On 19 October 2026, the UK’s Financial Conduct Authority (FCA) published examples of good practice and areas for improvement in the adoption of AI in financial services. The publication draws on the FCA’s industry engagement, supervisory work, and AI lab initiatives, and is relevant to regulated firms that develop, procure, deploy, or use AI in their regulated business or wider operations.
The FCA has previously stated that its established approach is to promote the safe and responsible use of AI in UK financial markets and to leverage AI in a way that drives innovation. The publication reflects this approach. The FCA does not propose to implement new rules. Rather, it expects firms to comply with the existing regulatory framework and apply existing requirements to their use of AI. The FCA also emphasises that there is no one-size-fits-all approach; firms should apply these considerations proportionately.
The publication is structured around three key themes:
- Consumer Duty and consumers in vulnerable circumstances;
- Governance and accountability; and
- Operational and cyber resilience.
Consumer Duty and Consumers in Vulnerable Circumstances
The FCA reiterated that firms using AI-supported tools remain responsible for consumer outcomes, including those delivered through products, services, communications, and support. According to the FCA, firms using AI safely and responsibly:
- Identify the consumer need and target market before designing and deploying AI-supported products and services.
- Test consumer outcomes across different consumer characteristics and scenarios.
- Apply proportionate controls to manage AI bias and accuracy, and to ensure that decisions can be explained.
- Explain to consumers how they use AI and its limitations, and test consumers’ understanding where appropriate.
- Monitor outcomes so they can spot and deal with issues quickly.
The FCA identified several areas where firms could improve how they meet their Consumer Duty obligations when using AI. Some firms assumed their AI outputs were clear without testing whether different consumer groups understood them.
By contrast, one firm that used AI to refine its responses to consumer complaints tested the new wording with a sample of consumers before deployment and found that consumers considered it clearer. The FCA’s examples highlight the importance of testing AI outputs with a range of consumers, including those in vulnerable circumstances, rather than assuming they are understood.
Governance and Accountability
Firms should govern their deployment of AI effectively through systems and controls proportionate to their size. Examples of good practice include:
- Ensuring ongoing monitoring, clear escalation routes, and trained oversight functions.
- Ensuring senior managers take reasonable steps to understand and mitigate AI risks within their areas of responsibility, seeking appropriate information and expertise where needed.
- Maintaining meaningful human oversight, rather than treating it as a box-ticking exercise.
- Setting a clear risk appetite to guide decisions on where and how AI is deployed. This includes adapting risk frameworks where necessary to ensure existing controls remain fit for purpose.
The FCA found that some firms had deployed AI tools before establishing clear governance arrangements. As a result, when risks emerged, there was no clear route for escalating issues or challenging decisions, and retrofitting governance after deployment left gaps in accountability.
The FCA also observed that some firms lacked formal processes to test, challenge, and approve AI use cases, or a structured approach to testing and governance, leading to gaps in auditability and documentation. The FCA’s examples highlight the importance of building governance into the design stage of each AI use case and periodically reviewing arrangements to ensure they remain appropriate.
Operational and Cyber Resilience
Firms should ensure that their use of AI is resilient and cyber-secure, so that model failures, changes, or dependencies do not disrupt important business services. The FCA notes the following approaches as examples of good practice:
- Adopting AI systems and architecture that reflect the sensitivity and security requirements of each use case (that is, the particular way in which AI is being used).
- Recognising dependencies on AI models, including those provided by third parties, and integrating them into firms’ operational resilience planning, where applicable.
- Taking steps to mitigate risks from cyber threats and overreliance on a specific AI model or third party.
- Managing third-party relationships proactively so firms have visibility of, and can plan for, model updates or product changes.
Some firms relied on vendors’ assurances without challenging or testing them, even though firms remain accountable for AI services they outsource. Others built products around a single model without a viable alternative or exit plan; in one case, a firm had to redesign its product when the underlying model was retired.
By contrast, another firm designed its AI service so that it did not depend on a single provider, reducing concentration risk and giving it greater flexibility if issues arose with the supplier. The FCA’s examples highlight the importance of testing vendor assurances, reflecting AI dependencies in operational resilience planning, and maintaining fallback and exit arrangements in case a model or provider becomes unavailable.
Key Takeaways for Firms
- Governance from the outset. Governance, accountability, and escalation routes should be built into each AI use case at the design stage, with a named senior manager responsible and arrangements reviewed periodically.
- Test outcomes, don’t assume them. The FCA says firms should be able to evidence that their AI tools deliver good outcomes and are understood by a range of consumers, including those in vulnerable circumstances.
- Manage third-party AI as your own risk. Firms remain accountable for outsourced AI. They should test vendor assurances, mapping AI dependencies into resilience planning, and maintaining fallback and exit arrangements.
- Proportionality is key. There is no one-size-fits-all model, and smaller firms can govern AI effectively through targeted, scaled controls.
- No new prescriptive rules. The FCA expects firms to demonstrate that the existing principles, systems and controls, outsourcing, and conduct of business provide a sufficient framework to govern their use of AI and demonstrate compliance with applicable regulatory obligations.
*Special thanks to Trainee Solicitor Kwame Amony-Ephraim˘ for contributing to this GT Alert.
˘Not admitted to the practice of law.