The Financial Conduct Authority has published examples of good and poor practice in financial services AI, identifying weaknesses in governance, human oversight and operational resilience alongside approaches that have helped businesses manage the technology more effectively.
The publication, issued on 19 October 2026, draws on the regulator’s supervisory work, industry engagement and AI testing initiatives, including its AI Live Testing programme and Supercharged Sandbox.
The Financial Conduct Authority (FCA) examines how financial businesses design, deploy and monitor AI applications, including systems used in customer services, operational decision-making and internal business processes.
Its findings are presented as illustrative examples and anonymised case studies, rather than formal enforcement decisions against named institutions. The document does not introduce new AI-specific regulatory requirements.
The FCA expects businesses to comply with existing obligations, including the Consumer Duty, the Senior Managers and Certification Regime and relevant systems and controls requirements. The controls adopted for a particular application should reflect its risks and potential consequences.
Governance arrangements are a central focus of the publication. The regulator identified examples of organisations developing and deploying AI without establishing suitable processes for approving the systems or assigning responsibility for their operation.
In one case study, an organisation introduced AI tools before agreeing clear governance arrangements. When problems emerged, different teams believed responsibility for oversight belonged elsewhere, leaving no established route for escalating concerns.
The FCA said attempts to introduce governance after deployment made it harder for the organisation to demonstrate how risks had been identified, considered and managed.
Better practice involved establishing responsibility at the design stage, with technical teams, business managers and relevant control functions participating in testing and approval.
Some organisations used existing governance committees, adapting their procedures to address AI-related risks rather than creating entirely separate management structures.
The regulator said those arrangements could be proportionate to the size of a business and the significance of its applications. Smaller financial institutions were not expected to reproduce the governance structures of major banking groups.
Senior management accountability was another area examined. The FCA identified examples in which executives delegated AI development to technical specialists without maintaining sufficient understanding or providing effective challenge.
Under the Senior Managers and Certification Regime, senior managers must take reasonable steps to oversee risks within their areas of responsibility. The regulator does not expect them to possess detailed engineering expertise, but they must understand relevant risks and obtain appropriate information.
The paper also examines the effectiveness of human review. Some businesses relied on staff to check automated recommendations without establishing whether reviewers had the knowledge or authority needed to challenge the results.
In one anonymised case, reviewing AI outputs became a routine approval exercise. Employees increasingly accepted recommendations without sufficient scrutiny, even where there were signs of errors or limitations.
A contrasting case involved an organisation using AI to support affordability assessments. Staff made their initial assessment without seeing the AI recommendation, allowing the business to compare independent human judgements with automated results.
The FCA presented this as an example of reducing the risk that reviewers would simply defer to a system’s recommendation.
Effective oversight therefore involves more than requiring a person to approve an automated decision. Reviewers need suitable information, expertise, defined escalation procedures and the authority to intervene.
Monitoring after deployment was another area where the regulator identified differences in practice. Some businesses focused narrowly on technical measures without examining whether AI systems continued to produce appropriate outcomes for customers.
The FCA described stronger approaches involving continuous monitoring, recorded decisions, checks for changes in model behaviour and established thresholds for escalating problems.
These arrangements help organisations assess whether an application continues to perform as intended after its initial testing and approval. AI systems may produce changing results as their inputs, operating conditions or underlying models develop.
Consumer outcomes remain subject to the FCA’s existing requirements. Businesses using AI to provide information, support or financial services must consider whether products meet customers’ needs and whether the limitations of automated assistance are adequately explained.
The publication includes examples of organisations using approved information sources and human review to reduce the risk of unsuitable customer communications.
It also identifies circumstances in which companies assessed results for different consumer groups and maintained records that could support investigations or complaints.
Operational resilience forms the third major area of the paper. Businesses increasingly use external AI models and supporting technology services, creating dependencies on suppliers whose availability and systems may change.
The FCA identified stronger practices involving documented inventories of AI applications, assessments of suppliers, contingency arrangements and consideration of alternative providers.
It also highlighted the need to understand the risks arising from model changes and interruptions to third-party services. Outsourcing technology does not transfer responsibility for regulated activities away from the financial business.
Separately, FCA chief data, information and intelligence officer Jessica Rusu previewed a finding from the regulator’s forthcoming joint AI survey with the Bank of England during a speech delivered on 19 October.
Rusu said 86% of firms covered by that survey were using AI. The percentage concerns firms in the joint financial services survey, not 86% of all UK businesses, and was disclosed ahead of the full survey’s publication.
The speech did not provide the final respondent count or full methodology, which were therefore not available to establish the precise sample size behind the figure at the time of the announcement.
That adoption estimate is separate from the examples in the FCA’s good-and-poor-practice publication. It is not a finding about the proportion of organisations with governance deficiencies.
The October paper sets out how the regulator has observed businesses applying existing obligations as AI use develops. Its anonymised examples show both effective controls and shortcomings, without establishing new rules or announcing sanctions against the organisations described.
You must be logged in to post a comment.