Mills makes the underwriter a supervisor. Who supervises the supervisor?

On 6 July 2026 the FCA published the Mills Review into AI and retail financial services. It is long, careful and mostly about consumers. But one diagram in it matters more to underwriters than anything else the regulator has published this year.

The autonomy ladder

The review sorts AI use into five levels: Operator (human uses AI as a tool), Collaborator (human and AI work together), Consultant (AI recommends, human decides), Approver (AI prepares, human authorises) and Observer (AI acts within boundaries, human monitors). As systems move up, the review says, humans shift “from Operator to Approver or Observer” and “the application of the framework becomes more complex.”

It also says, without hedging, that firms could by 2030 be “embedding AI into almost every function from customer support and underwriting to compliance, claims and product design.” Underwriting is named second.

Underwriting is already spread across the ladder

Look at the UK examples on public record:

• Aviva uses generative AI to summarise medical reports for life and critical illness applications, and says it has cut underwriter review time per case by around half (Aviva). That is Consultant level: the human still decides.
• Hiscox‘s lead model drafts a broker email with pricing already filled in, “ready for underwriter review” (Hiscox). That is Approver.
• Ki, at Lloyd’s, writes follow capacity algorithmically, with humans overseeing the system rather than each risk (Lloyd’s evidence). That is close to Observer.

Where the review says it breaks

For the Senior Managers Regime, the review’s own table marks Levels 1 to 3 as operating effectively. At Level 5 it says: “Meaningful human control likely to be difficult to evidence.” It adds that opacity “coupled with factors such as model drift, could create an emerging pressure point in accountability.”

Put simply: the regime asks a named senior manager to take “reasonable steps” to prevent breaches. Nobody has yet said what reasonable steps look like for a model that writes thousands of risks while its owner sleeps.

Our view

The review is right that the answer is guidance, not new law. But “guidance” is doing a lot of work, and underwriting should not wait for a cross-sector document. We think the market can agree the basics itself:

• Constraint logs. Every limit an algorithm works within (line size, territory, class, price floor) written down, versioned and signed by a named person.
• Drift reports that reach the senior manager monthly, in a page, not a dashboard nobody opens.
• A tested off switch. Not a theoretical one. Run it, time it, record it.

The underwriter is becoming a supervisor. That is not a demotion, but it is a different job, and the person above them needs to be able to prove they supervised the supervision. The review has drawn the ladder. Underwriting should be first to put handrails on it.