FCA publishes good and poor practice and sets out its latest thinking on AI in financial services

22 10月 2026

A new FCA publication on AI in financial services: good practice and areas for improvement (Publication) sets out key findings and practical examples of good and poor practice (with 20 brief case studies) from the FCA’s engagement with firms, industry and consumer bodies, technology providers, academics and policymakers. The FCA’s evidence base also draws on its supervisory work and AI Lab initiatives (e.g. AI Live Testing and the Supercharged Sandbox), together with work on the Mills Review.

The Publication is relevant to regulated firms that develop, deploy, procure or use AI in connection with regulated activities, consumer journeys, operations or governance.

In a related development, Jessica Rusu, FCA chief data, information and intelligence officer, has delivered a speech on ‘Building the future of finance in the age of AI’ (Speech). As well as referring to the Publication, the Speech outlines the FCA’s response to the Mills Review recommendations, describes the FCA’s ambitions for AI adoption in UK financial services, considers frontier AI and agentic finance, and explains how the FCA is itself using AI as part of its strategic goal to become a smarter regulator.

Our blog post considers both the Publication and the Speech, highlighting the key takeaways for firms and the next steps.

Key takeaways for firms

The existing regulatory framework and FCA rules apply in respect of firms’ adoption and use of AI. This means that firms remain accountable for outcomes and bear regulatory responsibility for compliance with applicable rules, including systems and controls, accountability and governance, operational resilience, consumer protection, complaints and redress. This is the case whether the AI tools used are internally developed, outsourced, embedded or used by staff to support decision-making.
The purpose of the Publication is to support the safe and responsible adoption of AI in financial services. The examples of good practice and areas for improvement are to help firms understand what ‘good’ looks like in this context, and what can be learned from and improved. They identify common themes and evolving practices, relevant to a range of AI use cases, including those using machine learning (ML), generative AI and agentic AI.
In the Publication, the FCA’s key findings and examples are organised into three focus areas:
1. Consumer Duty and consumers in vulnerable circumstances, where the focus is on how firms use AI to achieve good consumer outcomes.
2. Accountability and governance, where the focus is on how firms oversee and effectively govern across the AI lifecycle.
3. Operational resilience, where the focus is on how firms ensure they deploy AI securely and sustainably.
The examples do not create any new requirements for firms or prescribe a single AI model – they are illustrative only and will evolve. They do, however, give firms an indication of the analysis and practical steps (e.g. in relation to developing and testing AI-supported products and services, systems and controls, governance and monitoring, among others) that the FCA may consider when carrying out its supervisory work.
Firms are responsible for assessing what is appropriate and proportionate for their own AI use cases, together with an assessment of the risks and potential impact. Notably, more autonomous agentic AI systems affect risk and increase the importance of continuous assurance, delegated-authority controls, accountability and incident reporting.
The FCA is itself using AI to develop its future as an agentic regulator. This is part of its work to become 'smarter'.

The Publication

Background

In March 2026, in response to one of the recommendations made by the House of Commons Treasury Committee following its inquiry into AI in financial services, the FCA committed to sharing examples of good and poor practice.

The FCA took forward this commitment as a dedicated workstream running alongside the FCA Board-commissioned Mills Review into the impact of AI on retail financial services (for an overview of the Mills Review and its recommendations, see our blog post). It engaged directly with industry, including through an AI Input Zone online survey in Q2 2026 that sought to establish what firms considered to be working well, where there are challenges, and the themes and topics the FCA should address in its examples.

Scope

The Publication is relevant to regulated firms that develop, deploy, procure or use AI in connection with regulated activities, consumer journeys, operations or governance. For the avoidance of doubt, the FCA confirms this covers AI tools that are:

developed in-house;
supplied by a third party;
embedded in another system; or
used by staff to support decision making.

The Publication also includes 20 brief case studies and a focus section for smaller firms in relation to each of the three focus areas (these case studies and focus sections are not covered in this blog).

