What happened
The UK Financial Conduct Authority published a multi-firm review on September 2, 2026, summarizing observations gathered from financial firms on how frontier AI models are affecting cyber resilience, governance, and vulnerability management. The review introduces the concept of "harness engineering" — the environment, controls, and processes around an AI model that make its outputs useful, safe, and reliable — as a key organizing frame for firms' AI oversight. Firms reported that frontier AI enables "vulnerability chaining," combining multiple lower-rated flaws into new attack routes, and is exposing weaknesses in existing defense-in-depth architectures, supplier preparedness, and cloud/software-supply-chain visibility. The FCA states the review does not introduce new rules or guidance but is meant to help small and medium-sized firms benchmark their preparedness.
Why it matters
Financial-services CISOs and boards get a regulator-validated checklist of where frontier-AI-driven cyber risk is outpacing existing remediation and governance processes, informing near-term investment in vulnerability management and third-party resilience.
Action needed
Assess firm's vulnerability remediation pipeline and third-party/cloud dependency mapping against the FCA's harness-engineering and vulnerability-chaining observations.