Part of the AI Regulation News hub.
The FCA published examples of good and poor AI practice for regulated firms and said the examples create no new requirements
The page shows how the FCA reads existing accountability, Consumer Duty and outsourcing rules when AI is involved. Its most useful part is the poor-practice lists, which read like a supervisory question set.
Bottom line: Non-binding. The FCA says its examples are illustrative and non-exhaustive and that they do not create new requirements. It is a good and poor practice page applying existing rules (Principles for Businesses, SYSC, the Consumer Duty, SM&CR) to AI. It is not a rule, a Handbook change or a consultation.
Who this affects: FCA-authorised firms that develop, procure, deploy or use AI in regulated activities, consumer journeys, operations or governance. In practice that means the senior managers who own those areas, compliance and risk functions, and the procurement and vendor-management staff who buy or oversee third-party models.
Issue date: The FCA page metadata gives a published date of 19 October 2026. The same metadata shows the page was created on 5 October 2026 and last modified on 20 October 2026. The visible page text we extracted carries no date line. There is no consultation window or compliance deadline.
What changed: No rule changed. The FCA put in one place what it says it saw firms doing well and badly in three areas: Consumer Duty and vulnerable consumers, governance and accountability, and operational resilience. It adds 20 anonymised case studies, labelled A to T, and separate focus boxes for smaller firms.
Analysis: On our reading, the areas-for-improvement lists are the part worth using. Items such as "Poor documentation." and "Delegating responsibility without sufficient challenge." are written as things the FCA saw in firms, so they are plausible lines of questioning in a supervisory visit. That is our inference. The page does not say how it will be used in supervision.
Primary sources: AI in financial services: good practice and areas for improvement, FCA
- Instrument (EN)
- AI in financial services: good practice and areas for improvement
- Authority
- Financial Conduct Authority (FCA)
- Jurisdiction
- United Kingdom
- Status
- Published good and poor practice page. Not a rule, Handbook change, consultation or policy statement
- Bindingness
- Non-binding by its own terms: the examples "do not create new requirements". The existing rules it points to (PRIN, SYSC, SM&CR, Consumer Duty, DISP) are unchanged and continue to apply
- Issue date / next deadline
- 19 October 2026 per page metadata (created 5 October, modified 20 October 2026). No deadline
- Who it applies to
- Regulated firms that develop, deploy, procure or use AI in connection with regulated activities, consumer journeys, operations or governance, including tools built in-house, supplied by a third party or embedded in another system
- Evidence base
- Engagement with firms and others, the Mills Review, AI Live Testing, the Supercharged Sandbox, an AI in smaller firms event and the AI Input Zone
- Primary source
- https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
What is this page, and what is it not?
The FCA describes the page as examples drawn from industry engagement, supervisory work and its AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox. It sorts them into three chapters: Consumer Duty and consumers in vulnerable circumstances, governance and accountability, and operational resilience.
The status language is plain. The examples are "illustrative, non-exhaustive" and will evolve. The FCA adds that they "do not create new requirements, prescribe a single model" or displace a firm's own judgment of what is proportionate for its use cases. So this is guidance on how the regulator reads rules that already exist.
The page also marks its edges. It says firms' AI use is subject to frameworks overseen by other regulators, naming data protection and equality law, and that the publication is not intended to address those regimes. The cyber risk from frontier models is left to a separate FCA, Bank of England and Treasury statement and a multi-firm review.
Where does accountability sit?
The governance chapter opens with a sentence that does most of the work: "Firms are responsible for AI systems they develop, procure and deploy", followed on the page by a reference to their outputs and outcomes. It does not matter, on this wording, whether the model was built in-house or bought.
The senior manager paragraph is more specific. The FCA says "we don't expect senior managers to be technical specialists", and then lists what it does expect: reasonable steps to understand the risks in their area, obtaining information and expertise where needed, effective oversight and challenge, and governance and escalation that stay appropriate to the risk.
The good-practice items under that heading are concrete. Firms mapped AI responsibilities across senior management functions, tailored ownership to each use case rather than assigning one owner per model, assigned accountability from the design stage, and kept auditable records of decisions, including rationale, challenge and escalation.
The poor-practice items are the mirror image. Some firms delegated AI development entirely to technical teams without sufficient understanding or challenge, which the FCA calls particularly concerning for higher-risk uses that affect consumers. Others had no clear link between a risk being identified and a named person owning it, which the page says could limit a senior manager's ability to show they understood, challenged and managed the risk.
What does it say about human oversight?
