FCA publication on AI in financial services: the recommendations
Introduction
On 19 October 2026 the FCA published AI in financial services: good practice and areas for improvement, and its central message is that a control is only as good as the evidence that it works. The document creates no new rules, but it is the clearest picture yet of what supervisors will look for when they examine how firms develop, buy and use AI.
The publication draws on industry engagement, supervisory work and the FCA's AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox, alongside work on the Mills Review. It sets out good practice examples, areas for improvement and a series of anonymised case studies across three themes: consumer outcomes, governance and accountability, and operational resilience.
Status of the examples
The FCA describes its examples as "illustrative, non-exhaustive" and states that they "do not create new requirements". Firms remain responsible for deciding what is appropriate and proportionate for each use case. The FCA is explicit that existing rules apply to AI, and it groups them under four headings:
• Safety, security and robustness: the Principles (PRIN), Threshold Conditions (COND), SYSC, operational resilience, outsourcing and the critical third parties regime.
• Fairness, transparency and explainability: the Principles, the Consumer Duty, the guidance on the fair treatment of vulnerable customers, and the Equality Act 2010.
• Accountability and governance: the Senior Managers and Certification Regime (SM&CR).
• Contestability and redress: the Dispute Resolution sourcebook (DISP).
The examples cover machine learning, generative AI and agentic AI. They apply to firms that develop, deploy, procure or use AI in regulated activities, consumer journeys, operations or governance, including in-house, third-party, embedded and staff-used tools. Data protection and equality frameworks overseen by other regulators are acknowledged but not addressed.
What the FCA says
Consumer outcomes and vulnerability
Firms remain responsible for the outcomes that AI-supported products, services, communications and support deliver. The FCA ties this to the Consumer Duty (FG22/5) and its guidance on vulnerable customers (FG21/1). Good practice starts with the consumer need and target market, before any technology is chosen, and then tests outcomes across consumer characteristics with proportionate bias and accuracy controls.
The FCA highlights several practices:
• Deciding deliberately where AI should support, automate or abstain, and building automated technical checks and continuous monitoring rather than relying only on a person to review outputs.
• Explaining the role and limits of AI clearly, restricting customer-facing chatbots to approved source material, and keeping auditable records.
• Testing communications with consumers before rollout, instead of assuming that outputs are clear.
• Using AI to help identify potential vulnerability, while offering a genuine choice between AI and non-AI support.
The areas for improvement mirror these points: building without a defined consumer problem, guardrails that create new risks, excluding vulnerable consumers from AI journeys by default, overstating what AI can do, and placing too much confidence in large language models to detect vulnerability. One case study describes a guardrail that reduced model drift but produced generic outcomes, a reminder that a control can solve one problem while creating another.
Governance and accountability
This is the longest section of the publication, and the one with the most direct supervisory consequences. The FCA expects proportionate, risk-based governance across the whole AI lifecycle, from scoping and design through testing, deployment, monitoring and decommissioning.
Frameworks. Good practice includes structured pre-deployment challenge and sign-off, central AI governance bodies, ethics committees, and governance of the entire consumer journey rather than the model alone. For agentic AI, firms described additional governance layers. The weaknesses are informal approval processes, governance introduced after deployment, governance operating in isolation, and unclear responsibility.
Monitoring. The FCA favours forward-looking monitoring of real-world outcomes, supported by dashboards, audit trails, spot checks, staff feedback and structured evaluation of generative outputs. It criticises a narrow focus on technical metrics, static or reactive monitoring, and oversight functions without AI expertise. Some firms' second and third lines of defence "didn't have enough expertise" to identify or challenge emerging AI risks, which left them without effective escalation triggers and intervention mechanisms. The FCA also found that some training was "generic or limited to awareness", whereas better practice was role-specific, with separate content for senior stakeholders, technical teams and human-in-the-loop staff, including how to manage automation bias.
Senior managers and reasonable steps. The FCA says it does not expect senior managers to be technical specialists. It does expect them to take reasonable steps to understand AI risks, obtain the expertise they need, and ensure that controls and escalation routes remain appropriate. Good practice includes clear SMF ownership of AI risks from design onwards, documented and auditable oversight, and targeted training. The weaknesses are poor documentation, delegation without challenge, and gaps between risk assessment and accountability.
