AI in action · Regulation
FCA's Alder: Shared AI Models Are a Global Tripwire
FCA chair Ashley Alder warns that firms' reliance on the same few AI models and cloud providers can turn one failure into a global shock. His answer: look past the perimeter, and cooperate.
The chair of the UK Financial Conduct Authority has made the case that the next financial crisis may not start in finance at all. In the Michael D. Gill Lecture, delivered on October 13 and published by the FCA on October 23, Ashley Alder argued that risk now travels across firms, sectors and borders while regulation is still organised vertically, by sector, regulator and country, leaving gaps through which accidental errors spread and bad actors find weaknesses.
Technology was his central example. With so many firms relying on the same small group of cloud providers, data sources and AI models, Alder said, "a failure in one part is a global tripwire." He pointed to the faulty CrowdStrike update of 2024, which hit fewer than 1% of Windows devices yet grounded more than 10,000 flights, disrupted health and payment services and cost US Fortune 500 companies an estimated $5.4 billion. He also referred to "new threats posed by rogue AI models, whether designed in China or by Western companies."
That leads to the perimeter. The FCA is reconsidering whether its legal perimeter covers the right activities and whether existing powers can be used more creatively against risks that start outside finance, a question Alder expects to come up more and more often, "not only cloud services, but with AI models, data providers, social media platforms." The UK's critical third parties regime, set up by the FCA, the Bank of England and the PRA and aimed first at major cloud providers, already lets regulators test the resilience of services outside the sector, though Alder stressed it will not treat those suppliers as financial firms.
His answer is supervisory cooperation rather than new global rulebooks, which he described as hard to agree at present. He proposed building a shared picture of risk, testing scenarios together, from cyber attacks and cloud outages to disruption of digital money, and preparing legal gateways, data-sharing standards and crisis protocols in advance. On AI, he said "the FCA is working with the Monetary Authority of Singapore to develop tools to support safe, responsible AI adoption," and that "the extraordinarily rapid emergence of agentic AI risks takes the importance of this to a whole new level."
The lecture gives a systemic frame to the FCA's more practical AI work this month, from its examples of good and poor practice with chatbots to its own use of AI in market surveillance. Its message for market participants is that the concentration of AI supply, a handful of model and cloud providers serving most of the industry, is now being treated as a financial stability question in its own right, not just a procurement decision for each firm.
Sources: FCA — Beyond borders: Regulating the risks we share, speech by Ashley Alder (delivered Oct 13, published Oct 23, 2026)