The guidance draws on the regulator’s engagement with firms, supervisory work and testing initiatives. It addresses three connected areas: consumer outcomes, governance and accountability, and operational resilience. The examples are illustrative rather than exhaustive, and firms should choose controls proportionate to the particular use, risks and possible effects of their systems.
Consumer outcomes remain central
Firms should begin by identifying the consumer need and intended market before designing or deploying AI-supported services. They should test results across different consumer characteristics and scenarios, take proportionate steps to address bias and accuracy, and consider whether decisions can be explained. Where appropriate, consumers should be told how AI has been used and what its limits are. Ongoing monitoring is also important so firms can identify problems and respond.
AI can help firms identify customers who may need additional support, including potential signs of vulnerability in customer interactions or spending patterns. It also points to the value of offering a choice between automated and non-automated support where suitable, and allowing people to move between channels without having to repeat information.
Examples of weaker practice include deploying tools without a clear consumer need, relying too heavily on a model to identify vulnerability without adequate testing, and creating rigid automated journeys that make it difficult to get help. The regulator’s message is that automation should improve consumer outcomes, rather than simply reproduce an existing process at greater speed.
Clear ownership and oversight
Responsibility cannot be delegated to a model or supplier. Firms remain accountable for systems they develop, buy or deploy, including their outputs and effects. Effective governance should cover the AI lifecycle, with risk-based controls, defined human oversight and escalation routes, and senior managers who understand and take responsibility for relevant risks.
There is no single governance structure suitable for every firm. Smaller organisations may use targeted controls and begin with narrower applications, while still documenting ownership and monitoring. The practical issue is whether the firm can identify who is responsible, understand how a system is performing and intervene when risks or results change.
Plan for disruption and change
AI systems can depend on external models, suppliers and infrastructure. Firms should take those dependencies into account when planning for operational resilience, consider cyber risks and avoid becoming excessively reliant on a single model or provider. Testing, backup arrangements and plans for service continuity can help limit disruption if a system changes, fails or becomes unavailable.
In a speech delivered on 19 October, FCA chief data, information and intelligence officer Jessica Rusu connected those practical examples to the faster shift from AI that assists decisions towards systems that can act with greater autonomy. The speech urged firms to put consumers first, maintain clear accountability and prepare for failures. The speech also raised consumer-facing concerns where people use general-purpose AI tools for financial information, and called for clear, proportionate explanations of the limits of AI-generated financial information and advice.
The approach is to test and monitor how systems are deployed, rather than assume that a static set of examples will remain sufficient as technology develops. Its published material is intended to help firms apply existing responsibilities as AI use expands. For businesses, the immediate task is therefore to understand where AI affects customers or important services, assign accountable owners, and maintain safeguards that match the risks.
