FCA sets out responsible AI practice

What does this mean?

The FCA is not introducing a separate AI rulebook. However, existing regulatory requirements apply, including the Principles for Businesses, Consumer Duty, SYSC and SM&CR, along with operational resilience, outsourcing and complaints rules. 

The publication combines brief expectations related to these requirements with good and poor practice and areas for improvement observed in firms. The examples are illustrative, non-exhaustive and will evolve.

Consumer outcomes

The FCA stresses that firms remain responsible for consumer outcomes delivered through AI and should explain how they use AI in a way consumers can understand.

Examples of responsible deployment include defining the consumer need before choosing AI, deciding where a tool should escalate to a person, and testing outcomes across different consumer characteristics.

Areas for improvement included assuming AI outputs were clear without testing them, overstating AI capabilities, and excluding vulnerable consumers by default without offering an alternative route to support.

Governance and accountability

Firms need proportionate, risk-based governance across the AI lifecycle, with clear accountability, effective oversight and escalation.  

The FCA highlights effective boards as those that treat AI as a strategic business issue and set a clear risk appetite to guide where AI can be used, what level of risk is acceptable and what controls are needed. Senior managers are not expected to be technical specialists but should take reasonable steps to understand AI risks in their areas, obtain appropriate expertise where needed and provide effective oversight and challenge.

Good practice included formal challenge and sign-off before deployment, accountability from the design stage, board oversight of AI strategy and risk appetite, and governance bodies such as AI boards or data ethics committees. Firms also used thresholds and escalation routes to translate risk appetite into practice and provided targeted training to senior managers and oversight functions.

The FCA expects human oversight to be designed around the use case, level of AI autonomy and potential impact. It stresses that effective oversight is not simply about reviewing outputs, but about ensuring people have the authority, capability and escalation routes to challenge or intervene. Areas for improvement included excessive reliance on human review, which can mask model weaknesses, and the risk of oversight becoming a box-ticking exercise.

Operational resilience and third parties

The FCA expects firms to reflect AI dependencies in their operational resilience planning where applicable. For firms subject to SYSC 15A, this is a requirement when assessing severe but plausible scenarios. Firms can outsource AI services but remain responsible for them.

The FCA finds that firms deploying AI responsibly tailor their architecture to the sensitivity and security requirements of each use case, take steps to mitigate cyber threats and reduce the risk of over-dependence on a single model or provider. Good practice also includes keeping clear records of AI use cases and providers, obtaining contractual notice of significant model changes, and stress-testing tools before deployment.

By contrast, the FCA has observed some firms accepting vendor assurances without testing them or building products around a single model with no viable alternative or transition plan.

Smaller firms

The FCA recognises that smaller firms do not need to replicate the scale or complexity of larger firms' approaches. Examples include using sample outputs and curated test data rather than testing at scale, tailoring governance to size and risk, focusing limited specialist expertise where oversight matters most, and starting with narrower use cases before scaling.

However, proportionality does not dilute accountability: smaller firms remain responsible for their AI use, including where third parties are involved, and still need clear responsibilities, with named owners and sign-off highlighted as good practice.

Mills review and agentic finance

Rusu’s speech outlined the FCA’s response to the Mills Review. The FCA is embedding six of the review’s seven recommendations into live work, with a focus on testing, assurance, monitoring and surveillance rather than further consultation.

The FCA will not create the proposed public-interest financial capability tool and will build on existing work instead. It has also called on AI providers to use clear, proportionate and consistent disclaimers about the limits of AI-generated financial information and advice.

For agentic AI, assurance will need to be continuous and conditional, as systems may behave differently at scale, under stress or as underlying models change. The FCA will work with industry, other regulators and frontier labs to develop a trusted framework covering agent identity, delegated authority, accountability and execution.

Rusu also described the FCA’s move towards becoming an ‘agentic regulator’, including AI tools to support oversight of 60,000 anti-money laundering firms coming into its remit in 2028 and a ‘market first responder’ agent for around 9,000 small wholesale markets transaction reporting firms.

What do firms need to do?

The FCA's examples are illustrative and non-exhaustive, but they provide a practical benchmark of good practice and of the weaknesses observed in firms' current approaches.

For boards and senior management, the message is that AI is a strategic business and risk issue that requires clear accountability, a defined risk appetite and effective challenge. The publication may also become a useful reference point for future supervisory engagement.

Firms should focus on five management actions:

1. Know where AI is being used. Maintain clear inventories of AI use cases, including third-party models and tools, with visibility of ownership, purpose and dependencies. 
2. Tier AI by risk and impact. Apply proportionate governance, testing and monitoring based on the nature of the use case, level of autonomy and potential impact on consumers, markets and operational resilience.
3. Establish accountability and risk appetite. Clarify senior ownership, approval and escalation arrangements, and translate risk appetite into practical thresholds for where AI can be used and when intervention is required.
4. Test and continuously monitor outcomes and controls. Assess whether controls operate effectively in practice, including whether monitoring captures consumer and operational outcomes, human oversight is meaningful, and escalation mechanisms work as intended.
5. Prepare for model or provider change and failure. Challenge vendor assurances, maintain visibility of significant model changes and dependencies, and test fallback, substitution and exit arrangements.

The key question is therefore less whether a firm has an AI governance framework, and more whether it can demonstrate that its controls are effective in practice.

Next steps

The FCA’s joint AI survey with the Bank of England is due by the end of October 2026. The FCA will update its good and poor practice examples as technology evolves, and will work with industry, other regulators and frontier labs to develop a trusted framework for agentic finance.