FCA review of AI in financial services: good practice and areas for improvement

Overview

On 19 October 2026, the FCA published examples of good practice and areas for improvement in the use of artificial intelligence (“AI”) in financial services. This was published alongside a speech by Jessica Rusu (the FCA's chief data, information and intelligence officer), which highlighted three key areas of focus: putting the consumer first, accountability and governance, and operational resilience. In the speech, the FCA acknowledged AI is moving faster than any regulatory framework was designed and the FCA will need to make judgments in novel and untested situations. 

As such, the examples of good practice and areas for improvement from the FCA, which also provides case studies and guidance for smaller firms, will be useful for all firms using AI. Below we draw out some of the interesting practices and trends.

1. Putting the consumer first

Firms deploying AI-supported tools remain responsible for consumer outcomes delivered through their products, services, communications and support. The following were considered as good practice and areas for improvement:

Good Practice 

• Defining the consumer need first: Before deciding whether AI was the right tool, firms started with a clear consumer problem, target market and intended outcome.
• Deciding where AI should support, automate or abstain: Firms decided the extent of how the AI can support or automate and when it was appropriate for AI to redirect or escalate to a person. In addition, firms considered what were proportionate checks and monitoring rather than relying solely on one person to review, approve, challenge and override.
• Identifying vulnerability: Firms used AI tools to spot potential vulnerability indicators, such as spending patterns. 

Areas for Improvement

• Only focusing on the technical: Some firms were concentrating solely on the technical aspects of a model, instead of considering whether they were able to evidence good outcomes, identify poor ones, and understand the likely causes.
• Weak monitoring and escalation: There is no set timescale for firms’ reviews or monitoring, however, some firms left long gaps between reviews or set escalation triggers that were too vague. 

2. Governance and Accountability

Governance models should be proportionate and should span every stage of the AI lifecycle, from initial scoping through to decommissioning. The following were considered as good practice and areas for improvement:

Good Practice 

• Structured challenge before deployment: Firms involved staff from different parts of the business to take part in testing and sign-off.
• Escalating ethical dilemmas: Firms established committees to consider the evidence on ethical dilemmas emerging from AI systems and make strategic decisions in line with regulatory requirements.
• Forward-looking monitoring: Firms monitored the actual outcomes and impacts of AI in practice and adjusted their approach as risks, such as model drift, developed.
• Clear SMF ownership from the outset: Firms allocated responsibility for AI across their senior management functions and made individuals accountable from the point of design.
• Board ownership and risk appetite: Boards regarded AI as a strategic matter for the business and took an active role in setting the firm’s risk appetite for AI. 

Areas for Improvement

• Retrospective governance and governance in isolation: Firms developed and rolled out AI tools before considering how they would be governed. Also, where AI governance was not clearly connected to a firm’s wider governance arrangements, it proved less effective.
• Oversight functions lacking AI-specific capability: In some firms, second- and third-line oversight functions lacked the expertise needed to spot or challenge new risks, and the training provided was either generic or limited to raising awareness.
• Poor documentation: Some firms kept inadequate records of their decisions on AI tools, with poor audit trails.
• Delegation without challenge: Some senior managers without adequate understanding of AI handed all responsibility for AI development to technical teams. This meant these senior managers were unable to provide effective challenge.

3. Operational Resilience

Firms should think carefully about where models are hosted and how they are built, and should take account of AI dependencies in their resilience mapping, testing and contingency planning. The following were considered as good practice and areas for improvement:

Good Practice

• Reducing single-vendor dependencies: Firms built their AI architecture so that it can work with different providers, limiting the risk of becoming overly reliant on any one vendor.  
• Visibility of vendor model changes: Some firms included contractual terms requiring advance notice of material changes to models to increase visibility over the changes made by providers.

Areas for Improvement

• AI left out of resilience planning: Some firms gave insufficient consideration in their operational resilience plans to how they used and depended on AI models.
• Untested vendor assurances: Some firms accepted assurances from vendors at face value, without testing or questioning them. 

Commentary

As noted in the FCA’s speech, AI adoption is not coming but is here already with 86% of firms now using AI.

Although the FCA is not creating a separate AI rulebook and is relying on the existing regulatory framework, firms are navigating a new regulatory landscape, with AI advancements developing at pace and the regulators having to exercise judgement in novel and untested situations. 

The key to navigating this new landscape is for firms to ensure they put consumers first, and have effective governance, accountability, oversight and operational resilience. Firms should also pay attention to the FCA’s publications on AI and assess whether their own approach would be deemed good practice or an area of improvement.