The guidance provides examples of good and poor practices and is designed to help firms apply the existing regulatory framework to their use of AI.
Key POINTS:
- The guidance focuses on three key areas: the Consumer Duty and vulnerable customers, governance and accountability, and operational resilience.
- An accompanying FCA speech confirms that the regulator is embedding the Mills Review’s recommendations into live work and that the FCA is itself becoming an “agentic regulator”.
- Supervisory scrutiny of firms’ AI use is set to increase, so firms should map their AI use cases against the good and poor practices using the action points we identify in this article, be ready to evidence how they meet the FCA’s expectations, and keep their approach under regular review.
On 19 October 2026, the FCA published a webpage titled “AI in financial services: good practice and areas for improvement” which provides guidance for financial services firms using AI.
While firms have welcomed the FCA’s pro-innovation stance and long-standing position that it will not introduce AI-specific regulation, they have found it challenging to understand how the existing regulatory framework should apply to the use of AI in new and untested scenarios.
The FCA promised further guidance for firms following the publication of the House of Commons Treasury Select Committee report on AI in financial services at the start of the year. The report recommended that, by the end of 2026, the FCA should publish comprehensive, practical guidance for firms on: (a) the application of existing consumer protection rules (i.e., the Consumer Duty) to their use of AI; and (b) accountability and the level of assurance expected from senior managers under the SMCR for harm caused through the use of AI (see this Latham blog post).
The publication of the guidance further cements the FCA’s position that it does not plan to introduce sector-specific rules on AI and will continue to rely on existing regulatory frameworks when supervising firms’ use of AI.
With the FCA stating that 86% of firms are using AI, according to its latest biennial survey with the Bank of England on AI in UK financial services, the guidance is now more important than ever. The survey found that firms are using AI across a wider range of business areas and are increasingly reporting use of generative AI, AI-enabled agents, and third-party implementations of AI systems.
In this article, we highlight key areas of the guidance and set out the most important action points for firms to consider to ensure that they are meeting regulatory expectations.
To understand how the UK government and regulators’ positions on AI have developed over time, see our report “The AI Revolution: Navigating the Regulatory Landscape in UK Financial Services,” which draws together key publications and guidance to assist firms with understanding regulatory expectations.
Good and Poor Practices
The FCA stresses that the examples it provides are relevant to a range of use cases and are designed to be illustrative only. It does not intend to create any new regulatory requirements or prescribe a particular approach in all cases. Consequently, firms should apply common sense and proportionality when mapping the guidance to their own use cases. The FCA also states that the guidance is not intended to be static; it will update the guidance as AI tools continue to develop.
The good and poor practices cover three key areas, as detailed below.
Consumer Duty and Vulnerable Customers
The key concern is that AI tools or solutions could result in consumer harm not adequately anticipated by the firm.
The FCA explains that firms should design products and services to meet consumers’ needs, characteristics, and objectives, and explore whether AI can offer a solution, rather than being led by AI.
Good practices include considering which tasks AI can support or automate, which should remain staff-led, and where the AI tool should abstain, redirect, or escalate to a person. Firms should test outcomes across different consumer characteristics and test for unfair or unjustified differences across relevant consumer groups and scenarios at the outset.
The FCA warns against firms excluding vulnerable customers from AI tools by default; instead, it expects firms to consider how AI tools can also produce good outcomes for such customers. For smaller firms, the FCA suggests that good-quality sample testing can be an effective tool when large-scale testing is not feasible.
The FCA expects firms to explain how they have used AI in their products, services, and journeys in a way that consumers can understand, and to explain its limitations to customers in non-technical language. It stresses that firms should not overstate an AI tool’s capabilities. It also suggests that firms limit chatbots and generative AI assistants to approved source material in order to reduce the risk of hallucinations or inappropriate responses.
The FCA has seen firms using AI effectively to improve customer communications, with human review to check output before it is provided to consumers. It recommends that firms maintain auditable records of consumer prompts, outputs, model versions, applied filters, and escalation decisions so that outcomes can be more easily checked if they are challenged.
The FCA has seen good examples of firms using AI tools to spot potential vulnerability indicators, and using outliers or unexpected scenarios to refine their approach. However, it cautions that some firms have been placing too much confidence in an AI tool’s ability to identify text-only indicators of vulnerability, particularly temporary ones. The FCA suggests that running outcomes monitoring checks more frequently can help firms spot harm and address any issues faster.
Governance and Accountability
Prominent concerns are that too many firms are still under-investing in sound governance and that governance is not suitably keeping pace with the way in which firms are using AI. This includes governance frameworks only being applied retrospectively after an AI tool has been deployed.
The FCA stresses that governance models should cover the full AI lifecycle, including initial scoping, design, and development; testing and validation; deployment; ongoing monitoring; and decommissioning. Key themes are the need for clear allocation of responsibilities, joined-up thinking, effective formal processes, and senior managers being personally accountable for AI systems.
