AI in Financial Services: What the FCA's Good Practice Review Means for Your Firm
The Financial Conduct Authority (FCA) has not introduced new rules for artificial intelligence (AI), but it has made clear that firms remain fully responsible for the outcomes their AI tools produce, whether those tools are built in-house or bought from a vendor. On 19 October 2026 the FCA published AI in financial services: good practice and areas for improvement, setting out examples drawn from industry engagement, supervisory work and its AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox.
The publication is relevant to any regulated firm that develops, deploys, procures or uses AI in connection with regulated activities, consumer journeys, operations or governance. That includes AI embedded in third-party systems and tools staff use to support decisions, so it reaches well beyond firms with their own data science teams. For most smaller and growing firms, the practical question is whether existing Consumer Duty, governance and outsourcing arrangements already capture the AI in use across the business.
What Has the FCA Published, and Does It Create New Rules?
The publication is a good and poor practice document, not a policy statement or consultation. The FCA states that its examples are illustrative and non-exhaustive, that they will evolve as practice develops, and that they do not create new requirements, prescribe a single model or replace a firm's own judgement about what is appropriate and proportionate for its AI use cases. There is no implementation date or transitional period.
What the publication does is show how the existing framework applies. Drawing on its AI Update, the FCA groups the relevant rules under four headings:
Safety, security and robustness: the Principles for Businesses (PRIN), the Threshold Conditions (COND), Senior Management Arrangements, Systems and Controls (SYSC), operational resilience, outsourcing and the critical third parties regime.
Fairness, appropriate transparency and explainability: PRIN, the Consumer Duty, the guidance on the fair treatment of vulnerable customers, COND, related Information Commissioner's Office (ICO) guidance and the Equality Act 2010.
Accountability and governance: the Senior Managers and Certification Regime (SM&CR), alongside the rules above.
Contestability and redress: the Dispute Resolution: Complaints sourcebook (DISP).
The examples are organised around three areas: the Consumer Duty and consumers in vulnerable circumstances, governance and accountability, and operational resilience. The FCA's evidence draws on engagement with firms, industry and consumer bodies, charities, policymakers, technology providers and academics, alongside its work on the Mills Review, AI Live Testing, the Supercharged Sandbox, an "AI in smaller firms" event and the AI Input Zone. Several sections include a specific focus on smaller firms, which is one of the more useful features for firms without dedicated AI or model risk teams.
The FCA's Key Findings
Consumer Duty: Responsibility for Outcomes Stays With the Firm
The FCA's starting point is that firms deploying AI-supported tools remain responsible for the consumer outcomes delivered through their products, services, communications and support. It points firms to its Consumer Duty guidance, FG22/5, and its guidance on the fair treatment of vulnerable customers, FG21/1.
Good practice began before any tool was built. Firms defined the consumer need, target market and intended outcome first, then decided whether AI was the right tool at all. They tested outcomes across consumer characteristics, including vulnerability and digital or financial capability, and checked for unjustified differences between groups. In one example, a firm tested whether vulnerability indicators such as accessibility requirements were influencing fraud suspicion or claim acceptance, and used the results to improve its model.
The areas for improvement are instructive. Some firms built tools without establishing the consumer problem or foreseeable harms. Others applied technical guardrails that reduced model drift but produced overly generic outputs, steering some consumers towards inappropriate options. Some excluded consumers with vulnerability indicators from AI journeys by default. The FCA accepts this may be appropriate in some scenarios, but says it could unfairly exclude those consumers if no alternative route to support is offered.
On consumer understanding, the FCA expects firms to explain the role and limits of AI in terms consumers understand, and it criticises firms that overstated what an AI system could do or were unclear whether AI or a person performed a function. It highlights auditable records of prompts, outputs, model versions, filters and escalation decisions, which support complaints handling and challenge. On vulnerability, it cautions against assuming a large language model (LLM) can reliably identify text-only indicators, particularly temporary ones, without thorough testing. The FCA also notes that it has not covered every aspect of the Duty, such as fair value, but that this does not remove the need for firms to consider them.
