UK regulator issues AI guidance for financial services firms

A framework for existing rules

The Financial Conduct Authority (FCA) recently published a webpage titled "AI in financial services: good practice and areas for improvement." This guidance aims to help financial services firms understand how to apply current regulations to new and untested AI scenarios. As LawFuel.com reported, the regulator is choosing not to create new, sector-specific rules for artificial intelligence.

Instead, the FCA wants firms to use common sense and proportionality to map their specific AI use cases against the regulator's identified good and poor practices. The guidance is designed to be dynamic, meaning the FCA intends to update it as AI tools continue to evolve. This approach ensures that the regulatory framework stays relevant without becoming overly prescriptive for every unique business model.

The move follows a House of Commons Treasury Select Committee report that urged the FCA to provide practical guidance by the end of 2026. The committee specifically wanted clarity on consumer protection and the level of assurance expected from senior managers. By releasing this guidance, the FCA is providing a roadmap for the 86% of firms already integrating AI into their operations.

Protecting consumers and the vulnerable

A primary focus of the new guidance is the Consumer Duty, which requires firms to design products that meet the needs and characteristics of their customers. The FCA warns that AI tools could result in consumer harm that a firm might not have initially anticipated. It suggests that firms should explore how AI can offer solutions rather than letting AI lead the design of the service itself.

The regulator highlights that AI should support tasks that remain staff-led, with clear points where the tool should abstain or escalate to a human. For example, firms are encouraged to test outcomes across different consumer groups to ensure there are no unfair or unjustified differences. The FCA specifically cautions against excluding vulnerable customers from AI tools by default, expecting firms to find ways to produce good outcomes for them.

To manage risks like hallucinations, the FCA suggests limiting chatbots and generative AI assistants to approved source material. Firms are also encouraged to maintain auditable records of consumer prompts, model versions, and escalation decisions. These records are essential for checking outcomes if a consumer challenges a decision made or influenced by an AI system.

Governance and senior accountability

The FCA identified a major concern that many firms are under-investing in sound governance or only applying it after an AI tool has already been deployed. The regulator stresses that governance models must cover the full lifecycle of an AI system, from initial scoping and design to testing and eventual decommissioning. They want to see formal processes in place rather than informal arrangements that can lead to gaps in accountability.

Crucially, senior managers remain personally accountable for AI systems under the Senior Managers and Certification Regime (SMCR). The FCA clarifies that these managers do not need to be technical specialists, but they must take reasonable steps to understand the risks in their area of responsibility. This includes obtaining the necessary expertise and providing effective oversight to challenge AI-driven outputs.

For larger organizations, the FCA suggests creating central bodies like AI boards or data ethics committees to oversee these risks. Smaller firms may instead incorporate AI oversight into their existing frameworks with targeted controls. Regardless of size, the regulator expects clear ownership of AI risks to be assigned from the very beginning of each use case's design phase.

Operational resilience and third parties

The guidance also addresses operational resilience, warning firms against becoming overly dependent on a single AI provider or model. If a single solution is withdrawn or becomes less effective, it could create significant business disruptions. The FCA suggests that firms should design their architecture to allow for switching between different providers if necessary.

Third-party implementations are becoming a larger share of the total AI systems reported by firms, making robust oversight of vendors critical. The FCA advises firms to clearly define responsibilities in contracts and proactively build in visibility of upcoming model changes. They also warn firms not to rely solely on a vendor's assurances without conducting their own independent testing.

To build resilience, the regulator suggests testing lower-risk use cases before full deployment and conducting stress tests to identify vulnerabilities. Firms are encouraged to keep relationships clearly documented, including which specific models are used for which use cases. This level of detail helps firms plan for the impact of updates or changes made by third-party AI developers.

The path forward for firms

While the FCA is not introducing new rules, it is increasing supervisory scrutiny on how firms manage their AI use. Firms are expected to map their current activities against the new guidance and be ready to evidence how they meet the regulator's expectations. The FCA notes that it is becoming an "agentic regulator," embedding the recommendations of the Mills Review into its live work.

For firms looking for additional benchmarks, the FCA points toward the Financial Stability Board (FSB) sound practices for the responsible adoption of AI. These practices offer 12 specific points for organization-wide governance and include illustrative case studies. While these are not binding, the FSB strongly encourages boards to use them as a tangible framework for benchmarking their own systems.

The overall message from the regulator is one of proactive responsibility. Firms must ensure that human oversight is not just a "tick box" exercise but involves people with the authority and capability to intervene. By focusing on transparency, auditable trails, and robust governance, firms can navigate the transition to AI-enabled services while remaining compliant with existing UK laws.