The regulator emphasises the need for firms to complete any challenge, testing, and sign-off before deployment, highlighting that informal processes can lead to inconsistent approaches and retrofitting governance after deployment, which often leads to gaps in accountability. The FCA suggests that larger firms may benefit from creating central AI bodies (such as data ethics committees or AI boards), while smaller firms may legitimately draw more heavily on their existing frameworks, incorporating AI oversight into current arrangements and adding targeted controls where they identify gaps. Regardless, the guidance underscores the importance of AI governance procedures plugging in to existing structures to operate most effectively.
The FCA found that forward-looking, outcomes-focused, continuous monitoring of AI outputs is most effective, with firms assessing AI outputs against structured evaluation frameworks. It suggests that firms could use tools such as dashboards, spot checks, monitoring groups, and staff feedback to assist with monitoring. Further, the FCA recommends that firms provide ongoing training to staff (role-specific, where appropriate) so that they have sufficient expertise to undertake effective monitoring, and to periodically review their governance arrangements in light of any developments to ensure that monitoring remains targeted and appropriate.
The FCA is clear that it does not expect Senior Managers to be technical specialists; however, they should take reasonable steps to understand the risks arising from AI use within their area of responsibility, and obtain appropriate information and expertise where necessary. Senior Managers also need to ensure that they are equipped to provide effective oversight and challenge. Therefore, firms should provide Senior Managers with targeted training to help them discharge their responsibilities effectively.
The FCA expects firms to assign ownership for AI risks to appropriate Senior Managers to establish clear accountability, governance, and oversight. It emphasises that this should be done from the design stage of each AI use case. The regulator expects to see auditable records of decisions, including rationale, challenge, and escalation. As such, firms should ensure that they have appropriate audit trails. While smaller firms still need to allocate responsibilities clearly, the FCA acknowledges that they may have simpler structures and less complex oversight processes.
The FCA considers that human oversight controls should be calibrated for each use case. It also emphasises that, as well as reviewing AI outputs, human oversight is about ensuring people have the right authority, information, capability, and escalation routes to challenge or intervene where needed. It recommends that AI should be used to support rather than replace human judgment, and cautions against human oversight becoming a “tick box” exercise.
In addition, the regulator stresses that firms should not rely unduly on individuals to oversee AI, and should take a more holistic approach that encompasses wider governance considerations. For example, if there are known issues, escalation routes should ensure that these are promptly addressed, rather than merely relying on individuals to catch the errors when the occur.
Finally, the guidance addresses risk appetite, noting that the most effective approaches translate board-level and risk function expectations into practical thresholds, metrics, and escalation routes. The FCA states that effective boards treat AI as a strategic business issue and actively set the firm’s risk appetite for AI use. The regulator also suggests that firms assess whether existing risk frameworks are appropriate for AI and adapt them where needed.
Operational Resilience
Key concerns include the need for firms to make contingency plans, carry out stress-testing of arrangements, understand supplier concentrations and dependencies, and avoid reliance on a single model.
The FCA emphasises the risk of firms becoming overly dependent on single providers or solutions, which could be changed, become less effective, or be withdrawn. It suggests that firms should consider carefully where to host their AI models, ensure that their third-party suppliers maintain appropriate backup servers in different locations, test lower-risk use cases before full deployment of AI solutions as well as stress-testing AI solutions to identify potential vulnerabilities, and reflect AI dependencies in their operational resilience planning. It provides an example of a firm designing an AI-based service so that it was not dependent on a single underlying model and considering how it could switch models if needed. The FCA also cites firms allowing staff members to trial an AI product before full launch as a positive example.
The FCA reminds firms that, even though they may outsource AI services, they still remain responsible for them. According to the regulators’ survey on AI in UK financial services, third-party implementations make up a larger percentage of the total number of reported AI systems in 2026 than in previous surveys, and they also make up an even greater share of highly material AI systems. Consequently, robust third-party oversight is critical. Good practices include clearly defining responsibilities between firms and their vendors, setting appropriate contractual obligations (such as requirements for suppliers to use AI securely), proactively building in visibility of upcoming model changes, and preparing fallback plans and exit options.
The FCA stresses the importance of designing AI architecture to operate with different providers to reduce dependency risk, keeping relationships clearly documented (including which models each use case is built on), and planning ahead for the impact of upcoming updates or changes to third-party AI models. Importantly, the FCA warns firms that they should not rely on vendors’ assurances without challenging or testing them.
International Approach
Firms looking for further guidance on how to use AI should consider the Financial Stability Board (FSB) sound practices for the responsible adoption of AI in financial services. The final version was published on 15 October 2026, and includes 12 sound practices for firms that are focused on organisation-wide AI governance and managing risks throughout the AI lifecycle. The report explains each sound practice in detail and what firms can do to meet each one. It also includes illustrative case studies alongside the sound practices.
While the sound practices are not binding, the FSB strongly encourages firms’ boards and senior management to reference the sound practices when developing and refining their institution’s AI governance, risk management, and control frameworks, including as AI adoption expands over time. They provide a practical, tangible framework against which firms can benchmark themselves.
Other FCA Initiatives
Alongside the guidance, the FCA published a speech by Jessica Rusu, FCA chief data, information, and intelligence officer, on the future of finance in the age of AI. The speech provides context for the guidance and updates firms on several other FCA initiatives relating to AI.
