The Bank of England is the central bank of the United Kingdom and, through the Prudential Regulation Authority, the prudential supervisor of UK banks, insurers and major investment firms. Its AI-relevant work has run through financial-stability and operational-resilience channels rather than through model regulation.
Frontier-model cyber risk
Per a New York Times report of April 22, 2026, the Governor of the Bank of England warned publicly that Anthropic may have "crack[ed] the whole cyber-risk world open" — roughly two weeks before the IMF's May 7, 2026 financial-stability blog named specific frontier-AI capability as a systemic-risk vector (International Monetary Fund (IMF)). Because that warning preceded the IMF designation, the Bank's stress-test scoping work has been described as the most likely first mover among G7 central banks in translating the macro-prudential AI framing into published supervisory practice (AI Macro-Prudential Policy).
On 15 May 2026 the Bank issued a joint statement with the Financial Conduct Authority and HM Treasury holding that the cyber capabilities of current frontier AI models "are already exceeding what a skilled practitioner could achieve, and at a significantly higher speed, greater scale, and lower cost," and setting out expectations for firms and financial market infrastructures across governance and strategy, vulnerability management, third-party risk, protection, and response and recovery (Joint statement on frontier AI models and cyber resilience (FCA, Bank of England and HM Treasury, May 2026)). The statement points firms to the effective practices on cyber response and recovery published by the Bank, the Prudential Regulation Authority and the FCA in October 2025, and commits the authorities to continued engagement with industry through the Cross Market Operational Resilience Group.
Cloud concentration and critical third parties
On July 10, 2026 the UK government designated the Microsoft, Google, Amazon and Oracle cloud units as critical third parties to the financial sector, effective July 13, placing them under joint supervision by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority, with resilience testing and incident-reporting obligations (Source: reuters.com). The designation reaches the infrastructure layer on which financial-sector AI deployment rests. See Financial Services — AI Deployment.
Relationships
- related: Joint statement on frontier AI models and cyber resilience (FCA, Bank of England and HM Treasury, May 2026)
- related: International Monetary Fund (IMF), European Central Bank (ECB), Federal Reserve, Financial Conduct Authority (FCA), Financial Stability Board (FSB), Financial Services — AI Deployment, AI Macro-Prudential Policy