UK: FCA AI good practice for financial services firms

The FCA has published good practice and areas for improvement on AI in financial services covering Consumer Duty, governance, senior manager accountability and operational resilience

Why should I read this?

On 19 October 2026, the FCA published its webpage “AI in financial services: good practice and areas for improvement”. It draws on supervisory work, industry engagement and the FCA’s AI Lab. The AI Lab includes AI Live Testing and the Supercharged Sandbox.

The FCA confirms that its existing rules apply to firms’ use of AI and the webpage creates no new rules. Firms remain responsible for AI outcomes, even if a third party supplies the AI tool.

The webpage is relevant to all regulated firms that develop, buy or use AI. Firms should expect supervisors to use the examples as a benchmark. Meeting those benchmarks may add compliance cost, particularly for smaller firms.

How should I approach the use of AI in my firm?

Start with the consumer need, not the technology

Define the customer problem and target market before you choose an AI tool in connection with services for customers. Test outcomes for different customer groups, including vulnerable customers. Keep testing for bias after launch.

Build AI into your governance and SMCR map

Keep an inventory of your AI use cases, models and providers. Give each material use case a named senior manager responsible for that use case from the design stage. Set a risk appetite and clear escalation thresholds before launch. Understand what good and poor outcomes will look like and how you will track it (see below).

Make human oversight meaningful

Do not rely on human review alone to manage model risk. Build technical checks into your AI systems. Train reviewers and give them authority to challenge outputs. Record whether staff approved, overrode or escalated each output.

Monitor customer outcomes, not only technical metrics

Track real-world outcomes and model drift. Keep records of prompts, outputs, model versions and escalation decisions. Review live outcomes often enough to spot harm quickly.

Review your AI providers and resilience plans

Test vendor assurances before you rely on them. Seek contract rights to notice of material model changes. Plan for fallback and exit. Firms within the scope of SYSC 15A must map AI dependencies into their resilience planning.

What else do I need to know about AI in financial services?

Regulatory context

The FCA’s AI Update explains how some existing rules apply to AI. For example, the webpage points firms to the Consumer Duty guidance in FG22/5 and to FG21/1 on the fair treatment of vulnerable customers. There is a section on governance and accountability which explains how the Senior Managers and Certification Regime (SMCR) applies to AI decisions. There is a further section on operational resilience, which explains how the rules in SYSC 15A apply to firms deploying AI.

The examples given in the AI Update are illustrative. They cover machine learning, generative AI and agentic AI. The webpage does not deal with fair value, but firms must still meet that outcome. Data protection and equality law sit outside its scope.

Products and services

The FCA warns that firms should take particular care where AI could affect outcomes, including:

people’s ability to access services;
how firms prioritise issues; and
support and guidance for consumers.

Good practice

Areas for improvement

Firms chose which tasks AI should support or automate.

They set points at which AI hands over to a person.

They tested for bias at the design stage and retested after changes.

They defined the customer need before choosing AI.

Some firms built tools before defining the customer problem or target market.

Some guardrails fixed one risk but created another.

Some firms shut vulnerable customers out of AI journeys by default. This is unfair if those customers have no other route to support.

Some smaller firms used sample outputs and vulnerability markers in test cases and one used filtered datasets reviewed by staff. These methods helped smaller firms spot bias using methods proportionate to their limited resources.

Customer understanding

Good practice

Areas for improvement

Firms told customers they were using an AI tool. They explained what the tool could not do.

They limited chatbots to approved source material.

They kept records of prompts, outputs and model versions.

Some firms did not test whether customers understood AI outputs.

Some gave technical model information without explaining what it meant for the customer.

Some overstated the accuracy of their AI.

Some were unclear about whether AI or a person performed a task.

Customer support and vulnerable customers

Good practice

Areas for improvement

Firms used AI to spot signs of vulnerability, such as spending patterns.

Customers could choose between AI and human support. They could switch channels without repeating themselves.

Firms used unusual cases to refine their prompts and controls.

Some firms reviewed live outcomes too rarely.

Some set vague escalation triggers.

Some trusted large language models to spot vulnerability from text alone.

Some automated journeys stopped customers from moving to another channel.

Governance frameworks

Good practice

Areas for improvement

Firms tested and signed off AI tools before launch.

