UK FCA Guidance on AI in Financial Services: Good Practices and Areas for Improvement

Recently, the seemingly unstoppable march of AI deployment across the world economy has rarely been out of the news. As financial services firms increasingly adopt AI-driven tools within their businesses, a key question has been how regulators will respond and whether they have clearly articulated their expectations for AI usage and governance across the sector.

Earlier today (19 October 2026), the UK Financial Conduct Authority (FCA) published a speech by its Chief Data, Information and Intelligence Officer, Jessica Rusu, on the FCA's approach to AI adoption within the financial services industry. This was accompanied by the launch of a new FCA publication on good practices and areas for improvement in relation to AI in financial services. The speech and guidance document are partly a response to the earlier Mills Review on AI and the future of retail financial services, published in July 2026.

For firms that have been following the FCA's public discussions until now around the risks and benefits of AI usage, the content of Ms Rusu's speech and the new guidance document are unlikely to come as a surprise. They both largely reinforce, rather than revolutionise, the FCA's existing approach, but they are indicative of the increasing importance of this issue to the regulator.

We have set out some of the key points from the speech and the guidance document below, although firms should ensure that they read the guidance in full and consider the FCA's expectations in light of their current AI usage.

        
            KEY ACTION POINTS FOR FIRMS
        
The FCA guidance is clear that it does not create new regulatory expectations and that firms should assess what is appropriate and proportionate in light of their own AI deployment and the associated risks in their business. As a result, not every observation in the FCA guidance will be relevant to every type of firm.

The formalisation of FCA expectations in the guidance is a strong indication that AI governance and risks are rising up the regulator's supervisory agenda. Firms should therefore review their existing AI policies and procedures (both their general policies and those governing more specific areas, such as the use of AI-driven recording and transcription tools) against the guidance and ensure that they would be able clearly to articulate their approach to governance, operational resilience and ensuring good outcomes in connection with AI if they were asked.

Firms should clearly map their usage of AI within their businesses, as well as their potential wider exposure to AI models (for example, through third-party service providers who may themselves be dependent on AI tools). The firm's assessment of what is appropriate and proportionate for its business model will need to be underpinned by a solid understanding of the applicable AI touchpoints.

Where a firm's deployment of AI models is at an early stage of sophistication, with limited AI autonomy and more extensive human involvement, the firm may be able to conclude that the usage is relatively low risk and some elements of the guidance are therefore less relevant. Conversely, as AI usage becomes more embedded with increasing business dependencies and greater autonomy for the AI model, the regulator's expectations are likely to increase.

Demonstrating clear oversight and accountability will be key. This can be structured in different ways according to the structure of the firm's business and the way in which AI has been deployed, but the FCA will expect the firm to be able to explain who has day-to-day oversight of AI models and who has ultimate accountability for deployment and the firm's overall AI strategy.

Given the increasing risks of cyber-attacks as frontier AI models become ever more advanced, the FCA recommends that firms should consider cyber insurance. Firms may therefore wish to review existing insurance policies or to explore whether appropriate insurance is available at an affordable cost.

Now Reading

No new FCA rulebook on AI (at least, for now)

Ms Rusu's speech is clear that the FCA's current focus is working with the industry to understand how firms are using AI and how they are addressing any resulting risks. She also emphasises the FCA's view that properly controlled AI usage can encourage innovation, competition and economic growth.

Reading between the lines, the regulator's strategy appears to be to adopt a "mid-Atlantic" position of avoiding introducing detailed and prescriptive legislation or regulatory rules on AI usage (unlike the EU's AI Act, for example), while also emphasising that existing regulatory rules impose obligations and expectations on firms (and so arguably being somewhat less laissez faire than the US). The FCA thinks that this position will be a key differentiator for the UK market.

No change in the UK regulatory perimeter to cover general purpose AI models

Ms Rusu observes (consistently with the findings of the Mills Review) that a significant number of consumers are now seeking financial information or advice from general purpose AI models, but may not understand that such advice is unregulated.

There had been some debate in the run-up to the speech about whether the FCA might recommend to the UK government that the regulatory perimeter needed to be updated to cover financial advice provided by these sorts of AI tools. Based on Ms Rusu's speech, it appears that this will not be the case: instead, the FCA is focusing on increasing consumer understanding of the regulatory boundary by calling on AI providers to use "clear, proportionate and consistent disclaimers" in relevant AI-generated output.

