Part of our guide: AI governance and risk
The FCA's Consumer Duty has moved from implementation to impact, and you have your policies in place, your product reviews completed and your governance framework documented. The question that matters now is no longer one of compliance, and it is instead whether you can evidence that your customers are actually getting good outcomes.
That is a much harder question, and it is one where AI can help, or, done badly, create exactly the kind of risk you are trying to manage.
The evidence challenge
Consumer Duty requires firms to evidence four outcomes: products and services, price and value, consumer understanding and consumer support. The regulator is not just checking that you have policies, and the test is whether those policies lead to measurably good outcomes for customers.
For most mid-market firms, the evidence challenge comes down to data, and you know your products are designed well and you believe your customers are treated fairly. The harder task is to prove it at scale, demonstrating that vulnerable customers are identified consistently and that complaints are resolved in a way that delivers good outcomes. The same demonstration is needed for your communications, where the test is whether they are actually understood by the people receiving them.
In firms with thousands of customers, doing this manually is impossible and would demand a team of reviewers listening to every call, reading every complaint and checking every letter. Even then, human review is inconsistent across a team of that size, and what one reviewer flags, another might miss.
Where AI adds measurable value
AI is particularly well-suited to the kind of work Consumer Duty evidence requires:
Customer vulnerability identification. AI can analyse customer interactions (calls, emails, chat transcripts) to flag indicators of vulnerability in real time, surfacing the cases that need human attention rather than replacing human judgment. A well-designed vulnerability detection system can review every interaction rather than sampling, giving you coverage you could not achieve manually.
AI can also transform complaints analysis and root cause identification, categorising complaints, identifying patterns and surfacing systemic issues before they become regulatory findings. Rather than reviewing complaints one by one, you can see across your entire complaints population: what themes are emerging, what products or processes are generating the most issues and whether root causes are being addressed.
Communication effectiveness. AI can assess whether customer communications are written at an appropriate reading level and whether they clearly explain key information. It can also assess whether there are patterns in customer confusion or misunderstanding, and that is particularly valuable for evidencing the "consumer understanding" outcome.
Outcome monitoring at scale. AI can continuously monitor customer outcomes data (retention, claims experience, complaint resolution, vulnerability identification rates) and alert you to trends that require investigation, shifting your compliance approach from periodic review to continuous monitoring.
The risks you need to manage
Here is where it gets complicated, and the same AI that helps you evidence Consumer Duty outcomes can create new risks if it is not properly governed.
Bias risk. If your vulnerability detection model is trained on biased data, it could systematically under-identify certain groups, and that is a Consumer Duty failure (not just a technical problem). Every AI model used in customer-facing processes needs regular bias testing.
Explainability risk. If the FCA asks why a particular customer was not identified as vulnerable, "the AI didn't flag them" is not an answer. You need to be able to explain how the model works, what its limitations are and what human oversight sits around it.
AI should augment your compliance processes rather than replace them, and over-reliance is a real risk where a team starts treating AI outputs as definitive rather than indicative. If your team crosses that line, you have introduced a new vulnerability, and the governance framework needs clear human review thresholds.
Third-party risk. If you are using a vendor's AI tools for Consumer Duty monitoring, that vendor becomes a material dependency. Under the new FCA/PRA third-party reporting rules (effective March 2027), you may need to register and monitor this relationship formally.
Getting the balance right
The technology is not the hard part, and the governance is where the difficulty sits.
The opportunity is real: AI can give you better evidence, more coverage and earlier warning of consumer harm than any manual process. It needs to be designed with governance from the start, not deployed by the technology team and presented to compliance as a fait accompli. The right approach is to involve compliance in the design of any AI capability that touches customer outcomes. That means agreeing what the AI should detect and what it should not, defining the human review process, establishing bias testing protocols and ensuring audit trails are maintained.
At Oxygen Bubbles, we build compliance and governance into every AI initiative from day one. Our Breathe engagement maps AI opportunities against your regulatory obligations, including Consumer Duty, so you get a roadmap that strengthens your compliance position rather than creating new risk.
Get in touch to talk through how AI can support your Consumer Duty evidence framework.
If your CRO needs the broader governance view, share this: Introducing AI in a Regulated Business: A Risk Officer's Practical Checklist
If your CFO needs the business case, share this: The Real ROI of AI in a Mid-Market Business