First, Ms Rusu explains how the FCA is advancing the recommendations of the Mills Review, which set out seven priority recommendations for the FCA board to consider, as follows:
- Secure and adapt the regulatory perimeter
- Strengthen system-wide coordination and oversight
- Monitor the transition to autonomous models and adapt regulatory frameworks
- Scale up the FCA’s AI Lab to support AI models and system innovation in financial services
- Enable the foundations for agentic finance
- Build and adopt an AI-enabled agentic supervisory model
- Develop a trusted public-interest AI-enabled financial capability service
Ms Rusu reports that the FCA is embedding the first six of these recommendations into live work immediately, with a focus on testing, assurance, monitoring, and surveillance. In particular, the FCA plans to make the existing regulatory perimeter clearer, and is calling on AI providers to help consumers understand the limits of financial information and advice generated by their models via disclaimers.
On frontier AI security, the FCA is working directly with banks to understand how frontier models are changing cyber defence, which is feeding into its supervisory and policy response. However, rather than create a new public-interest financial capability tool, as suggested in the seventh recommendation, the FCA plans to build on existing work via its AI Lab to help investors spot scams, verify information, and challenge unreliable AI outputs.
Ms Rusu also emphasises the need for firms to invest in cyber and operational resilience, ensuring that their critical incident reporting extends to significant AI failures and near-misses. Further, she stresses that firms need to think differently about assurance, as agentic systems require continuous, conditional assurance.
Finally, Ms Rusu explains how the FCA is becoming an “agentic regulator”, deploying AI tools to scale its operations and streamline supervision. For example, the FCA plans to use an agentic tool to supervise around 9,000 small wholesale markets transaction reporting firms. Therefore, firms can expect to see the regulator itself using more AI tools and on a greater scale.
Next Steps for Firms
The FCA’s guidance provides welcome, practical clarity on how the existing regulatory framework applies to firms’ use of AI, without the introduction of new AI-specific rules. Although the guidance will not answer every question firms have, it does more clearly articulate FCA expectations.
Several consistent themes run through the guidance: AI deployment should be consumer-led rather than technology-led; governance must cover the full AI lifecycle and be in place before deployment; Senior Managers remain personally accountable for AI risks within their areas of responsibility; and firms must avoid overreliance on single providers or models. Supervisory scrutiny of firms’ AI use is set to increase, and the FCA will expect firms to be able to evidence how they are meeting its expectations.
In light of the new guidance, firms should consider mapping their current and planned AI use cases against the FCA’s good and poor practices. The following action points are designed to help firms do so, and to address any gaps identified:
Consumer Duty and Vulnerable Customers
- Review the firm’s product and service design processes to ensure that they start from the perspective of consumers’ needs, characteristics, and objectives, rather than being led by the technology
- Test outcomes at the outset across different consumer characteristics, groups, and scenarios to identify any unfair or unjustified differences
- Review customer-facing materials to ensure that they explain how AI is used, and its limitations, in clear, non-technical language
- Maintain auditable records of consumer prompts, outputs, model versions, applied filters, and escalation decisions, so that the firm can trace how an outcome was reached if a consumer challenges it
Governance and Accountability
- Review the firm’s AI governance framework to ensure that it covers the full AI lifecycle, and identify any informal processes that require attention; where governance was applied only after deployment, carry out a gap analysis
- Ensure that board-level discussion and challenge are being appropriately documented and evidenced
- Ensure that AI governance plugs in to the firm’s existing governance structures
- Assign ownership of the risks arising from each AI use case to an appropriate Senior Manager from the design stage, and provide Senior Managers with targeted training
- Implement continuous, outcomes-focused monitoring of AI outputs (supported by ongoing staff training), and calibrate human oversight for each use case
- Ensure that the board has set the firm’s AI risk appetite, and translate that appetite into practical thresholds, metrics, and escalation routes
Operational Resilience and Third-Party Oversight
- Map the firm’s dependencies on AI vendors and models, reflect them in the firm’s operational resilience planning, and where services depend on a single provider or model, have preparations in place to switch providers or models if needed
- Review vendor contracts to ensure that they clearly define responsibilities, include appropriate obligations, and provide visibility of upcoming model changes, and put documented fallback plans and exit options in place
- Ensure that the firm challenges and tests third-party vendors’ assurances as part of the firm’s oversight
- Ensure that critical incident reporting covers significant AI failures and near-misses
Evidencing Compliance
- Prepare to evidence how the firm meets the FCA’s expectations in anticipation of increased supervisory scrutiny, and consider benchmarking the firm’s AI governance, risk management, and control frameworks against the FSB’s sound practices
The FCA has indicated that it will update the guidance as AI tools develop. As such, firms should keep their approach under regular review.
This publication is produced by Latham & Watkins as a news reporting service to clients and other friends. The information contained in this publication should not be construed as legal advice. Should further analysis or explanation of the subject matter be required, please contact the lawyer with whom you normally consult. The invitation to contact is not a solicitation for legal work under the laws of any jurisdiction in which Latham lawyers are not authorized to practice. See our Attorney Advertising and Terms of Use.
