AI Regulation Tracker / Regulator policy
UK SM&CR review declines to create a dedicated AI senior management function, keeping managers liable
The FCA and PRA finalised the first phase of their Senior Managers and Certification Regime review without creating a dedicated AI function. Named individuals stay personally accountable when a model gets it wrong.
The Financial Conduct Authority and the Prudential Regulation Authority have settled a question that many compliance teams were watching closely. In Policy Statement PS26/6, published as the first phase of their review of the Senior Managers and Certification Regime, the regulators declined to create a dedicated senior management function for artificial intelligence. The core message for regulated firms is that accountability for AI does not move to a new specialist. It stays where it already sits, on the named individuals who run the business.
Most of the Phase 1 changes took effect on April 24, 2026, with further elements phased in through the summer and into September. The reforms trim some process friction in the regime, but on the AI question they hold the line rather than break new ground.
No new function means no new place to hide
The most consequential decision in PS26/6 is the one the regulators did not take. There is no "Head of AI" Senior Management Function. That matters because the SM&CR works by attaching regulatory responsibility to specific people. When a firm deploys a model that misprices risk, screens out customers unfairly, or produces a flawed recommendation, the question the regulator asks is simple. Who was responsible for that decision.
By keeping AI inside the existing regime, the FCA and PRA confirm that an AI-driven outcome is treated like any other outcome the firm produces. The senior manager whose remit covers the relevant activity answers for it, whether the decision came from a spreadsheet, a junior analyst, or a machine learning system. Firms hoping to concentrate AI liability in a single new role, and thereby ring-fence it, will not find that option in the rulebook.
The practical implication is that AI oversight has to be built into responsibilities that already exist. A firm using a model in credit decisions cannot point to a generalist technologist when something goes wrong. It has to show that the senior manager accountable for that business line understood the model, oversaw its deployment, and took reasonable steps to prevent a breach. That reasonable-steps standard is the spine of the SM&CR, and PS26/6 leaves it fully intact for AI.
What the review does not do
PS26/6 is a review of the accountability regime, not a standalone AI rulebook. It does not set out detailed technical standards for model validation, testing, or documentation. It does not tell firms which AI use cases are permitted. And it does not, on its own, resolve how the Consumer Duty interacts with automated decision-making.
That last point is flagged as future work. The FCA plans to publish guidance at the end of 2026 on how the Consumer Duty and the SM&CR apply to AI. Until that arrives, firms are working from principle rather than a dedicated AI code. The prudent reading is that existing duties already bite, and the forthcoming guidance will sharpen expectations rather than introduce them cold.
The housekeeping changes
Alongside the AI decision, Phase 1 makes practical adjustments to how the regime operates. Criminal-record-check validity is extended from three months to six, easing a recurring administrative pinch point in the hiring and approval process. Intragroup checks are removed, cutting duplicate verification when staff move within a group. These are efficiency measures. They do not soften the accountability standard, and they should not be read as a signal that the regulators are loosening their grip on individual responsibility. Firms should update their onboarding and vetting procedures to reflect the longer check window, but the substance of who is answerable for what has not moved.
The cross-border angle
For a US financial group with UK operations, PS26/6 reinforces a standard that has no clean US equivalent. UK-regulated entities must keep named-individual accountability for AI outcomes, so a global firm cannot rely on a centralized US governance model to satisfy its UK obligations. Someone approved under the SM&CR has to own each material AI system in the UK book. The policy statement also complements the FCA's related review of AI in retail financial services, part of a broader push to keep senior-manager accountability intact even as firms lean harder on automation. Firms should treat the end-2026 guidance as the next date to watch and prepare their responsibilities maps now.
Frequently Asked Questions
What changed under PS26/6 for AI accountability?
Nothing was added specifically for AI. The FCA and PRA confirmed Phase 1 of the SM&CR review without creating a dedicated AI senior management function, so senior managers remain personally accountable for AI-driven outcomes under the existing regime. Phase 1 took effect April 24, 2026.
Who does this affect?
Senior managers, compliance teams, and boards at FCA and PRA-regulated firms in the UK, including banks, insurers, and asset managers that use AI in regulated activities. US groups with UK operations are covered for their UK entities.
Is there a "Head of AI" role I need to appoint?
No. The regulators expressly declined to create one. You should instead ensure each material AI system is mapped to an existing Senior Management Function holder in your responsibilities map and Statements of Responsibilities.
When will the FCA say more about AI and the Consumer Duty?
The FCA plans to publish guidance at the end of 2026 on how the Consumer Duty and the SM&CR apply to AI. Phase 1 changes are already in force as of April 24, 2026, with further elements phased in through September 1, 2026.
Sponsored Training
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.