This is where the page is least comfortable for firms that treat a reviewer as the control. It states that "Effective oversight is not simply about reviewing AI outputs, but about ensuring people have the right authority, information, capability and escalation routes to challenge or intervene where needed."
Two areas-for-improvement items follow. One is excessive reliance on human-in-the-loop controls without addressing underlying model risk, because human review may mask weaknesses in the model. The other is review that becomes box-ticking. Case study O describes a reviewer role that was unclear and became a tick-box exercise, with reviewers increasingly accepting AI recommendations despite signs of error.
Case study N shows the opposite. During set-up of an AI affordability tool, staff made the decisions and reviewers assessed each case without seeing the AI's proposed outcome, so the firm could compare independent human and AI judgments.
Consumer Duty and vulnerable customers
The Consumer Duty chapter points firms back to FG22/5 and the vulnerable customers guidance, FG21/1. It says that where firms deploy AI-supported tools they remain responsible for consumer outcomes, including those delivered through products, services, communications and support.
Good practice includes defining the consumer need and target market before choosing AI, testing outcomes across consumer characteristics including vulnerability, telling consumers how AI was used and what its limits are, and keeping records of prompts, outputs, model versions and escalation decisions.
The poor-practice examples include excluding consumers with vulnerability indicators from AI journeys by default without another route to support, overstating what an AI system can do, and placing too much confidence in an LLM's ability to spot vulnerability from text alone without sufficient testing.
Outsourcing, vendors and resilience
The third-party section is short and direct: "Firms can outsource AI services, but remain responsible for them." The FCA's good-practice items include architecture that can run with different providers, inventories of AI use cases and the models underneath them, contract terms that give notice of significant vendor model changes, and tested contingency plans.
The areas for improvement name the failure modes. Relying on vendor assurances without challenging or testing them. Depending on a hard-to-replace provider. Building around a single platform with no exit option. Case study T is the illustration: a firm built a product around one model, had no viable alternative, and had to redesign the product when the model was retired.
One sentence on the page is not framed as an example. On mapping AI dependencies into resilience planning, the FCA says this is a requirement for firms in scope of SYSC 15A. That is the only place we found the page naming a hard requirement, and it comes from an existing rule rather than from this publication.
What we did not verify
We opened the FCA page in full, including the expandable case studies, and read the governance, human oversight, Consumer Duty, resilience and third-party sections closely. We also opened the live TLY page on the FCA Mills Review to avoid repeating it.
We did not open the FCA AI Update, FG22/5, FG21/1, the SYSC 15A rules, the Mills Review itself, the joint statement with the Bank of England and Treasury, the frontier AI multi-firm review or the FSB report linked from the page. Our statements about them are limited to what this page says about them.
The 19 October 2026 date comes from page metadata, not from a visible date line. We did not verify how the FCA or the PRA will use the page in supervision, whether it will be updated, or how any named firm is affected. The case studies are anonymous. We offer no view on whether any particular firm's AI practice meets FCA expectations, and this is not legal advice.
The page binds nobody, and it still tells you what the FCA finds unconvincing: AI owned by no one, oversight that is a tick box, and vendor assurances nobody tested. A firm can read the areas-for-improvement lists against its own AI inventory as a self-review. That use is our suggestion, not something the FCA prescribes.
Source File
https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services
Open the FCA page and confirm the section 1.2 wording that the examples do not create new requirements, the governance key finding on firms being responsible for AI systems they develop, procure and deploy, the senior manager paragraph in section 3.3, and the third-party sentence in section 4.2. Then view the page source and confirm the published-date metadata reads 2026/10/19.
Firms can outsource AI services, but remain responsible for them. ยท FCA, AI in financial services: good practice and areas for improvement, section 4.2, published 19 October 2026
FAQ
Does the FCA page create new rules for AI?
No. The FCA says the examples are illustrative and non-exhaustive and that they "do not create new requirements, prescribe a single model" or replace a firm's responsibility to decide what is proportionate. It applies rules that already exist.
Do senior managers need to be technical specialists?
The FCA says "we don't expect senior managers to be technical specialists". It does expect them to take reasonable steps to understand AI risks in their area, get information and expertise where needed, and provide effective oversight and challenge.
Can a firm shift responsibility for AI to its vendor?
Not on the FCA's account. The page says firms can outsource AI services but remain responsible for them, and lists untested vendor assurances and single-provider dependence as areas for improvement.
Does the page apply to smaller firms?
Yes. It says there is no one-size-fits-all approach and that firms should respond proportionately. It adds smaller firms focus boxes describing scaled governance, simple risk tiering and baseline training, and says smaller firms can govern AI effectively with targeted, proportionate controls.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.