Britain's financial regulator says that the incident reports firms already have to file must in future cover significant failures of artificial intelligence, and the failures that were narrowly avoided.
Speaking at Bloomberg's UK Policy Series on Monday, the Financial Conduct Authority's chief data, information and intelligence officer, Jessica Rusu, said the regulator wants Britain to lead safe AI adoption in financial services. Greater autonomy, she said, requires clear accountability.
"Poorly governed AI can create consumer harm, cyber vulnerabilities, and operational failures, potentially at much greater speed and scale," she said.
"Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses," Rusu added. "As the AI Minister has recognized, near-miss reporting for agentic AI is becoming a national security priority. It is a regulatory priority too."
The sector in question is a large one. Financial services contributed £223.6 billion to the UK economy in 2025, or 8 per cent of national output, the fourth highest share among OECD countries.
The government has been moving in the same direction. Last week the artificial intelligence minister, Kanishka Narayan, said the government planned to work with Parliament and technical experts to assess how the regime could be strengthened to better protect Britain from AI-driven cyber threats and loss-of-control risks. "That includes identifying and reporting on serious incidents and near misses, including reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed," he said.
The model being invoked is aviation. Steven Adler, co-founder and chief scientist of the independent nonprofit Guidelight AI Standards, told MPs last week that AI oversight could learn from the aviation sector, where the reporting of near-misses is mandatory in most jurisdictions, because the events that were avoided are the ones that teach you how to keep avoiding them.
The legislative position is less settled. The government has yet to commit to adding AI-specific measures to the Cyber Security and Resilience (Network and Information Systems) Bill. Alexandra Jones, Director General for Growth, Science and International at the Department for Science, Innovation and Technology, told MPs last week that amendments remain under consideration.
Parliament has asked for more before. In January the House of Commons Treasury Committee called on financial regulators to conduct stress tests to ensure businesses were ready for AI-driven market shocks, and said there should be clear lines of accountability when AI systems produce harmful or unfair outcomes. The remarks were reported by The Register.
The new category deserves careful definition. A near-miss is identified by its outcome, which is that nothing happened. Reporting one therefore requires a firm to establish what an autonomous system very nearly did, and to put that in writing to the regulator.
This is where the two registers part company. The log of incidents is bounded by incidents, of which there are as many as there are. The log of near-misses is bounded only by what the system was capable of attempting, which in an agentic system is more or less the specification.
It follows that the obligation grows with the technology. A firm that deploys a more capable agent has a wider range of things it has narrowly not done, and therefore more to disclose, so the volume of required reporting rises in step with the quality of the model being reported on.
The Department of Unnecessary Research has modelled the compliant extreme. A system that has been switched off cannot nearly do anything at all, which makes the nil return the only filing that can be completed with confidence.
A firm with nothing to report has either the safest artificial intelligence in the sector or the poorest imagination about it, and the return looks identical either way.