FCA publishes good and poor practices for the use and deployment of AI

The FCA has set out its expectations for AI in financial services, publishing observations on good and poor practices relating to firms’ use of AI and an accompanying speech from Jessica Rusu, FCA Chief Data, Information and Intelligence Officer, on the regulator’s broader vision.

An overview of the findings is set out below and our top takeaways are as follows:

• Governance and accountability must be embedded throughout the AI lifecycle – The FCA repeatedly stresses that governance should begin before deployment and continue throughout the lifecycle of an AI system. Firms deploying AI safely and responsibly generally adopt structured governance frameworks covering design, testing, deployment and ongoing monitoring, supported by clear accountability, senior management oversight and effective escalation arrangements. By contrast, the FCA identified retrospective governance, unclear ownership and informal approval processes as recurring weaknesses.
• Consumer outcomes and understanding are key – The FCA emphasises that firms remain responsible for outcomes delivered through AI-enabled products, services and communications. Good practice includes defining the consumer need before deployment, testing outcomes across different consumer groups and vulnerability characteristics, and ensuring customers understand the role and limitations of AI systems. Areas for improvement include deploying AI solutions without a clearly defined consumer need, excluding vulnerable consumers by default, and focusing on technical performance without sufficient consideration of consumer outcomes.
• Firms should plan for failure, particularly as AI becomes more autonomous – A recurring theme in both the publication and Jessica Rusu’s speech is the importance of operational resilience. Firms are expected to understand dependencies on AI providers, maintain contingency arrangements and stress-test AI systems. The FCA also highlights the increasing importance of governance arrangements for agentic AI, emphasising the need for clear ownership, effective oversight and appropriate escalation routes as AI systems become more autonomous.

Background

The FCA’s observations draw on supervisory work, industry engagement and experience through its AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox. The publication is intended to help firms identify emerging good practice and areas for improvement as AI adoption accelerates across the sector.

Importantly, the FCA is explicit that the publication does not create new regulatory requirements. Instead, it explains how existing regulatory expectations, including under the Consumer Duty, SMCR, governance, operational resilience and outsourcing frameworks, apply in the context of AI deployment.

The publication also follows the FCA’s wider work on AI, including the Mills Review, which examined how AI could transform retail financial services by 2030 and beyond. In her speech, Jessica Rusu confirmed that the FCA is embedding 6 of the Mills Review’s 7 priority recommendations into live work immediately, through supervisory activity, testing and industry engagement. The one recommendation not being taken forward is the Review’s proposal to develop a new public-interest AI-enabled financial capability service. Instead of building this new tool, the FCA intends to build on existing initiatives, including InvestSmart, the FCA Firm Checker and IOSCO’s AI Lab-powered TechSprint.

Key findings

The strongest message throughout the publication is that firms remain responsible for AI systems they develop, procure or deploy, including the outputs and outcomes produced by those systems. The FCA found that the strongest approaches were structured, risk-based and supported by clear accountability and monitoring arrangements.

The key findings are summarised below.

Governance, accountability and controls across the AI lifecycle

The FCA states that firms deploying AI safely and responsibly generally adopt risk-based governance throughout the AI lifecycle, from initial scoping and design through to testing, deployment, monitoring and decommissioning. Good practice includes structured challenge and sign-off processes, multidisciplinary governance committees and clear accountability arrangements.

The FCA is particularly critical of firms that attempt to fit governance around AI deployments after key design decisions have already been made. Other areas for improvement include informal approval processes, fragmented ownership structures and unclear responsibility for AI systems.

In practice, firms may wish to consider whether governance arrangements cover the full AI lifecycle, whether responsibilities for AI use cases are clearly allocated and documented, and whether governance decisions, challenge and escalation can be evidenced through formal approval processes.

Consumer outcomes, explainability and vulnerability considerations

The FCA emphasises that firms remain responsible for consumer outcomes wherever AI-supported tools are used.

Examples of good practice include defining the consumer need before deploying AI, testing outcomes across different consumer groups and scenarios, managing bias and explainability risks and monitoring outcomes after deployment. The publication also highlights examples of firms using AI to improve support for consumers in vulnerable circumstances.

Conversely, the FCA identifies examples of firms focusing on technical model performance without sufficient consideration of consumer understanding, consumer outcomes or the needs of vulnerable consumers. The regulator also raises concerns about firms overstating the capabilities of AI systems or failing to explain their limitations clearly.

Firms may therefore wish to consider whether they have clearly defined the consumer need for AI deployment, tested outcomes across different customer groups and vulnerability characteristics, and ensured that customers understand both the role and limitations of AI-enabled tools.

Ongoing monitoring and meaningful oversight

The FCA repeatedly stresses that governance should not be viewed as a point-in-time exercise.

Examples of good practice include monitoring dashboards, audit trails, post-implementation review processes, structured evaluations of AI outputs and periodic governance reviews. Firms are also expected to ensure that oversight functions have sufficient expertise to challenge and escalate issues appropriately.

Areas for improvement include reactive monitoring approaches, narrow focus on technical model metrics and insufficient capability within oversight functions to identify and challenge emerging AI risks.

The publication also prompts firms to consider whether they are monitoring outcomes rather than simply technical performance metrics, whether escalation triggers are appropriately defined and whether oversight functions have sufficient expertise and training to provide effective challenge.