Larger firms set up AI boards or data ethics committees.

Smaller firms used their existing committees and simple risk tiers.

Firms designed extra governance before launching agentic AI.

Some firms used informal approval processes. Control functions were not involved enough.

Some firms designed governance after building the tool.

Responsibility was sometimes split between technology and business teams.

Some smaller firms scaled and tailored their governance frameworks to their size, capability, and risk profile rather than copying large firm models. This allowed them to deploy AI safely by focusing their in-house expertise where oversight and challenge were most needed.

Monitoring and oversight

Good practice

Areas for improvement

Firms used dashboards with thresholds to track model performance.

Dedicated post-implementation monitoring groups.

Running spot checks and automated scoring frameworks to detect model drift or harmful AI outputs.

Giving tailored training to senior staff, technical teams and reviewers.

Regular governance reviews.

Some firms tracked technical metrics instead of outcomes.

Some treated governance as a one-off exercise.

Some second and third line teams lacked AI expertise. Their training was generic.

Senior managers

The FCA does not expect senior managers to be technical experts, but they must take reasonable steps to understand AI risks in their area and must challenge AI decisions effectively.

Good practice

Areas for improvement

Firms mapped AI responsibilities to senior management functions.

Senior managers owned AI risks from the design stage. They received documented information and targeted training.

Some firms kept poor records of AI decisions. Their senior managers could not show the steps they had taken.

Some senior managers left AI entirely to technical teams.

Some firms did not link AI risks to named senior managers.

Firms remain accountable for AI supplied by third parties. One firm mapped each material AI use case to a named senior manager. Strong examples included documented vendor assessments and fallback plans.

Human oversight

Good practice

Areas for improvement

Firms assessed which tasks needed human oversight. They used qualified reviewers with authority to escalate.

AI supported staff judgement instead of replacing it. Firms set clear thresholds for overriding outputs.

Some firms relied too heavily on human review. This can hide weaknesses in the model.

Human review risked becoming a box-ticking exercise.

Risk appetite and thresholds

Good practice

Areas for improvement

Boards set a risk appetite for AI and received regular management information (MI).

Firms used risk scoring to scale governance.

Firms adapted their model risk frameworks for AI.

There was clear ownership of AI agents.

Some firms had no defined risk appetite or thresholds.

Some avoided risks near regulatory boundaries instead of managing them. This led to poor outcomes.

Smaller firms that started with narrow use cases reduced the risk of widespread harm.

Operational resilience

Good practice

Areas for improvement

Firms made considered choices about hosting their AI models.

Suppliers kept backup servers in different locations.

Firms piloted lower-risk use cases first. They stress-tested AI tools before launch.

Some firms left AI out of their operational resilience plans. This gap grew as they moved to more material use cases.

Third-party providers

Good practice

Areas for improvement

Firms designed AI systems that could work with more than one provider to avoid single-vendor dependence.

Legal, compliance and risk teams joined procurement. Contracts gave firms notice of material model changes.

Firms tested contingency plans.

Some firms accepted vendor assurances without testing them.

Some relied on a single provider with no exit plan, risking lock-in.

Next steps

The webpage is not a consultation and sets no deadline. The FCA expects the examples to change as practice develops. Supervisors are likely to use them as a benchmark. Firms should compare their AI arrangements against them.

Frontier AI and cyber resilience are subject to a separate FCA, Bank of England and HM Treasury statement.

How ES can help

Eversheds Sutherland can help firms:

benchmark AI governance frameworks against the FCA’s examples of good practice
support the mapping of AI use cases and accountability under the SMCR
review AI-enabled customer journeys against Consumer Duty requirements
strengthen AI monitoring, management information and human oversight
review AI supplier contracts, third-party risk and operational resilience arrangements

The materials on the Eversheds Sutherland website are for general information purposes only and do not constitute legal advice. While reasonable care is taken to ensure accuracy, the materials may not reflect the most current legal developments. Eversheds Sutherland disclaims liability for actions taken based on the materials. Always consult a qualified lawyer for specific legal matters. To view the full disclaimer, see our Terms and Conditions or Disclaimer section in the footer. Eversheds Sutherland is a provider of legal and other services operating through various separate and distinct legal entities. For further information about these entities and Eversheds Sutherlands' structure please see the Legal Notice page of this website.