The regulator’s new AI practice paper is not a rulebook for generative or agentic systems. It is a more practical signal: where existing obligations apply, firms should be able to show that their AI-related controls work in practice.
The Financial Conduct Authority’s new good- and poor-practice publication on AI in financial services, published on 19 October 2026 and updated on 20 October with an editorial amendment to chapter 4.1, does not introduce new AI requirements.
The FCA says its examples are illustrative, non-exhaustive and expected to evolve. They do not prescribe one operating model or replace a firm’s responsibility to decide what is appropriate and proportionate for its own use cases, risks and potential impact.
That is not a new AI rulebook. It is, however, a useful account of how the FCA expects existing frameworks to meet real AI deployments—including machine learning, generative AI and agentic AI.
The publication is aimed at regulated firms that develop, deploy, procure or use AI in connection with regulated activities, consumer journeys, operations or governance. It covers in-house tools, third-party systems, AI embedded in another product, and tools used by staff to support decisions. The relevance of any particular obligation still depends on the firm and the activity. Consumer Duty, SM&CR and operational-resilience requirements are not turned into universal AI controls by this paper.
A guardrail is not the outcome
The paper’s consumer examples are a reminder that technically sensible controls can still produce poor results in use. In one case study, a firm used guardrails to reduce model drift and unexpected responses. The tool then produced overly generic outcomes and steered some consumers toward inappropriate options. The FCA’s concern was not simply whether the guardrail worked technically, but whether the system delivered good consumer outcomes.
That distinction runs through the paper. Where the Consumer Duty or other relevant existing obligations apply, firms using AI-supported tools in consumer journeys remain responsible for the outcomes delivered through their products, services, communications and support. Its examples point to testing outcomes across relevant consumer characteristics and scenarios, explaining use and limitations where appropriate, and monitoring live outcomes so issues can be found and addressed.
Those are supervisory examples, not a safe harbour or a checklist. But they make the practical question harder to evade: can a firm show that its controls work in the context where people actually encounter the AI system?
Where the Consumer Duty applies, the relevant primary text remains the FCA Handbook’s Consumer Duty rules and guidance, not the practice paper alone.
Ownership cannot stop at the technical team
The FCA does not suggest that senior managers must become model engineers. It does say they should take reasonable steps to understand AI risks within their areas of responsibility, obtain appropriate information and expertise, and ensure that governance, controls and escalation arrangements fit the risks presented.
One example is deliberately ordinary: a firm assigned ultimate accountability to the senior manager responsible for the business area where a tool would operate, while a separate model owner oversaw the technical build. The point is not that every AI system needs the same job titles. It is that business accountability and technical ownership should both be visible before deployment.
The paper also pushes back on nominal human oversight. A person reviewing outputs is not, by itself, a meaningful control. The FCA says effective oversight depends on authority, information, capability and escalation routes—the conditions that let someone challenge or intervene. In a case study involving affordability assessments, reviewers made their own assessments without seeing the AI system’s proposed outcome, allowing the firm to compare the two and reduce the risk of automatic deference. In another, a poorly defined reviewer role drifted into a tick-box exercise, with recommendations accepted despite signs of errors or limitations.
For firms within the Senior Managers & Certification Regime, the relevant accountability analysis remains fact-specific. The paper offers examples of what the FCA has observed, not a new allocation regime for AI.
Resilience starts with the dependencies
AI governance is also a resilience issue. The publication asks firms to consider how model changes, degradation or unavailability could disrupt important business services. For firms in scope, it links this to SYSC 15A, while making clear that the particular requirements apply only where that regime applies.
The supplier section is especially concrete. Firms can outsource AI services, the FCA says, but remain responsible for them. Its examples include keeping an inventory of AI use cases and providers, seeking visibility of significant model changes, developing and testing contingency plans, and considering fallback and exit options. One case study describes a firm that built a product around a particular model without a viable alternative or transition plan. When the model was retired, the firm had to redesign the product.
No single control is prescribed. A firm may not be able to prevent a provider from changing a model, but it can decide in advance what information it needs, where its dependencies sit and whether its fallback plan can work.
An applied message, not a deadline
There is no new effective date or AI compliance deadline in the paper. Its value is more immediate and less tidy: it gives firms a set of practical comparisons between controls that merely exist on paper and controls that can be shown to work.
That does not mean every illustration is a mandatory control, or that every firm should build a separate AI-governance structure. The FCA repeatedly stresses proportionality. Smaller firms, it notes, may use targeted controls, simpler risk tiering and phased adoption rather than reproduce a large-firm model.
The supervisory signal is nonetheless clear. If AI is being used in a regulated service or supporting a material operational decision, the question is not whether the organisation has adopted an “AI framework.” It is whether its existing consumer, governance, accountability and resilience arrangements still hold when the system changes, a person defers to it, or a supplier withdraws it.
Sources
- FCA, AI in financial services: good practice and areas for improvement (19 October 2026; page updated 20 October 2026)
- FCA Handbook, PRIN 2A: The Consumer Duty
- FCA Handbook, SYSC 15A: Operational resilience
Leave a Reply