The FCA draws out a particularly pointed warning in this area: human review of AI outputs can become a “tick-box exercise” rather than meaningful oversight, particularly where reviewers increasingly defer to AI-generated recommendations without sufficient scrutiny even when outputs show signs of error or limitation (“automation bias”). Firms should be able to evidence that human reviewers are actively exercising judgement, not simply rubber-stamping AI outputs.

Senior management accountability

The publication reinforces the importance of clear accountability for AI-related risks.

The FCA expects senior managers to understand the risks arising from AI use within their areas of responsibility and to take reasonable steps to provide effective oversight. The FCA does not expect senior managers to be technical experts on the AI tools being deployed, but notes they may need to be trained on the risks arising from such tools. Examples of good practice include clearly allocated SMF responsibilities, documented governance decisions, auditable records and defined escalation routes.

The FCA also highlights poor documentation, ineffective challenge and unclear links between risk identification and accountability as recurring weaknesses.

In particular, firms may wish to assess whether AI-related responsibilities have been clearly allocated, whether challenge and decision-making are appropriately documented and whether senior managers could demonstrate the reasonable steps they have taken to oversee AI-related risks.

Operational resilience and third-party dependencies

The FCA notes that firms remain responsible for outsourced AI services and should understand dependencies on AI providers and models.

Examples of good practice include maintaining inventories of AI use cases and providers, reducing reliance on individual vendors, monitoring supplier changes, understanding concentration risks and model dependencies, and establishing contingency arrangements where services become unavailable or unsuitable.

Areas for improvement include excessive reliance on vendor assurances, concentration risk arising from single providers and failure to reflect AI dependencies within operational resilience planning.

The FCA’s observations also encourage firms to consider whether AI-related dependencies are adequately reflected in operational resilience planning, whether they maintain sufficient visibility over third-party models and providers and whether contingency arrangements would operate effectively in the event of a provider or model failure.

Agentic AI and autonomous systems

One of the most notable themes running through both the publication and Jessica Rusu’s speech is the attention given to agentic AI.

The FCA recognises that firms are increasingly exploring AI systems capable of taking actions as well as generating outputs. The regulator expects firms deploying more autonomous systems to establish appropriate governance structures, escalation routes, compliance controls and accountability arrangements.

The publication highlights the importance of maintaining clear ownership of AI agents, understanding which systems and data they can access and ensuring effective oversight as autonomy increases. Jessica Rusu similarly emphasised that greater autonomy creates new operational, cyber and consumer protection risks, requiring continuous assurance rather than solely point-in-time testing.

Firms exploring agentic AI may therefore wish to consider whether ownership of AI agents is clearly defined, whether appropriate controls and escalation routes exist for autonomous actions, whether they understand the systems and data those agents can access and whether accountability remains clear as levels of autonomy increase.

Looking ahead

The speech by Jessica Rusu provides further insight into how the FCA itself is adapting to AI. Rusu confirmed that the FCA is becoming a “smarter regulator” and is increasingly deploying AI across its own operations, for example to support the future supervision of anti-money laundering firms. The FCA is also developing machine-readable regulatory data and expanding the role of its AI Lab and Sandbox environments.

It is clear that the FCA sees AI as both a regulatory priority and a supervisory tool, using technology to identify risks earlier, direct resources more efficiently and support a more data-driven approach to supervision. Looking ahead, firms should expect the FCA's use of AI, machine-readable regulation and digital supervisory tools to become an increasingly important feature of the regulatory landscape.

The publication also follows criticism from the House of Commons Treasury Committee, which concluded in a January 2026 report that the FCA, Bank of England and HM Treasury “are not doing enough” on AI and that a “wait-and-see approach” risks exposing consumers and the financial system to potentially serious harm, recommending FCA guidance on existing rules and SMCR accountability by the end of 2026. This reinforces the case for firms treating the FCA’s guidance as a genuine supervisory benchmark now, rather than assuming the lack of new rules means nothing has to change.

Next steps

While the FCA is not introducing new rules for AI deployment, the publication of good and poor practice guidance is an important development for firms as they grapple with how to manage the risks and opportunities from AI. Firms should take this opportunity to review their governance, systems and controls in relation to their use of AI. The FCA clearly expects there to be significant AI failures and near-misses; Jessica Rusu talks about firms “planning for failure” and “for when things go wrong”. On that basis we can expect the FCA to ask firms for evidence, at a minimum, that they have reacted to this good and poor practice guidance when deploying AI within the firm. Where firms identify areas for improvement within their own organisations, they should act promptly to address these issues. In particular we would encourage firms to:

• Review whether governance arrangements cover the full AI lifecycle from design through to ongoing monitoring.
• Confirm that accountability for AI risks is clearly allocated and documented.
• Assess whether AI deployments are supported by appropriate testing, monitoring and escalation processes.
• Evaluate whether operational resilience and third-party risk frameworks adequately capture AI-related dependencies.
• Review governance frameworks for generative and agentic AI use cases, particularly as deployments become more sophisticated and autonomous.
• Consider whether records, audit trails and management information would enable the firm to demonstrate effective oversight during supervisory engagement.

If you would like to discuss the implications for your organisation, please get in touch with your usual Simmons & Simmons contact or any member of our Financial Services Regulatory Team.