Governance and Senior Manager Accountability
The FCA states that firms are responsible for the AI systems they develop, procure and deploy, including their outputs and outcomes. It expects proportionate governance covering the full AI lifecycle, which it describes in six stages:
initial scoping
design and development
testing and validation
deployment
ongoing monitoring
decommissioning
The weaknesses identified will be familiar from other governance reviews: informal or inconsistent approval processes, limited involvement of control functions, and "retrospective governance", where tools were deployed first and then fitted into existing frameworks. In one case, when risks emerged, several teams believed oversight sat elsewhere and there was no clear route to escalate issues.
On the SM&CR, the FCA is clear that it does not expect senior managers to be technical specialists. It does expect them to take reasonable steps to understand the AI risks in their area of responsibility, obtain appropriate expertise, provide effective challenge and ensure governance and escalation arrangements remain appropriate. Delegating AI development entirely to technical teams without sufficient understanding or challenge was a particular concern for higher-risk use cases, including those affecting consumers. Poor documentation meant some senior managers could not show the steps they had taken. Among smaller firms, one mapped every material AI use case to a named senior manager, with documented risk appetite and escalation routes, before deployment.
Human Oversight Must Be Meaningful
A recurring message is that a person reviewing AI outputs is not, on its own, an adequate control. The FCA criticises excessive reliance on human-in-the-loop controls without addressing the underlying model risk, and describes a firm where reviewers gradually accepted AI recommendations without proper scrutiny until the role became a tick-box exercise. Better practice included risk-assessing where human oversight is needed and ensuring reviewers have the expertise and authority to escalate. One firm had staff assess affordability cases without seeing the AI's proposed outcome, so it could compare independent human and AI judgements and reduce the risk of automatic deference to the system.
Risk Appetite, Thresholds and Monitoring
Effective boards treated AI as a strategic business issue and set a risk appetite for AI use cases, translated into practical thresholds, metrics and escalation routes. One firm used red, amber and green performance thresholds agreed between the business and model risk teams, with predefined actions when performance moved into amber or red. On monitoring, the FCA found that firms tracking only technical metrics, rather than real-world outcomes, had less meaningful oversight, and that some second and third line functions lacked the AI-specific capability to challenge emerging risks. Firms developing agentic AI were seen registering their agents in a central inventory showing ownership, system access and the controls that apply.
Operational Resilience and Third-Party AI
Firms can outsource AI services, but they remain responsible for them. The FCA identified overreliance on untested vendor assurances, dependence on hard-to-replace providers, and single-platform arrangements with no exit plan. In one example, a firm had to redesign a product when the underlying model was retired. Good practice included contractual rights to notice of significant model changes, assessing prospective suppliers' own use of AI during procurement, and keeping an inventory of AI use cases and the models behind them.
For firms within scope of the operational resilience rules in SYSC 15A, the FCA states that considering dependence on AI models when assessing severe but plausible scenarios is a requirement. Wider cyber risks from frontier AI models are outside the scope of this publication. For those, the FCA points to its joint statement with the Bank of England and HM Treasury and its multi-firm review on frontier AI and cyber resilience.
What Are the Key Themes for Firms?
Taken together, four broader messages emerge from the publication:
Existing rules apply in full. The FCA has not created a separate AI rulebook; it looks at AI through the Consumer Duty, the SM&CR, SYSC, DISP and related requirements.
Design comes before deployment. Many of the weaknesses the FCA describes stemmed from deploying first and governing later.
Evidence matters. Records of approvals, reviews, overrides and escalations are what allow a firm, and its senior managers, to demonstrate that reasonable steps were taken.
Proportionality is recognised. The FCA expressly accepts that smaller firms can govern AI through targeted controls, existing committees, simpler risk tiers and narrower use cases.
