Part of our guide: AI strategy
On 19 October 2026 the Financial Conduct Authority (FCA) published AI in financial services: good practice and areas for improvement, drawn from what it saw when testing firms' use of artificial intelligence (AI) this year. It creates no new requirements, and that's what makes it useful: the existing rules already apply to AI, and the examples show how the FCA expects firms to meet them. For most firms the practical change is to give each use of AI a named senior owner, to capture and manage AI risks the way they manage any other business risk and to keep governance running from the first pilot until the tool is retired.
It's also one of the clearest pieces of regulatory material on AI we've seen, with a simple structure and twenty case studies that firms can measure their own practice against. This piece is for firms regulated by the FCA, including insurers and banks that are also regulated by the Prudential Regulation Authority (PRA). We set out what the FCA said first and then what we think it means in practice.
What the FCA published
The publication covers firms that develop, deploy, procure or use AI, whether it's built in-house, bought from a third party, embedded in another product or used by staff. It's organised around the Consumer Duty, governance and accountability and operational resilience, and the FCA describes its examples as "illustrative, non-exhaustive" and says they "do not create new requirements". It maps AI to rules firms already know, including the Principles for Businesses, the Senior Management Arrangements, Systems and Controls sourcebook (SYSC), operational resilience, the Consumer Duty and the Senior Managers and Certification Regime (SM&CR).
On the same day Jessica Rusu, the FCA's Chief Data, Information and Intelligence Officer, said in a speech that "Agentic systems therefore require continuous, conditional assurance" and that firms' incident reporting "must extend to significant AI failures and near-misses". She also said a joint FCA and Bank of England survey, due to be published the following week, shows that 86% of firms now use AI.
A named senior owner for each use of AI
The clearest message is about accountability. Firms showing good practice mapped responsibilities for AI across their senior management functions (SMFs), and some tailored ownership to each use case rather than giving each model a single owner, with technical, research and business owners and a senior person accountable for overall oversight. In one case study, "Ultimate accountability sat with the SMF responsible for the business area the tool would operate in", with a separate model owner for the technical build and both roles documented before deployment.
The weaker practice is just as instructive. Some senior managers delegated responsibility for AI development entirely to technical teams without enough understanding or challenge, and some firms had no clear link between identifying a risk and the person accountable for it. The FCA is careful to say it doesn't expect senior managers to be technical specialists. It expects them to take reasonable steps to understand the risks arising from AI within their area of responsibility, drawing on expert input where they need it.
AI risks managed like any other business risk
The FCA expects boards to set the firm's risk appetite for AI use cases and to translate it into thresholds and escalation routes, and one firm turned its appetite into red, amber and green performance thresholds for its AI tools. Good practice also meant "auditable records of decisions, including rationale, challenge, and escalation", while some firms' decisions on AI tools were "poorly documented with limited audit trails or supporting rationale", leaving senior managers unable to show the steps they'd taken.
We've rarely seen AI risks captured and documented the way firms document their other business risks. Putting each material use of AI on the same risk register, with an SMF owner, its controls, its thresholds and a review date, would answer much of what the FCA describes without building anything new.
Governance for the whole lifecycle
The FCA expects proportionate governance across the full AI lifecycle, from initial scoping through to decommissioning, and it lists treating governance "as a point-in-time exercise" as a weakness. Good practice included piloting lower-risk use cases before full deployment and structured challenge, testing and sign-off before anything went live. In one case study a firm deployed AI before setting up its governance, and when risks emerged "multiple teams thought oversight sat elsewhere".
Human oversight needs the same care. The FCA warns that human review can become "a 'box-ticking' exercise, rather than meaningful oversight", and one case study describes reviewers who increasingly accepted AI recommendations without scrutiny.
Third parties and resilience
The FCA is plain that firms "can outsource AI services, but remain responsible for them". It expects clear responsibilities and contract terms with suppliers and plans for model changes, fallback options and exit, and one case study describes a product that had to be redesigned when the model it was built on was retired.
What this means in practice
None of this needs a separate AI bureaucracy. Most firms already have the risk, change and model governance forums to carry it, and the FCA's own examples include smaller firms building AI oversight into their existing governance. These are the steps we'd take first:
- List every use of AI in the firm, including tools staff use and AI embedded in suppliers' products, and name the SMF owner and the technical owner for each.
- Put each material use on the risk register alongside other business risks, with the board's appetite translated into thresholds and escalation routes.
- Agree that nothing leaves a pilot until it's been assessed against the FCA's good practice, with the decision, the challenge and the sign-off recorded.
- Keep monitoring once a tool is live, check that human review is still meaningful and log AI incidents and near-misses through the existing incident process.
- Review each AI supplier contract for notice of model changes, fallback and exit.
Our founder, Dan Simms, held SMF24, the Chief Operations function, at two UK insurers in an earlier role, and the place we'd start is a single live use of AI. If it would help, we'd welcome a 30-minute conversation to test one of yours against the FCA's examples and see whether its ownership, records and monitoring would hold up.