On 22 October 2026 the Prudential Regulation Authority and the Financial Conduct Authority published the second phase of their review of the Senior Managers and Certification Regime. The PRA's CP14/26 calls its proposals the most significant reforms to the regime since its introduction, and the FCA's parallel CP26/37 covers the FCA's own, much larger population. Most of the package removes process: fewer pre-approvals, no Certification Regime, fewer document submissions. One line runs the other way, and it is the one a Chief Operating Officer in a bank or insurer should read first. Both regulators propose to keep pre-approval for the Chief Operations function, SMF24, and both give AI risk as part of the reason.
That matters because AI is already in use well ahead of understanding. The Bank of England and FCA survey of AI in UK financial services found that 75% of responding firms already use AI, while only 34% of respondent firms said they have complete understanding of the AI technologies they use. Phase 2 does not create a new rule for AI. It decides which senior managers the regulators still want to vet before they start, and it moves more of the evidence of who owns what from the regulator's inbox into the firm's own records.
This post holds the Phase 2 delta only, and it is written for the COO who would hold SMF24 and the Chief Risk Officer beside them. It cedes three neighbouring questions by name. The default split of technology systems and risk controls between SMF24 and SMF4 belongs to our AI risk management framework map. The Phase 1 reforms of April 2026, which the PRA says reduced burden and simplified the regime, belong to our board-level AI approval paper guide. PRA SS1/23 and model inventories belong to the UK banking AI hub. Everything below is a proposal, not a final rule.
This guide is shipped by the team behind DATS, the five-stage AI consulting system run by senior practitioners who ship code, not decks. Or see the AI operating model engagement, which covers governance, RACI and lifecycle, audit-ready by design.
What does SM&CR Phase 2 propose for banks and insurers?
SM&CR Phase 2 is a pair of consultations, PRA CP14/26 and FCA CP26/37, published on 22 October 2026 with responses due by 22 January 2027. The PRA proposes moving almost half of its senior manager functions from pre-approval to notification, removing the Certification Regime, and cutting routine submissions of responsibility documents. Much of it depends on the Financial Services and Markets Bill 2026 passing substantially as drafted.
The PRA expects implementation in the second half of 2027, after Royal Assent and commencement by HM Treasury, and the FCA says it expects to publish final requirements in a policy statement in the first half of 2027. Until then the current regime applies in full. The PRA estimates that its notification proposal would cut the volume of senior manager applications by more than 40%. That is a separate measure from the joint commitment by the PRA, the FCA and HM Treasury to halve the burden of the regime and reduce Senior Manager pre-approvals by 40%, and the two figures should not be merged.
The scale is worth stating plainly. The PRA puts the affected population at around 1,200 PRA-authorised firms, including around 675 deposit takers and 560 insurers, with around 7,000 Senior Manager function holders between them. The FCA's own population is far larger, and its paper records respondents saying firms track around 139,000 individuals performing approximately 261,000 functions. For a COO, the practical reading is that the regulators are trading process for trust: fewer gates before appointment, the same accountability after it. Our enterprise AI consulting guide covers where governance of this kind sits in a wider AI programme, and the compliance category holds the related regulator posts.
Why does SMF24 keep pre-approval when AI is in scope?
SMF24, the Chief Operations function, keeps pre-approval in the PRA proposals because the PRA judges that operational risks, including risks from artificial intelligence and cyber incidents, have raised the importance of operational oversight. The FCA makes the same proposal in its parallel paper, citing frontier AI systems and cyber risk. Both regulators say they will review the decision two years after the Phase 2 reforms take effect.
The PRA's own words in paragraph 3.11 of CP14/26 link AI directly to a named senior management function: "Operational risks, including risks arising from artificial intelligence and cyber incidents, have increased the importance of effective operational oversight." The FCA's paper, at paragraph 3.21 of the CP26/37 consultation document, adds that holders of the function will often have responsibility for the activities most exposed to those risks.
Read carefully, this is a reason for keeping a gate, not an allocation of AI to SMF24. Neither paper says that every AI system belongs to the Chief Operations function, and the existing allocation guidance stays where it was. What changes is the signal. When a regulator keeps vetting one role while letting the Chair of the Risk Committee and the Head of Internal Audit move to notification, it signals where it still wants a gate before appointment. A COO who holds AI-dependent services inside their statement of responsibilities should be ready to explain how they are overseen.