What Should Firms Do Now
The right response depends on how a firm uses AI. A firm using a vendor chatbot in its customer journey faces different questions from one using AI internally to summarise files or draft documents. In most cases, a proportionate review of existing arrangements will be more appropriate than building a new framework.
We would suggest firms consider the following steps:
Identify where AI is used. Build an inventory covering in-house tools, AI embedded in vendor systems and tools staff use to support decisions, distinguishing experimental from live use.
Assess risk proportionately. Tier each use case by its potential impact on consumers, markets and important business services, and focus effort on consumer-facing and decision-making uses.
Confirm accountability. Assign each material use case to a named senior manager and check that SM&CR documentation reflects this.
Test against the Consumer Duty. Review whether outcomes testing, vulnerable customer arrangements and complaints records cover AI-supported journeys, and whether customer communications describe the role and limits of AI accurately.
Review third-party arrangements. Check due diligence, notice of model changes, fallback and exit options and, for firms in scope of SYSC 15A, whether AI dependencies are reflected in resilience mapping and scenario testing.
Update monitoring and management information. Add AI outcomes to the compliance monitoring plan and give the board management information that tracks outcomes, not only technical performance.
Train by role. Senior managers, technical staff and human reviewers need different levels and types of training.
Document decisions. Record approvals, risk assessments, overrides and escalations so that oversight can be evidenced if the FCA asks.
Frequently Asked Questions
Has the FCA introduced new rules for AI in financial services?
No. The FCA's publication of 19 October 2026 states that its examples do not create new requirements. Firms' use of AI is governed by existing rules, including the Principles for Businesses, the Consumer Duty, SYSC, the SM&CR and DISP.
Which firms does the FCA's AI good practice publication apply to?
It is relevant to regulated firms that develop, deploy, procure or use AI in connection with regulated activities, consumer journeys, operations or governance. This includes AI supplied by a third party, embedded in another system or used by staff to support decision making.
Do senior managers need to be AI experts?
No. The FCA says it does not expect senior managers to be technical specialists. They should, however, take reasonable steps to understand the AI risks in their area, obtain appropriate expertise and provide effective oversight and challenge.
Is human review of AI outputs enough to manage the risk?
Not on its own. The FCA identified excessive reliance on human-in-the-loop controls as an area for improvement and warned that review can become a tick-box exercise. Oversight should be designed around the use case, with clear authority, expertise and escalation thresholds.
How should smaller firms respond to the FCA's AI expectations?
Proportionately. The FCA saw smaller firms build AI oversight into existing governance, use simpler risk tiers, start with narrow use cases and test with sample outputs rather than at scale, while keeping named accountable individuals and clear audit trails.
How Compliance Angle Can Help
Compliance Angle supports FCA-regulated firms in reviewing how their use of AI fits within their existing regulatory framework. Our support is practical and proportionate, tailored to each firm's business model, permissions, size and regulatory risk. Relevant support includes:
regulatory health checks and gap analyses covering AI use across the business
governance and SM&CR support, including allocating accountability for AI use cases
Consumer Duty support, including outcomes testing and vulnerable customer arrangements for AI-supported journeys, building on our guide to Consumer Duty outcomes monitoring
policy and procedure development, including AI governance and third-party oversight
compliance monitoring and ongoing compliance support, including monitoring plans that cover AI outcomes and acting as an outsourced compliance function
risk management and governance support, including setting risk appetite and thresholds for AI use
reviews of customer communications that describe the use of AI
role-based compliance training for senior managers and staff reviewing AI outputs
If your firm uses AI, or is planning to, and you would like to discuss whether your arrangements reflect the FCA's expectations, please contact us or email info@complianceangle.co.uk.
Source: Financial Conduct Authority (FCA), "AI in financial services: good practice and areas for improvement", published 19 October 2026, last updated 20 October 2026.