Human oversight. The FCA is direct that human oversight is not satisfied by having a person look at outputs. It should reflect the use case, the level of autonomy and the potential impact, and it requires authority, information, capability and escalation routes. The FCA warns that heavy reliance on human review "may mask weaknesses in the model". One case study describes a reviewer role that "became a tick-box exercise over time", with reviewers accepting AI recommendations with decreasing scrutiny. Another describes reviewers assessing cases without first seeing the AI outcome, an approach that bears directly on independence of judgement.
Risk appetite and thresholds. Good practice includes board ownership of AI strategy, risk appetite that guides development, central inventories of AI agents, and red, amber and green performance thresholds with predefined actions. The FCA criticises undefined appetite and thresholds, and firms that avoid, rather than manage, risks near regulatory boundaries.
Operational resilience and third parties
The FCA expects resilient and secure AI architecture, with AI dependencies built into resilience planning. It notes that mapping these dependencies is a requirement for firms in scope of SYSC 15A. Good practice includes assessing hosting options, maintaining backup infrastructure or model-switching capacity, stress-testing before deployment, piloting low-risk use cases first, and running exercises in which staff try to break the tool. The principal weakness is failing to consider AI in operational resilience reviews at all.
On third parties, the FCA reiterates that firms may outsource AI services but remain responsible for them. It encourages firms to reduce single-vendor dependence, keep inventories of AI use cases and providers, monitor vendor model changes and plan for contingencies. It criticises over-reliance on untested vendor assurances, dependence on hard-to-replace providers, and the absence of exit options. One case study describes a product that had to be redesigned when its underlying model was retired.
Frontier AI and cyber security are outside the scope of this iteration, and the FCA points readers to its separate work with the Bank of England and HM Treasury.
Smaller firms
The FCA states that smaller firms can govern AI effectively with targeted, proportionate controls. Examples include testing on sample outputs and quality-assured datasets, incremental adoption within a defined domain, and simpler structures provided that responsibilities and accountable individuals remain clear.
What it means for firms
Four themes that run through the examples
1. Evidence over assurance. Firms "should be able to show that the controls they choose work in practice". A control that feels reassuring but has not been tested against real outcomes will not meet that standard.
2. A human in the loop is not, on its own, a control. Where a reviewer cannot realistically disagree with the model, or has stopped trying to, the review adds the appearance of safety without the substance. The risk is not simply that AI output is sometimes wrong, but that it looks right.
3. Capability in the second and third lines. Oversight functions need enough AI expertise to challenge the business, and training needs to be specific to the role rather than limited to awareness.
4. Accountability that can be documented. Senior managers do not need to be technical, but their reasonable steps need to be recorded, auditable and linked to clear escalation routes.
What the publication leaves open
The FCA does not set out a formal perimeter for what counts as an AI use case within scope, and it does not publish next steps or deadlines. Because the examples are illustrative, firms are left to judge proportionality themselves, which places a premium on documenting that judgement and the reasoning behind it.
The case studies also concentrate on AI deployed in the business and in customer journeys. The scope section does say that the examples cover AI tools used by staff to support decision making, but the detailed examples say little about compliance functions' own use of AI, or about how staff use everyday assistants. For many firms that is where most AI activity now sits, and where the method for oversight still has to be built.
Practical steps
• Build a single inventory of AI use cases, agents and providers, including embedded and staff-used tools, with a named accountable owner for each.
• Test whether human review is meaningful: sample reviewer decisions, measure override rates, and consider whether reviewers should assess a case before seeing the AI outcome.
• Move from awareness training to role-specific training for senior managers, technical teams and reviewers, covering automation bias explicitly.
• Assess whether the second and third lines can challenge AI risks, and close capability gaps through hiring, secondment or external support.
• Define risk appetite and red, amber and green thresholds with predefined actions, and make sure the board has seen and owns them.
• Map AI dependencies into operational resilience and third-party arrangements, including vendor model changes, retirement of models and exit options.
• For consumer-facing use, define the consumer need first, test outcomes across characteristics including vulnerability, and keep an auditable record of what was tested and why.
• Document senior manager oversight now, rather than reconstructing it when a supervisor asks.
Closing view
Nothing in the publication is a new obligation, and that is precisely why it matters. It shows how the FCA reads existing requirements, including the Consumer Duty, SYSC and SM&CR, when applied to AI. Firms that can demonstrate working controls, capable challenge and a clear line of accountability will be well placed. Those relying on a reviewer signing off outputs, or on a vendor's assurances, should expect to be asked how they know it works.
Sources
• AI in financial services: good practice and areas for improvement, FCA, published 19 October 2026
