FCA sets out good and poor practice on AI: what finance firms should check

Global reference

• Country: United Kingdom
• Authority: Financial Conduct Authority (FCA)
• Publication: AI in financial services: good practice and areas for improvement, with a speech by Jessica Rusu
• Key date: Published 19 October 2026
• Status: Illustrative and non-exhaustive. No new rules; existing rules already apply

Areas for improvement

• Governance retrofitted after the AI tool was deployed, or kept separate from the wider framework.
• Unclear or fragmented responsibility, and senior managers delegating too much to technical teams.
• Monitoring of technical metrics rather than real outcomes.
• Oversight teams without AI expertise, weak records and poor audit trails.
• Human reviewers who became box-ticking and accepted AI outputs without scrutiny.
• Untested vendor assurances. One firm had to redesign a product when its underlying model was retired.

Good practice

• Named senior manager ownership of AI risks, with structured challenge and sign-off before deployment.
• Incident playbooks with red, amber and green thresholds.
• Some reviewers assessed cases without seeing the AI’s answer, to reduce automatic deference.
• Avoiding reliance on one model or vendor, and tracking vendor model changes.

Agentic finance

• Incident reporting should extend to significant AI failures and near-misses.
• Agentic systems need continuous, conditional assurance.
• The FCA will work with industry, other regulators and frontier AI labs on a framework for agent identity, delegated authority, accountability and execution.

What to do now

• Compare your AI governance with the FCA’s areas for improvement, one by one.
• Name a senior owner for each material AI use, and record decisions.
• Test reviewers: sample cases where they approved AI output, and check the quality of challenge.
• Add model change and retirement notice to vendor contracts, with an exit plan.
• Log AI near-misses now, even if no rule requires a report yet.

Our take

The FCA is not writing an AI rulebook. It is showing what weak control looks like. The most useful point for finance is the warning about box-ticking review: a person who signs off everything is not a control.

Important. This summary is for general information and is not legal, regulatory or financial advice. It is based on public Financial Conduct Authority publications and may be incomplete or out of date. The official publications prevail; check the official source before acting.