November 2026 – November 2028. A curated view of open consultations, upcoming implementation deadlines and expected regulatory developments across resilience, TPRM, AI, cyber, operational risk and governance.
Editorial baseline: 12 November 2026 · Curated, not an automatically updated live feed
HMT may designate additional providers beyond the four cloud providers designated in July 2026. A rolling process is confirmed, but no further provider names or designation dates are announced.
Watch Bank of England, PRA and FCA reporting on CTP self-assessments, resilience testing, incident oversight and the effectiveness of joint supervision. No standalone annual progress report is confirmed.
The ESAs publish and update the critical ICT third-party provider list annually; track additions, removals, oversight recommendations and progress of joint examination teams.
Monitor implementation of the January 2026 UK–EU MoU on information sharing, cross-border incidents and coordination between UK CTP and DORA CTPP oversight.
The FCA is exploring how general-purpose LLMs affect the distinction between information, guidance and regulated advice. Its 6 November 2026 response says no separate time-bound perimeter review is planned; clarification of existing guidance is being considered. This is not an open consultation.
The FCA stated on 6 November 2026 that a policy statement on simplifying pensions and investment advice rules is expected by year-end. Related to the AI advice boundary and technology-neutral Targeted Support, but not itself an AI-specific rule.
FCA proposals address AI-enabled financial crime controls, third-party tools, effectiveness and governance.
FCA guidance consultation on DeFi operational resilience and financial crime risks.
PRA PS7/26 and associated supervisory expectations: incident reporting, MTP notifications and annual registers. Check firm-specific scope.
Bank of England reporting requirements for relevant financial market infrastructures.
Final guidelines published September 2026; implementation and two-year transition require monitoring. Do not treat this date range as a confirmed application date.
High-risk AI rules for Annex III uses apply, subject to scope and exemptions.
Extended deadline for high-risk AI embedded in specified regulated products; not a blanket financial-services deadline.
Monitor supervisory guidance, critical ICT third-party oversight and implementation experience; DORA is already applicable.
Track actual rule changes and equivalence or cooperation developments; closer political ties do not imply automatic regulatory alignment.