The Financial Conduct Authority (FCA) has published a report on good and bad practice relating to the use of AI in financial services. It provides a detailed review of how firms are deploying AI across customer-facing services, internal operations, governance and risk management. The examples come from industry engagement, supervisory work and the FCA's AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox.
The report provides a clear indication of the FCA's supervisory thinking on AI. It also offers valuable insight into the areas likely to attract scrutiny during future supervisory engagements, particularly as firms move from experimenting with generative AI to deploying more autonomous and agentic AI systems.
No AI-specific regime, but existing rules still apply
A recurring theme in the report is that firms should not treat AI governance as a separate compliance exercise. The FCA emphasises that its existing regulatory framework already provides the foundation for responsible AI adoption, and that firms remain accountable for the outcomes generated by AI-supported products, services and processes.
This reflects the FCA's consistent message that firms cannot outsource responsibility to algorithms, technology vendors or large language models. Firms remain responsible for regulatory compliance and customer outcomes. This means AI should be analysed through existing regulatory lenses rather than as a standalone technology issue.
Consumer Duty sits at the centre of the FCA's approach
The FCA states that firms deploying AI must continue to deliver good consumer outcomes and remain responsible for the products, services, communications and support delivered through AI-enabled systems. It identifies several examples of good practice, including:
- defining consumer needs and target markets before designing AI-enabled products;
- testing outcomes across different customer groups, including vulnerable customers;
- implementing controls to address bias and improve explainability;
- being transparent with consumers about the role and limitations of AI; and
- monitoring live outcomes to identify and address emerging issues.
The FCA is particularly critical of firms that deploy AI solutions without first establishing the consumer need they are intended to address, or which create barriers for vulnerable consumers through inflexible automated journeys. It also warns against excessive reliance on large language models to identify vulnerability indicators without appropriate testing and safeguards.
Explainability matters more than technical detail
A notable aspect of the report is its focus on consumer understanding. The FCA acknowledges that firms may not always be able to explain complex AI systems in technical detail. However, it emphasises that consumers should understand when AI is being used, what role it plays, what its limitations are, and what options remain available if something goes wrong. It highlights concerns where firms:
- assume AI-generated outputs are clear without testing them;
- provide technical explanations that consumers cannot understand;
- exaggerate the accuracy or reliability of AI systems; or
- focus solely on explaining how a model works rather than demonstrating good outcomes.
Governance and accountability remain board-level concerns
The FCA devotes significant attention to governance arrangements. It identifies common characteristics among firms that it considers to be deploying AI safely, including proportionate governance structures, clear accountability, multidisciplinary oversight, continuous monitoring and effective senior management engagement.
Importantly, the FCA makes clear that governance should cover the entire AI lifecycle, from design and testing through deployment, monitoring and eventual retirement. It is critical of firms that attempt to retrofit governance arrangements after AI systems have already been deployed.
The report also contains important messages for senior managers. While the FCA does not expect senior managers to become technical AI specialists, it does expect them to understand AI-related risks sufficiently to exercise effective oversight and take reasonable steps to manage those risks.
Human oversight is not a complete solution
Many firms have responded to AI risks by introducing "human-in-the-loop" controls. However, the FCA warns that simply adding human review does not automatically reduce risk. It notes that firms can become overly reliant on manual review processes, creating a false sense of comfort while underlying governance or model risks remain unresolved. It also highlights the danger of human oversight becoming a box-ticking exercise rather than a meaningful challenge process.
Operational resilience and third-party risk move up the agenda
The FCA also considers the operational resilience implications of AI adoption. It expects firms to understand and manage their dependencies on AI systems, including models supplied by third-party providers. Firms should consider how model failures, service interruptions, updates or vendor changes could affect important business services and incorporate these risks into resilience planning where appropriate. It highlights several areas of good practice, including:
- mapping AI dependencies within operational resilience frameworks;
- conducting stress testing before deployment;
- maintaining contingency arrangements;
- reducing dependence on a single AI vendor; and
- obtaining visibility of significant model changes from suppliers.
Agentic AI receives early regulatory attention
The report expressly acknowledges the rise of more autonomous AI systems and notes that firms should implement suitable governance structures before deploying them, including accountability mechanisms, escalation routes and compliance controls. It also encourages firms to maintain inventories of AI agents so they can be monitored and managed effectively.
Why this matters
The report provides practical insight into the regulator's evolving expectations and reveals the questions supervisors are likely to ask when assessing AI use cases. It also reinforces several themes that are likely to shape AI governance programmes over the next few years:
- AI risk should be integrated into existing regulatory compliance frameworks rather than treated separately.
- Consumer Duty considerations should be embedded throughout AI design, deployment and monitoring.
- Clear accountability and senior management ownership remain essential.
- Third-party AI arrangements require robust governance and resilience planning.
- Agentic AI will face heightened scrutiny as adoption grows.
Perhaps most importantly, the FCA has signalled that its focus remains firmly on outcomes rather than technology. Firms will be judged less on whether they use AI, and more on whether they can demonstrate that it produces fair, resilient and well-governed outcomes for consumers and markets.
In addition to the report, Jessica Rusu, the FCA's Chief Data, Information and Intelligence Officer, has given a speech on how AI is transforming financial services and that the UK should position itself as a leader in its safe and responsible adoption. Drawing on the recent Mills Review, she highlights the rapid shift from AI experimentation to widespread deployment, including the emergence of increasingly autonomous "agentic" systems, and stresses that firms must prioritise consumer outcomes, maintain clear accountability and governance, and build operational resilience against AI failures. The speech also addresses the growing role of general-purpose AI tools in providing financial information and advice, calling for clearer consumer warnings about the limits of these services. At the same time, the FCA is developing frameworks for agentic finance, and using AI itself to become a "smarter regulator". The overarching message is that innovation and consumer protection must be developed together if the UK is to realise AI's economic benefits while maintaining trust in financial services.