There is no ‘one-size-fits-all’ approach. Firms retain responsibility for responding proportionately to each AI use case, the risks and the potential impact.

The examples of good practice

In the Publication, the FCA explains that the examples of good practice:

“... identify common themes and developing practices which are relevant to a variety of AI use cases, such as those using machine learning, generative AI or agentic AI. They are illustrative, non-exhaustive and will evolve as practice develops.”

Two points in particular stand out - the examples are:

Thematic and illustrative. As noted above, the FCA makes clear that they create no new requirements and neither specify a single model nor replace firms’ responsibility for assessing what is appropriate and proportionate for their own AI use cases, together with an assessment of the risks and potential impact on consumers and markets.
Subject to future change. The Publication notes that the examples will evolve, while in the Speech, Jessica Rusu comments that the good and poor practice “is not intended to be static guidance”. She adds that the FCA “will update it as the technology evolves.” Given the speed of technological development, this is not only practical, but essential.

Three focus areas and the FCA's key findings

The Publication is organised around the following three focus areas and, in each case, the FCA summarises its key findings before providing examples of good practice and areas for improvement. In summary, these are:

Consumer Duty and consumers in vulnerable circumstances (described in the Speech as “putting consumers first”), where the focus is on how firms use AI to achieve good consumer outcomes. The FCA highlights that firms that deploy AI-supported tools remain responsible for consumer outcomes. Its key findings (also reflected in the examples of good practice) are that firms using AI safely and responsibly are:

Defining consumer need/the target market before AI-supported products and services are designed and deployed.
Testing consumer outcomes across different consumer characteristics and scenarios.
Managing AI bias and accuracy through proportionate controls and ensuring that decisions are explainable.
Informing consumers about their AI use (and its limitations) and testing consumer understanding where appropriate.
Monitoring live outcomes so they can identify and deal with issues quickly.

Accountability and governance, where the focus is on how firms oversee and effectively govern across the AI lifecycle. Effective governance in this context means proportionate oversight, clear accountability and risk-based controls, with the AI lifecycle typically comprising initial scoping; design and development; testing and validation; deployment; ongoing monitoring; and decommissioning.

The FCA reminds firms that they are responsible for the AI systems they develop, procure and deploy, including their outputs and outcomes. It acknowledges that deploying AI may create new governance and operational challenges. The FCA’s key findings (also reflected in the examples of good practice) are that firms deploying AI safely and responsibly generally share common features, including:

Human oversight and escalation triggers that are clearly defined.
Multidisciplinary governance - evidenced and supported by continuous monitoring.
Clear accountability, governance and SMF oversight/challenge in respect of AI risks.

Operational resilience, where the focus is on how firms ensure they deploy AI securely and sustainably. The FCA’s key findings (also reflected in the examples of good practice) are that firms deploying AI safely and responsibly share common approaches, including:

Adopting AI systems and architecture reflecting their use case sensitivity and security requirements.
Recognising and integrating AI model dependencies into their operational resilience planning (where applicable).
Acting to mitigate risks from cyber threats and over-dependence on a specific AI model or third party.
Proactively managing third-party relationships to ensure they have visibility and can plan for model updates or product changes.

The examples of good practice and areas for improvement - a brief summary

The examples of good practice and areas for improvement identified by the FCA are briefly summarised in the table below, under the three focus areas.