There is no further detail on whether this is simply a voluntary request or whether the FCA might look to impose some kind of future regulatory requirement to this effect (for example, via the UK designated activities regime, which allows the regulator to make rules applicable to some activities carried on by unregulated entities).

The rise of agentic AI

Agentic AI refers to an AI model which is able to take autonomous actions within certain pre-defined limits. The FCA recognises the potential benefits of agentic AI usage in financial services (for example, in helping consumers manage payments or monitor investments), but as the autonomy afforded to an AI tool increases, so do the relevant risks.

The FCA notes that while having a "human in the loop" is an important risk mitigant, firms should not become over-reliant on a human intervening to prevent poor outcomes from an AI model. In such a case, the firm should consider whether the AI model itself, or the way in which it has been deployed, needs to be updated to prevent the relevant issues from arising in the first place.

Ms Rusu indicates that the FCA plans to work with the industry, other regulators and frontier AI labs to develop a new "trusted framework" for agentic finance, which will include some clear standards about agent identity, delegated authority, execution and accountability. Again, there is no further detail on what this might look like in practice, although one possibility is the publication of some kind of agreed industry standard on agentic AI in financial services, which could then be endorsed by the regulator.

Governance and oversight are a central theme

A considerable proportion of the guidance document focuses on the FCA's expectations around governance and accountability in connection with a firm's deployment of AI. It emphasises the importance of effective governance arrangements at all levels.

The board or governing body of the firm is expected to set the overall AI strategy and risk appetite for the firm, and should be receiving regular management information to allow it to monitor outcomes. The FCA notes that it is good practice for individual senior managers to be accountable for the deployment of AI within the business areas for which they are responsible and to own the risks of AI deployment from the design stage onwards. The FCA notes that senior managers are not expected to be experts in all the technical detail of an AI model, but must have sufficient understanding to exercise appropriate oversight and challenge within their business area.

Firms should also ensure that control functions (such as compliance, risk and internal audit) have the necessary expertise to oversee and challenge AI deployment and usage and appropriate authority to intervene where appropriate. This may require additional training in some cases.

A continuing focus on operational resilience

In keeping with its broader concerns around operational resilience, the guidance emphasises that firms should carry out thorough analyses of capabilities, security and risk management when determining whether to develop in-house AI products or to source these from a third party.

In either case, firms should have a robust business continuity policy so that there are back-up options if there is disruption to a key AI model. AI dependencies should be clearly mapped into a firm's broader resilience planning. Firms should consider running low-risk pilot use cases of new AI tools before they are fully deployed, allowing issues to be identified early before they might cause a major operational impact.

The FCA recommends that firms should consider strengthening their contractual rights with key third-party model vendors so that they can obtain notice of model updates or changes which might cause disruption or otherwise affect the use of the AI product within the firm's business. Where firms are dependent on a single platform AI provider, they should also consider potential exit strategies to avoid being locked in to an unsuitable product in the future.

Don't forget the Consumer Duty...

Firms that deal directly with consumers, or are otherwise part of a consumer distribution chain, will also need to consider the impact of the FCA's Consumer Duty on their use of AI. A significant proportion of the FCA's guidance is dedicated to this issue, which includes (among others) the following observations:

Firms should have a clearly identified use case and target market before deploying AI in a consumer-facing role.
Firms need to consider how the use of an AI tool may affect customers with characteristics of vulnerability, and where appropriate, should ensure that alternative channels are available. However, firms should not simply exclude such customers from being able to use AI tools by default, as this may unfairly prevent them from being able to enjoy the benefits of AI. As a result, the firm will need to consider the particular context and associated risks when determining its approach.
Firms should ensure that they are transparent with consumers about when and how AI models are being used and about any limitations in the output. Where an AI tool is unable to assist, firms should clearly flag alternative sources of assistance to the consumer. Any information provided to customers should be clear and should not include technical jargon which is not properly explained.
Firms should test and monitor AI outcomes across groups of consumers with different characteristics, including factors such as digital or financial capability, to ensure that the design does not inadvertently exclude particular groups or cause consumer harm.

If you would like further information on any of the issues discussed above, please get in touch with your usual Travers Smith contact or email any of the individuals named below.

Read Tim Lewis Profile