in this quarter, formally collapsed the boundary between "classical" risk models and the rest of the AI estate. Pricing engines, fraud and AML detection, generative AI workflows that influence a customer decision or a regulatory output — all in scope for inventory, validation cadence and monitoring at a tier appropriate to risk.
The institutions that built the model-risk scaffolding for credit over two decades have the playbook. The institutions that did not — non-bank lenders, smaller insurers, asset managers entering retail — are constructing it under deadline. The 2026 supervisory cycle will distinguish between the two visibly.
3. BPA pipeline reset and the Irish MA window
The Bulk Purchase Annuity pipeline has reset for a busier H2 than most insurers were planning for, and prospective Matching Adjustment applicants in the Republic of Ireland are now seriously preparing submissions. The CBI's clarified guidance has shifted MA from theoretically permitted to practically viable. The firms moving first will set the precedents the supervisor uses for everyone else.
What we are watching into Q3
- The Bank of England's SWES 2 data call and the granularity at which private credit firms can actually report counterparty exposure.
- FCA supervisory dialogue on AI-driven Consumer Duty evidence — particularly renewal pricing and vulnerable-customer outcomes.
- The first wave of Irish MA applications and the governance bar the CBI sets.
As always, write to us with what you are seeing inside your function — the briefing is sharpened by the conversations it provokes.