1. Consumer Duty and consumers in vulnerable circumstances
	Good practice	Areas for improvement
Products and services	Choosing where AI should support, automate or abstain (i.e. a task remains staff-led). Managing AI bias risks at the design stage. This involves testing for unfair/unjustified differences across relevant consumer groups and scenarios, addressing any issues, retesting, then ongoing monitoring for bias. Defining consumer need, before developing or deploying a product - firms start with a clear consumer problem, target market and intended outcome before deciding whether AI is the right tool and, if so, in what form. Testing outcomes across different consumer characteristics (including vulnerability and financial/digital capability) and scenarios.	Building an AI tool without first establishing the consumer problem, target market or foreseeable harms. Implementing technical model guardrails without fully considering how to support good consumer outcomes (i.e. guardrails may address one risk, but create another). Excluding vulnerable consumers by default. To reduce risk, some firms automatically excluded consumers with vulnerability indicators from AI journeys - this may be appropriate in some circumstances, but could be unfair if firms do not otherwise provide the means for these customers to access support or benefits that meet their needs.
Consumer understanding	Explaining to consumers when/how AI has been used and what its limitations are. Using AI to assess consumer communications and make them clearer, incorporating a final human review as part of the process. Using approved source material and guardrails to reduce hallucinations or inappropriate responses. Maintaining records that can be audited (e.g. consumer prompts, outputs, filters applied etc)to help monitor outcomes, complaints handling, explainability and investigation, should a consumer challenge an outcome.	Assuming AI outputs are clear and helpful without testing whether different consumer groups understand them. Giving consumers technical information about an AI model without an adequate explanation of what it means for them. Overstating the accuracy, reliability or role of AI systems, or being unclear about whether AI or a person performed a particular function. Taking a purely technical approach to explaining an AI model’s actions.
Consumer support and vulnerable consumers	Using AI tools to identify potential needs and respond appropriately. Giving consumers choice and continuity, e.g. allowing consumers (where appropriate) to choose between AI-enabled or non-AI support for straightforward tasks, with the ability to changes channels without having to repeat information. Combining AI monitoring with sample reviews and structured governance to enable learning from unexpected scenarios to refine prompts, controls or criteria for escalation.	Having weak monitoring and escalation processes in place (e.g. long gaps between reviews of live outcomes or vague definitions of escalation triggers). Assuming a large language model (LLM) can reliably identify vulnerability without sufficient testing or safeguards. Creating inflexible automated journeys, which can make it harder for consumers to access support.
2. Governance and accountability
	Good practice	Areas for improvement
Governance framework	Taking a risk-based approach, with structured challenge, testing and sign-off before deploying new AI systems. Establishing central AI governance bodies (e.g. data ethics committees or AI boards) with members from different areas of the business. Scaling AI oversight through existing governance frameworks. Clear governance of AI throughout the consumer journey. Escalating ethical issues emerging from AI systems for senior consideration (e.g. setting up committees to consider and address any such issues). Building a suitable governance structure for more autonomous agentic AI systems before deploying them.	Having informal processes for testing, challenging and approving AI use cases, or generic governance. Applying retrospective governance after designing and deploying AI use cases. Operating AI governance procedures in isolation or solely for specific AI lifecycle phases. Unclear, fragmented or overly diffuse responsibility for AI systems (e.g. across technology and business teams and/or across regions or business lines).
