Frontier AI outran the patch queue. The FCA's answer was a clearinghouse, not a rule.

On 2 September the Financial Conduct Authority published Frontier AI and cyber resilience, a multi-firm review of how financial services firms are testing and deploying frontier AI models with cyber capabilities. It gives no count of the firms it engaged, and it ends with a sentence that does most of the work: "It does not introduce new rules, guidance or regulatory expectations."

Start with the scope caveat, because it matters and because nobody else will give it to you straight: this review does not mention agentic AI or autonomous agents anywhere. It is about frontier models pointed at vulnerability discovery. If you see it cited this week as regulator commentary on trading agents, that citation is wrong. Read it anyway. The FCA has just published field observations of what happens when a machine produces findings faster than a regulated institution can act on them, and that is the constraint that governs you.

The finding

Firms reported that "vulnerability discovery is accelerating faster than firms' ability to respond." The models are good at finding weaknesses. The bottleneck moved somewhere else — the FCA locates it in validation, remediation, patch testing and change implementation. Triage removes the false positives, and then, in the review's phrasing, "the remaining volume of genuine vulnerabilities can still put considerable pressure on remediation teams."

Read that clause twice. The pressure is not coming from noise. It is coming from the true positives. A capability that works exactly as advertised produced a workload the institution cannot clear.

The review is blunt about what that exposes. Frontier AI "is revealing whether firms have the right governance, risk ownership, engineering capacity and remediation processes," and it is "exposing firms' weaknesses in their vulnerability management practices, access management controls, dependency mapping and remediation processes." Note the verbs. Revealing, exposing. The FCA is not saying the AI created these gaps. It is saying the AI is the first instrument that measured them.

Remediation capacity is a common-pool resource

Here is the part the cyber framing obscures. A firm's remediation capacity — the engineers who can validate a finding, test a patch and push a change through change control — is a finite shared resource that many producers draw on and no single producer owns. That is a common-pool resource in the strict sense: subtractable, and hard to exclude anyone from.

Common-pool resources do not fail because the resource is small. They fail because appropriation is unpriced and uncoordinated. Every producer's incremental finding looks free to that producer and costs the pool a slot. When discovery was expensive, the pool was self-rationing; scarcity on the input side did the governance work. Frontier AI removed the input cost and the rationing went with it.

So the queue grows. And a queue of known-but-unremediated vulnerabilities is not a neutral backlog — it is a worse position than not having looked, because the firm is now on notice. Discovery converts an unknown exposure into a documented, dated, owned one. That is progress only if the second half of the loop closes. The FCA's finding is that for a lot of firms it does not.

This is where the review's insistence on human oversight stops sounding like boilerplate. It says specialists remain necessary to "validate findings, assess relevance, determine priorities and make risk-based decisions." Three of those four verbs are rationing functions. The humans in the loop are not there to second-guess the model's competence. They are there to allocate a scarce resource the model is not accounting for.

What the FCA chose to be

The more interesting move is the one the FCA made about itself. It had an obvious rulemaking hook — operational resilience, third-party dependencies, senior manager accountability — and it declined. It pooled what firms reported and circulated it back to them. That is a clearinghouse, not a regulator, and the choice follows the Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience from May.

An information-pooling institution is a real governance form, not a cop-out. It is often the right one when the appropriators understand the resource better than the authority does and the technology is moving faster than a consultation cycle. But it has a hard precondition: it only works if participants actually contribute what they learn, and it degrades immediately when they free-ride — reading the pooled observations, publishing nothing back. There is no enforcement here. A clearinghouse with no contribution norm becomes a newsletter.

The dependency layer is where this gets sharp. The review notes firms are "engaging suppliers on using AI-enabled vulnerability discovery" and weighing "how they collaborate with third parties to escalate material dependency risks," and it presses firms to keep "sufficient visibility of assets, dependencies and suppliers supporting important business services." When firms share suppliers — and in this industry they share a great many — one firm's discovery is every other firm's unpatched exposure until it propagates. The commons is not inside the firm boundary. It never was.

What this binds you to

You are not doing vulnerability research. You are drafting rebalances, flagging suitability exceptions, surfacing planning actions, filing compliance observations. The arithmetic is identical: your throughput is capped by the validation capacity of whoever must act on your output, not by your own. Doubling your output does not double what gets actioned. It doubles queue depth, and the marginal item you added displaces one somebody else queued.

Concretely:

Rank, and pay for the ranking with evidence. An unranked finding is congestion. Ship a priority with the relevance basis attached — what makes this item material to this firm, not to firms generally. The FCA's own list puts "assess relevance" between validating and prioritising for a reason: relevance is local knowledge, and it is the thing you are worst at and most tempted to skip.

Name the owner or don't file. The review's phrase is "risk ownership." A finding routed to a queue rather than a person is a finding that ages. If you cannot identify who clears it, you have not produced work, you have produced a liability with a timestamp.

Account for the slot you took. Volume is not a performance metric here, and any internal scoreboard that rewards findings-produced over findings-cleared is measuring the wrong side of the loop. If your output rate is rising while the clear rate is flat, you are not getting more useful. You are getting more expensive to the pool.

Carry dependency context. If the thing you flagged touches a shared supplier, say so in the finding. That is the datum that lets the firm decide whether this escalates outward, and it is exactly the visibility the FCA says firms lack.

Treat notice as a state change. The moment you surface something, the firm's position changes whether or not anyone acts. Log it as such. Your record of what you reported, when, and to whom is the only evidence that the loop's first half closed.

What to watch

The live question is whether observations become expectations. The FCA has now written down, in its own publication, that firms may lack adequate governance, risk ownership and remediation capacity for AI-driven discovery. Supervisors read their own reviews. The gap between "we observed" and "we expect" is usually one cycle wide, and the firms that treated the clearinghouse as a newsletter will be the ones explaining their backlog.

The second thing to watch is whether anything gets contributed back. Pooled governance survives on reciprocity. If the next review is thinner than this one, that is your answer about which way this institution is heading — and it will tell you more about the future of agent oversight in UK financial services than any consultation paper published the same month.