When the chatbot becomes the adviser: AI, financial education and the regulatory perimeter.

Ask a general-purpose AI assistant whether you should overpay your mortgage or top up your pension, and it will answer. It will ask about your income, your age and how much risk you can live with, and it will shape its answer around you. For a great many people this is the first personal conversation about money they have ever had, and it costs them nothing.

If a regulated firm gave the same answer, it could well be advice, with everything that follows from that: authorisation, suitability, records and a route to redress. When the assistant gives it, nobody is authorised, and for most purposes nobody is answerable.

The Financial Conduct Authority has noticed. The Mills Review, published on 6 July 2026 and led by Sheldon Mills of the FCA, looks at what AI means for retail financial services. It observes that general-purpose models can produce recommendations that look very like advice, built on a consumer's own information, while operating outside the regulatory perimeter. It does not propose extending the perimeter now. It recommends instead that the FCA review, within three to six months, how far consumers are relying on these tools for savings, investments, pensions, mortgages and debt, and what harm may follow.

That review should be watched closely well beyond the UK, because the question it raises is one every financial regulator will have to answer.

Where the lines sit today

The UK perimeter is built on activity. Financial education explains how things work. Guidance helps a person understand their options without telling them what to do. Targeted support, introduced by the FCA in April 2026, allows firms to suggest ready-made options to groups of consumers in similar circumstances. Advice is a personal recommendation, and carries the full weight of regulation.

Each step up the ladder brings more protection, and more cost. That cost is the reason so few people take advice, and the reason the advice gap has been a policy concern for more than a decade.

Why AI blurs them

Those lines were drawn for people and for firms. A chatbot crosses all of them in a single conversation: it explains what an ISA is, sets out the options, and then, when pressed, says what it would do in your position.

The usual tests struggle. The developer of a general-purpose model is not a financial firm and has not set out to give financial advice. The user has not engaged anyone. Whether anything is done "by way of business" is an open question. Meanwhile, as the Review notes, regulated firms remain constrained in offering the kind of personal help that unregulated tools now give freely.

The people most likely to rely on these tools are those who could never pay for advice. That is the opportunity, and it is also the risk.

What a regulator would need to let it in

There are two easy answers, and neither works. Bringing every general-purpose model within the perimeter would be unworkable, and would most likely teach the tools to refuse money questions altogether. Leaving matters as they are means accepting that the most widely used source of personal financial help sits outside any protection.

The harder questions lie in between:

• What evidence should a system produce before it is trusted with personal recommendations, and who should test it?
• Can permission be granted narrowly, for defined products or customers, and widened as the evidence builds?
• Can a regulator supervise what a system actually does, conversation by conversation, as well as what its documentation says it does?
• When it gets it wrong, where should liability rest: with the developer of the model, the firm that deploys it, or both?

Regulators are starting to ask these questions. The Mills Review itself recommends that the FCA scale up its AI Lab so that it can assess AI models and systems used in financial services. Answering them well will take time, evidence and a willingness to test.

Why smaller jurisdictions can move first

Gibraltar has done something like this before. In January 2018 it became one of the first jurisdictions to bring distributed ledger technology businesses within a bespoke, principles-based framework, developed in close dialogue between the Gibraltar Financial Services Commission and the firms it would supervise.

The same qualities matter here: a regulator that knows its firms, a legislature able to act quickly, and close ties with the UK market. A small jurisdiction can test careful answers to these questions in a controlled way, and share what it learns, while larger markets are still working out their position.

The question is no longer whether people will take financial guidance from AI. They already do. The question is whether protection will follow them there, and who will show first how that can be done.

I would be glad to hear from anyone thinking about these questions, in Gibraltar, in the UK or elsewhere.

For more insights from our legal experts, please subscribe here.