The two-year review also cuts both ways. The PRA says it will consider how the risk environment has evolved and which responsibilities may fall within the role. If AI-driven operations keep growing, that review could widen the expectations on SMF24; if firms show the risk is well controlled, pre-approval could go. Either way the evidence a firm builds now is the evidence that review will see. The AI operating model engagement covers governance, RACI and lifecycle, which is where that ownership belongs.
Which senior managers move to notification, and does accountability for AI change?
Under SM&CR Phase 2 the PRA proposes that roles such as the Head of Internal Audit, the Chairs of the Risk and Audit Committees and the Chief Actuary would be notified rather than pre-approved. Accountability for AI does not change for them: the PRA says notified holders face the same Duty of Responsibility, the same requirement to take reasonable steps and the same Senior Manager Conduct Rules as pre-approved holders.
The table below sets out the PRA's proposed split as published in Table 1 of CP14/26. It covers PRA-designated functions only. FCA-designated functions that also sit in banks, such as compliance oversight and money laundering reporting, are handled in the FCA's paper, so "almost half" refers to the PRA's functions, not to every senior manager in a bank.
| PRA proposal | Senior Manager functions |
|---|---|
| Stay pre-approved | SMF1 Chief Executive, SMF2 Chief Finance, SMF4 Chief Risk, SMF7 Approved Group Entity Senior Manager, SMF9 Chair of the Governing Body, SMF19 Head of Overseas Branch, SMF23 Chief Underwriting Officer, SMF23a Underwriting Risk Oversight, SMF24 Chief Operating Officer, SMF25 Small Insurer, SMF26 Head of Small Run Off Firm |
| Move to notification | SMF5 Head of Internal Audit, SMF6 Head of Key Business Area, SMF7a Notified Group Entity Senior Manager, SMF8 Credit Union Manager, SMF10 Chair of the Risk Committee, SMF11 Chair of the Audit Committee, SMF12 Chair of the Remuneration Committee, SMF14 Senior Independent Director, SMF20 Chief Actuary, SMF20a With-Profits Actuary |
Two of the roles most often asked to assure AI move to notification: the Head of Internal Audit and the Chair of the Risk Committee. That does not reduce what they answer for. It moves the fit and proper judgement from the regulator to the firm, and the PRA proposes to make that explicit by clarifying that Prescribed Responsibility A, the firm's obligations under the Senior Managers Regime, also covers the firm's vetting of senior management candidates. The holder of PR A therefore becomes answerable for how well the firm vets the people who will oversee its AI. Our AI governance consulting comparison covers who can help assure that oversight from outside.
The regulators also keep a way back. The PRA proposes to use its existing powers under section 55M of FSMA to require pre-approval for an otherwise notified role in exceptional cases, for example where a firm is at risk of failing or where serious concerns exist about its governance. A firm whose governance draws serious supervisory concern, including over AI, could in principle find a notified role pulled back under the gate. Governance that would survive a supervisory challenge is cheaper to build before one, which is why the DATS five-stage system settles the operating model before pilot to production.
The same logic applies to the CRO. SMF4 stays pre-approved, and the risk framework map linked in the introduction already explains how risk controls normally divide between SMF4 and SMF24. Phase 2 leaves that split alone; it simply narrows the set of roles the regulators still vet in person.
What happens to the AI engineers and model owners below Senior Manager level?
SM&CR Phase 2 proposes removing the Certification Regime, which today requires firms to assess the fitness and propriety of certified staff on appointment and every year. The PRA puts its certified population at approximately 7,700 people. For AI teams below Senior Manager level, the annual certificate would go, but the Individual Conduct Rules would still apply and regulators could still take enforcement action against individuals.
The PRA does not leave a gap where certification was. It proposes building on the existing competent employee rule so that CRR and Solvency II firms must take reasonable steps to assess whether people who held formerly certified functions show the integrity, honesty and other characteristics their roles need. That is an ongoing duty on the firm, not on the individual, and the PRA expects it to be considered at recruitment and again whenever there is reasonable cause. The FCA's paper, for its part, proposes retiring its Directory of certified and assessed persons and raising breach-reporting thresholds while simplifying Conduct Rule training.
