On 19 October 2026, the Financial Conduct Authority (FCA) published a new webpage setting out good practice and areas for improvement in artificial intelligence (AI) in financial services.
Examples
The examples provided by the FCA identify common themes and developing practices which are relevant to a variety of AI use cases, such as those using machine learning, generative AI or agentic AI. The examples that the FCA share come from its industry engagement, supervisory work and AI lab initiatives, including AI Live Testing and the Supercharged Sandbox. They do not create new requirements, prescribe a single model or replace firms’ responsibility for considering what is appropriate and proportionate for their own AI use cases, risks and potential impact.
The examples cover the following areas:
- Consumer Duty and customers in vulnerable circumstances – how firms use AI to achieve good consumer outcomes.
- Governance and accountability – how firms oversee and effectively govern across the AI lifecycle.
- Operational resilience – how firms make sure they deploy AI securely and sustainably.
Consumer Duty and customers in vulnerable circumstances
The FCA reminds firms that when they are deploying AI-supported tools, they remain responsible for consumer outcomes. This includes outcomes they deliver through any products, services, communications and support. The FCA adds that firms that use AI safely and responsibly:
- Define the consumer need and target market before designing and deploying AI-supported products and services.
- Test consumer outcomes across different consumer characteristics and scenarios.
- Use proportionate controls to manage AI bias and accuracy, and to ensure that decisions can be explained.
- Tell consumers how they have used AI, and its limits, and test their understanding where appropriate.
- Monitor live outcomes so they can spot and deal with issues quickly.
The FCA provides examples of good practice and areas for improvement in relation to products and services, consumer understanding and consumer support and consumers in vulnerable circumstances. In relation to the latter the FCA provides the following examples of good practice:
- Identifying potential needs and responding appropriately. Firms used AI tools to spot potential vulnerability indicators, such as key words in consumer responses, spending patterns, or signs a consumer is struggling with a digital journey.
- Giving consumers choice and continuity. Where appropriate, firms allowed consumers to choose between AI-enabled or non-AI support for straightforward tasks. Consumers could switch channels without having to repeat information. This helped maintain continuity and consumer control and allowed firms to answer questions more efficiently.
- Learning from unexpected scenarios. Firms combined AI monitoring with sample reviews and structured governance so they could use unexpected scenarios, such as a consumer mentioning using a food bank or financial distress, to refine prompts, controls or escalation criteria. We have seen examples where firms used outliers to refine their models.
Governance and accountability
The FCA states that there is no one-size-fits-all model, but firms deploying AI safely and responsibly generally share common features:
- Proportionate, risk-based AI governance throughout the AI lifecycle.
- Clearly designed human oversight and escalation triggers.
- Multidisciplinary governance, evidenced and supported by continuous monitoring.
- Senior managers who are accountable for AI systems and for taking reasonable steps to mitigate risks.
The FCA provides examples of good practice and areas for improvement in relation to governance frameworks, monitoring and oversight, senior management function (SMF) and reasonable steps, human oversight and risk appetite, thresholds and oversight. In each case it also provides a smaller firm focus.
As for SMF and reasonable steps, the FCA provides the following examples of good practice:
- Assigning clear SMF ownership for AI risks. Firms mapped responsibilities for AI across SMFs, establishing clear accountability, governance and oversight for AI risks. Some firms highlighted the importance of an ownership structure and tailored roles to each AI use case, rather than assigning a single owner to each model. Roles could include technical, research and business owners, with a senior person accountable for overall oversight.
- Accountability assigned at the beginning. Senior managers were accountable and owned risks from the design stage onwards for each AI use case.
- Informed, documented and auditable SMF oversight. Firms made sure senior managers received appropriate information and oversight through documented governance processes, so they could understand key risks and challenges, and make informed decisions. They had auditable records of decisions, including rationale, challenge, and escalation.
- Clear escalation routes. Firms had clear, evidenced escalation routes, including formal threshold-based escalation to governance bodies.
- Targeted SMF training. Firms gave senior managers targeted training so they could understand AI risks and discharge their responsibilities effectively.
Operational resilience
The FCA notes that firms deploying AI safely and responsibly generally share some common approaches including:
- Firms adopt AI systems and architecture that reflect the sensitivity and security requirements of their use cases.
- Dependencies on AI models, including those provided by third parties, are recognised and integrated into firms’ operational resilience planning (where applicable).
- Firms take steps to mitigate risks from cyber threats and of becoming overly dependent on a specific AI model or third party.
- Third-party relationships are managed proactively, to ensure that firms are sighted and can plan for model updates or changes in products.
The FCA provides examples of good practice and areas for improvement in relation to operational and cyber resilience and third-party relationships.
As for operational and cyber resilience, the FCA provides the following examples of good practice:
- Assessing hosting choices for AI resilience. Firms made considered decisions on whether to host their AI models on company-owned architecture or a third-party cloud graphics processing unit. They considered a range of factors, including differences in capability, security, and risk management.
- Using backup infrastructure to support continuity. Firms ensured that their third-party suppliers maintained appropriate backup servers in different locations to ensure that AI models would continue to function if there was, for example, an unanticipated spike in demand.
- Piloting lower-risk use cases before full deployment. When exploring how they could deploy AI solutions, firms ran lower-risk use cases to identify and mitigate any issues early on. This helped ensure those issues wouldn’t have a major operational impact.
- Stress-testing AI tools before deployment. This enabled firms to identify potential vulnerabilities and refine guardrails so that the product was resilient before deployment.
- Mapping AI dependencies into resilience planning. Firms considered their dependence on AI models, including those hosted externally, when assessing how severe but plausible scenarios could affect their business services. This is a requirement for firms in scope of SYSC 15A.
FCA speech
The FCA has also published a speech by its chief data, information and intelligence officer, Jessica Rusu who touches on the good and poor practice. The speech is entitled Building the future of finance in the age of AI. In her speech she states that the FCA is “calling on AI providers to help consumers understand the limits of financial information and advice generated by their models through clear, proportionate and consistent disclaimers”.