Monitoring and oversight	Adopting forward-looking monitoring (e.g. continuous monitoring dashboards; post-implementation monitoring groups; and logging and audit trails of AI interactions). Using structured evaluation frameworks to assess generative AI outputs against clear criteria. Providing ongoing training (some role-specific) and capability reviews of staff human-in-the-loop and oversight functions. Undertaking periodic review of governance arrangements to ensure they remain appropriate and current.	Having a narrow monitoring focus (e.g. technical metrics rather than outcomes), which can lead to less meaningful oversight. Monitoring that is reactive or static - unadapted for AI systems. Maintaining oversight functions that lack AI-specific capability (e.g. insufficient expertise in second- and third-line oversight functions to enable emerging risks to be identified and challenged).
Senior management function (SMF) and reasonable steps	Assigning clear SMF ownership for AI risks. Assigning accountability and risk ownership at the outset (i.e. from the design stage onwards) for each AI use case. Ensuring SMF oversight is informed, documented and auditable (e.g. decision records that include rationale, challenge and escalation). Establishing and evidencing clear escalation routes, including formal threshold-based escalation to governance bodies. Giving targeted SMF training so that senior managers understand AI risks and discharge their responsibilities effectively. The FCA does not expect senior managers to be technical specialists. However, they should take reasonable steps to understand the risks arising from AI use within their area of responsibility and, where necessary, obtain appropriate information and expertise.	Poor documentation of decisions on AI tools, with limited audit trails or supporting rationale. Delegating responsibility for AI development entirely to technical teams without sufficient understanding or effective challenge. This is particularly concerning for higher-risk AI use cases, including those affecting consumers. No clear link between AI risk assessment and SMF accountability.
Human oversight	Maintaining human-in-the-loop as a risk-based control. Using AI to support rather than replace human judgement. Embedding escalation routes into AI processes (e.g. human-in-the-loop controls at key design and operation stages).	Placing excessive reliance on human-in-the-loop controls, (i.e. staff overseeing AI outputs) without addressing underlying model risk or governance responsibilities. Lack of meaningful oversight, where human review of AI outputs is a 'box-ticking' exercise.
Risk appetite, thresholds and oversight	Board ownership of AI strategy and oversight, with effective boards treating AI as a strategic business issue. Using risk appetite to guide AI development and oversight. Adapting existing risk frameworks for AI. Clear ownership and oversight of AI agents.	Undefined risk appetite and thresholds, limiting the board’s ability to judge acceptable outcomes. Defaulting to avoiding risks that are close to regulatory boundaries, rather than identifying management and mitigation steps, can also lead to unintended poor outcomes.
3. Operational resilience
	Good practice	Areas for improvement
Operational and cyber resilience	Assessing hosting choices for AI resilience and making considered decisions on where to host AI models. Using back-up infrastructure to support continuity. Piloting lower-risk use cases before full deployment, to identify and mitigate any issues at an early stage and avoid major operational impact. Stress-testing AI tools before deployment to identify potential vulnerabilities and refining guardrails before deployment. Mapping AI dependencies, including those hosted externally, into resilience planning.	Failing to consider AI use or AI model dependencies in operational resilience plans (where applicable). Not considering the business impact of a move from low-risk AI use cases into more material ones.
Third-party relationships	Reducing single-vendor dependence. Keeping clear records of AI use cases, the models on which they were built and providers. Maintaining visibility of vendor model changes to reduce disruption by understanding upcoming updates and planning for their impact. Contingency planning for disruption/unexpected changes to third-party AI arrangements. Assessing suppliers' AI use as a routine aspect of the procurement process and including contractual obligations for suppliers to use AI securely.	Overreliance on untested or unchallenged vendor assurances. Firms remain accountable for outsourced AI services and without testing assurances they may not understand model limitations, resilience dependencies or fallback arrangements. Overreliance on hard-to-replace individual AI providers, which can create operational resilience risks. Having single-platform dependence without exit options in the event the chosen model becomes unavailable or unsuitable.