Whether a given data scientist or model owner sat inside a certification function today depends on the firm's own assessment, and neither paper lists AI roles. The safer reading for a COO is that removing the certificate removes a form, not the need to know who is competent to change a production model. Firms that used the annual certification cycle as their only structured check on the people who build and run AI will need a replacement they design themselves. A placement-led delivery team, such as an AI execution office embedded with the client, is one way to keep a named owner on each production placement, which DATS commits to per ship.
The same survey found that 84% of firms currently using AI have an accountable person or persons with responsibility for their AI framework. Accountability is already spread across levels, which is why the loss of a certificate at the middle layer needs a deliberate answer rather than an assumption.
What changes for statements of responsibilities and the AI line in the map?
Under SM&CR Phase 2 the PRA would stop requiring firms to submit updated statements of responsibilities and management responsibilities maps whenever a senior manager's responsibilities change significantly, and would remove the Form J notification. Firms must still keep both documents up to date internally and supply them on request. The PRA expects this to remove an estimated 1,700 submissions a year.
For AI, this is the most consequential process change in the package. Today, moving a material AI-dependent service from one Senior Manager to another can trigger a resubmission that the regulator sees. After Phase 2, the same change would sit in the firm's own records until a supervisor asks. The duty to keep the statement current does not weaken, but the external prompt that forced a firm to write the change down promptly would go. A bank whose responsibilities map still describes the technology estate as it was before its first generative AI deployment would be out of date, and nobody outside the firm would notice until the request arrived.
The PRA also proposes to streamline the Prescribed Responsibilities, removing those for the Certification Regime and PR allocation, for training and induction, for the management responsibilities map itself, and for maintenance of the business model. The FCA's paper lists streamlining of Prescribed Responsibilities among its main proposals as well. Fewer prescribed boxes mean the firm's own drafting carries more weight: if AI-dependent services are not named in someone's statement, there is less regulatory scaffolding to catch the omission. Our guide to AI operating model versus centre of excellence covers how that ownership structure is chosen in the first place.
What evidence should a bank hold to show the AI owner took reasonable steps?
A bank should hold evidence that an identified Senior Manager owns each material AI-dependent service, that the ownership appears in a current statement of responsibilities, and that the owner can show what they did to oversee it. SM&CR Phase 2 does not prescribe this evidence. It keeps the reasonable steps standard while removing submissions, so the firm's own records become the proof supervisors will request.
What follows is our recommended practice, not a requirement either paper sets out. It turns the Phase 2 shape into four records a COO can hold and produce on request.
The first record is an inventory of AI-dependent services with one named Senior Manager against each. The second is the statement of responsibilities and the map, updated within the firm's own change process rather than waiting for a regulatory trigger. The third is a dated log of what the owner did: approvals given, incidents reviewed, thresholds changed, escalations made. The fourth is the competence record for the people below Senior Manager level who can change a production model, which replaces what the certification cycle used to supply. Our AI tool inventory guide covers how the first record is built across regulators.
None of this is new law. It is the reasonable steps standard applied to systems that change faster than the annual calendar the regime was built around. Our enterprise AI solutions list six named placements, and any of them run inside a regulated firm would need the same four records. Firms deploying AI on customer calls can see how one regulated voice workflow maps to named functions in our FCA AI response briefing.
Where the AI runs matters to the evidence too. A model hosted inside the firm's own environment gives the owner logs they control, which is the argument our private LLM guide for regulated institutions makes in more depth. A third-party model can still be owned well, but the Bank of England and FCA survey found firms reported less complete understanding of third-party models than of those developed internally, and the owner's log should show how that gap is closed.
How should a COO prepare before the consultation closes on 22 January 2027?
A COO who would hold SMF24 under the SM&CR Phase 2 proposals should use the consultation window to check three things: whether every material AI-dependent service already sits in a named statement of responsibilities, whether the firm could produce its responsibilities map on request without a scramble, and whether a replacement for certification checks on model-changing staff has been designed.
