Governance is a growth strategy (and it’s not just us that says it.. Thanks Mills Review!)

At Friday, we've spent years arguing an unpopular point: that data governance, done properly, is not the thing that slows a business down. It's the thing that lets you and your business move faster.

For most of that time it's been a lonely argument. Governance has always been cast as the brake, the cost centre between a good idea and the market, the department that says no. You know the dance.

The FCA's new Mills Review, their 147-page look at AI and the future of retail financial services, quietly ends that argument in our favour. Buried in the chapter on how firms change is a line every board should sit up for: Governance is likely to become an enabler of capability.

Not a safeguard. Not a tax on innovation. An enabler. And the report is explicit that this isn't a nice-to-have bolted on at the end. These are “not additional safeguards, but the conditions that enable AI to be deployed in regulated environments.”

So let us tell you what we think it means in practice.

The reason governance changes isn't ideological, it's mechanical. AI breaks the frameworks firms already have because, as the review puts it, models "update continuously rather than on fixed release cycles, they draw on third-party inputs that a regulated firm did not create or build, and… they are probabilistic in nature."

Sit with each, because each breaks something specific.

Continuous updates: kill the annual review. You can't sign a model off in January and assume it behaves the same in June. 

Third-party inputs: mean you're accountable for decisions shaped by data and models you didn't build. Your affordability call, your fraud screen, your creditworthiness assessment are all increasingly reliant on someone else's output. 

Probabilistic outputs: mean "it passed testing" proves less than it used to. The system will sometimes be confidently wrong, and your governance has to expect that rather than be surprised by it.

The review's conclusion follows: managing these systems "may no longer work through periodic reviews but operate continuously alongside the systems it is designed to control." Governance stops being a one-off approval you get before launch and becomes something you do continuously, for as long as the system is running. 

Here's the sentence we'd frame and hang on the wall. Firms that can demonstrate "auditability, explainability where needed, robust testing, clear permissions, effective monitoring and escalation will be able to deploy AI more confidently." The ones that can't "may be slower to adopt."

Then the review goes somewhere a regulator rarely does, into commercial territory. Because trust is the main barrier to consumers actually using AI in finance, "acquiring a reputation for trusted AI processes could win business."

So the maths changes. Governance is no longer the cost of doing AI. It's the thing that lets you ship faster than the firm next door, and the thing that earns the trust that converts into customers. Treat it as an afterthought and you don't just carry more risk, you're slower to move and less trusted when you do.

The review is honest about who's positioned to win. It says the firms that embed these capabilities well "will likely distinguish winners and losers," and warns that into 2030 incumbents may still hold the cards "proprietary data, brand and customer trust, capital, governance and vendor relationships." Bigger firms can negotiate better terms from vendors, too.

You can't manufacture a decades-old brand. You can't conjure a balance sheet, or the buying power to lean on a vendor. But governance? That you can build. The review even names the gap smaller firms face: "higher relative governance, testing and assurance costs." That reads like a disadvantage. But it's the one moat on the incumbents' list a challenger can close by choice, rather than by waiting twenty years.

So three moves follow, and they're the ones we make with clients every week.

Move from point-in-time to live. If your governance is a document reviewed quarterly, it's already behind your models. Assurance has to run alongside the system, not chase it.

Get your third-party layer in order. You are accountable for outputs you didn't build. That means knowing what data and models sit under your decisions, and being able to evidence how they're controlled before a regulator, a client, or an acquirer asks.

Treat auditability as a commercial asset, not a filing cabinet. If governance now wins business, and the ability to show it to a customer or an investor, is a capability worth building like one.

None of this is about slowing down. It's the opposite. The Mills Review has, more or less, written down what we've believed since we started Friday: done properly, governance is what unlocks the value in your data, and what lets you move and build trust.

Read the Mills Review here: https://www.fca.org.uk/publication/corporate/the-mills-review.pdf