The Speech - update on the FCA’s thinking on AI

As noted above, the Speech brings together different strands of the FCA’s AI initiatives to offer a helpful update on the regulator’s current thinking and approach to firms’ adoption of AI. The key points include the following:

The FCA’s response to the Mills Review recommendations

The FCA is embedding six of the seven priority recommendations into live work immediately. To understand how firms are deploying AI systems, the FCA’s focus is on “testing, assurance, monitoring and surveillance: directly with industry”. Its innovation services - such as the AI Lab - afford direct insight into what firms are building and developing.
To clarify the existing boundary between regulated and unregulated activity, and the corresponding consumer protections, the FCA is calling on AI providers to use “clear, proportionate and consistent disclaimers” to help consumers understand the limits of financial information and advice generated by their models.
The Mills Review recommended creating a trusted public-interest AI-enabled financial capability service (the seventh priority recommendation). Instead, the FCA will build on existing work, including IOSCO’s first TechSprint (the outcome of which was announced earlier this month) which was powered by the AI Lab, to help investors spot scams, verify information and challenge unreliable AI outputs.
The Mills Review’s remit was on retail markets, but the AI transition extends into wholesale markets, where it is accelerating firms' analysis, trading, monitoring and decision-making.

Frontier AI and agentic finance

The FCA is working with banks to understand how frontier models are changing cyber defence; it is using these insights directly, to develop its supervisory and policy response.
Firms need to invest now in cyber and operational resilience. The existing requirement to report major incidents must extend to significant AI failures and near-misses; near-miss reporting for agentic AI is a regulatory priority. (Note that the Speech does not expand on what the FCA would understand a ‘near-miss’ to be, and the Publication does not specifically refer to firms’ incident reporting requirements, so firms will need to wait to see whether the FCA will provide additional clarification or guidance on this in an AI context.)
Agentic systems need continuous, conditional assurance. The FCA will work with industry, other regulators and frontier labs to develop a “trusted framework for agentic finance”. This will combine clear approaches to agent identity, delegated authority, accountability and execution.

Becoming an agentic regulator

Part of the FCA’s ongoing work to become a smarter regulator involves developing its future as an agentic regulator, using the same technologies reshaping the financial markets to make itself “sharper, faster, and more effective”.
The FCA is adopting AI to scale its operations and focus on the greatest harms. For example, it is deploying automation and building AI agentic tools for supervisory purposes, and working on machine-readable data collection APIs.
The ability to leverage the AI Lab and Sandbox environment is increasingly important for system-wide simulations and supervision methods.

What next?

The conclusion of the Speech neatly encapsulates the opportunities and challenges facing firms and regulators:

“AI is moving faster than any regulatory framework was designed. That means regulators will increasingly need to make judgements without precedent, while ensuring that trust remains at the heart of financial services.”

As the Publication makes clear, the FCA sees the potential for AI to benefit consumers, clients and firms. Importantly, it has found through its work that this is the case whether firms deploy AI directly in consumer- or client-facing products and services, or purely internally for efficiency gains and operational improvements.

However, AI must be deployed safely and responsibly. In the Speech, Jessica Rusu states that “protecting consumers starts with how firms deploy AI”, and she expresses the FCA’s belief that “developing the best approach to deploying AI safely is what will differentiate the UK market”.

There have been calls from firms for greater clarity on how to interpret and govern increasing use of AI within the existing technology-neutral regulatory regime. The examples the FCA provides in the Publication are therefore designed to be practical, but they are relatively high-level and the case studies are noticeably short. Nevertheless, the threefold focus on putting consumers first, clear governance and accountability, and operational resilience planning offers a potentially useful framework for firms to help manage their AI adoption through the full lifecycle. There is much for firms and their senior management to carefully consider here, to establish what may need to change and how best to achieve this.

Coming up - hot on the heels of the Publication - is the fourth edition of the Bank of England and FCA joint survey of AI adoption by the financial services sector. The Speech notes that this will be published next week, with the headline figure being that 86% of firms are using AI (by comparison, in the third edition of the survey, published in November 2024, that figure stood at 75%).

The challenge is clear: firms and regulators will need to keep pace.

Please get in touch with our team if you would like to discuss the Publication or the Speech in the context of your firm's AI strategy or regulatory obligations.

Article tags

good and poor practice Mills Review FCA operational resilience supervision AI consumers agentic finance Consumer Duty governance

Related categories

Regulatory UK FinTech

Key contacts

Marina Reason

Partner, London

Kelesi Blundell

Partner, London

Clive Cunningham

Consultant, London

Dr Ioannis Asimakopoulos

Senior Associate, London, Brussels and Greece group

Jon Ford

Partner, London

Jack Moore

Senior Associate, London

Jamie Ball

Manager, Emerging Technology Advisory, London

Cat Dankos

Senior Regulatory Consultant, London

Catriona de Jongh

Knowledge Lawyer, London

Disclaimer

The articles published on this website, current at the dates of publication set out above, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action.