FCA Updates Operational Resilience Hub with Frontier AI Resources and 2027 Incident Reporting Rules

Key Takeaways

• The FCA has refreshed its operational resilience page to add frontier AI resources and to flag new incident and third party reporting requirements taking effect on 18 March 2027.
• The existing operational resilience rules remain fully in force, with the March 2025 compliance deadline now past.
• Compliance teams should confirm they can remain within impact tolerances and begin preparing for the new reporting regime.

Deep Dive

The FCA has refreshed its operational resilience page to add frontier AI resources and to flag new incident and third party reporting requirements taking effect on 18 March 2027. The existing operational resilience rules remain fully in force, with the March 2025 compliance deadline now past. Compliance teams should confirm they can remain within impact tolerances and begin preparing for the new reporting regime.

The most significant forward-looking item is the new incident reporting and third party notification regime, published on 18 March 2026 and effective 18 March 2027. Firms have a 12-month implementation window. Compliance teams should review the Policy Statement and Finalised Guidance, compare current incident classification and escalation processes with the new requirements, and determine how material third party arrangements will be identified and reported. The critical third parties (CTP) regime is also now operating, but the FCA is explicit that it does not shift accountability: boards and senior management remain responsible for resilience and for compliance with outsourcing and operational resilience rules when relying on third parties.

The page also adds frontier AI material. This includes a May 2026 joint statement from the FCA, Bank of England, and Treasury on frontier AI models and cyber resilience, and September 2026 insights from firm engagement. It also points to CMORG guidance (38 key activities and 31 questions) and NCSC materials, including preparation for a "vulnerability patch wave." Other items, such as the CrowdStrike observations, the joint cyber response and recovery practices, the CCG insights, the January 2026 CBEST thematic, and the G7 CEG post-quantum cryptography roadmap (milestones through 2035), are stated not to introduce new requirements. They still indicate supervisory expectations and should be treated as benchmarks for good practice.

Recommended actions:
- Validate that important business services, impact tolerances, scenario testing, and remediation plans are current and evidenced.
- Launch a gap analysis and implementation plan for the March 2027 reporting rules, with board visibility.
- Assess third party and concentration risk, including reliance on CTPs.
- Incorporate frontier AI into cyber risk, vulnerability management, patching capacity, and governance reviews.
- Consider completing the CQUEST and ORQUEST self-assessments and review CBEST findings.
- Track post-quantum cryptography readiness.

Risk implications: Failure to remain within impact tolerances or to prepare for the 2027 reporting rules could lead to supervisory action, consumer harm, and reputational damage. Accelerating AI-enabled vulnerability discovery raises the likelihood of compressed patching timelines and cyber incidents.

Source: Financial Conduct Authority