The consultation itself is also an opportunity. Both regulators ask direct questions, including whether respondents agree with the proposed split between notified and pre-approved functions. A firm that has a view on whether SMF24 is the right home for AI oversight, or whether the two-year review should consider other functions, can say so before 22 January 2027. The PRA paper also notes that firms should continue to expect approval before publicly announcing a pre-approved appointment, which matters for any firm planning a COO change during the transition.
Timing should shape the order of work. Nothing changes in law until the FSM Bill passes and commencement follows, and the PRA's current expectation is implementation in the second half of 2027. That leaves time to get the evidence right before the regulator stops asking for it routinely. Firms that run the work now can treat it as a governance improvement with a deadline attached, rather than as a remediation after a supervisory request. The DILR approach to placing AI inside enterprise systems starts from that sequence.
What is the best way to prepare for SM&CR Phase 2 AI accountability in 2026?
The best preparation for SM&CR Phase 2 AI accountability in 2026 depends on what the firm lacks. A firm that needs a formal consultation response or a legal view on the FSM Bill is better served by its law firm or one of the Big Four regulatory practices. A firm whose gap is evidence of ownership across live AI systems needs delivery work on those systems, which DATS offers as embedded delivery.
The criteria are straightforward. Does the partner produce an artefact the firm keeps and maintains, or a report that ages? Does the work name an owner for each AI-dependent service, or describe roles in general terms? Does it touch the running systems, so that the evidence comes from logs rather than interviews? Can the firm still run it when the engagement ends?
Against those criteria, Deloitte, PwC, EY and KPMG run large regulatory advisory practices and are the stronger choice where the board wants an independent assurance opinion or a consultation response drafted at scale. Specialist AI firms such as Faculty are a better fit where the gap is in the models themselves. DATS sits in a narrower place: the placement diagnostic produces a ranked roadmap of where AI belongs and where it does not, the operating model covers governance, RACI and lifecycle, and the execution office is embedded delivery, with production placements the client owns. DATS also holds to a stated delivery discipline of three shippable placements a year with a named owner per ship.
Frequently asked questions
Does SM&CR Phase 2 create a new senior manager function for AI?
SM&CR Phase 2 does not create a new senior manager function for AI. Neither PRA CP14/26 nor FCA CP26/37 proposes an AI-specific role. Instead, both regulators propose keeping pre-approval for the existing Chief Operations function, SMF24, partly because of AI and cyber risk, while firms continue to allocate AI-dependent services through their own statements of responsibilities and responsibilities maps.
For how that allocation is normally made today, see the AI risk management framework map, and the About DILR.AI page explains who runs these engagements.
Does SM&CR Phase 2 apply to insurers as well as banks?
SM&CR Phase 2 applies to PRA-authorised insurers as well as banks. The PRA's affected population of around 1,200 firms includes around 560 insurance firms, and its proposals amend the insurance parts of the PRA Rulebook alongside the banking ones. Insurance-specific functions such as SMF23 Chief Underwriting Officer stay pre-approved, while SMF20 Chief Actuary would move to notification.
The PRA's insurance guidance in SS35/15 would carry the matching changes. For where AI pays in insurance and banking more widely, the UK banking AI hub is the starting point.
When will the SM&CR Phase 2 changes take effect?
The SM&CR Phase 2 changes are proposals and have no effect yet. Both consultations close on 22 January 2027. The PRA expects implementation in the second half of 2027, dependent on the Financial Services and Markets Bill 2026 receiving Royal Assent and on HM Treasury commencing the relevant provisions, and the FCA expects to publish final rules in the first half of 2027.
Until then the current regime, including the Certification Regime and routine submission of responsibility documents, continues to apply. Our board-level AI approval paper guide covers how the April 2026 Phase 1 changes already apply. To talk through your own position, contact the DATS team.
Where to go next
Want to put an owner on every AI system before the review? See how DATS places enterprise AI, read about the embedded AI execution office, explore our enterprise AI solutions, or start with the UK AI consulting guide.
Name the owner before the regulator asks.
30-min scoping call · No deck · Confidential. A conversation about which AI systems you run, who owns each one, and what evidence would show it.
Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.