The Financial Conduct Authority has published examples of good practice and areas for improvement in the use of AI in financial services.

The publication does not create new requirements or prescribe a single governance model. Instead, it explains how the existing regulatory framework applies to machine learning, generative AI and agentic AI, drawing on the FCA’s supervisory work, industry engagement and AI Lab initiatives. The examples focus on three areas: consumer outcomes, governance and accountability, and operational resilience. This is the most concrete public indication given by the FCA to date about its expectations of how firms should be using AI tools.

The FCA’s central message is that firms remain responsible for the outputs and outcomes of AI systems that they develop, procure or deploy. Firms should apply proportionate, risk-based governance throughout the AI lifecycle, supported by clear senior-management accountability, meaningful human oversight and continuing monitoring of real-world outcomes. 

The publication includes a number of practical examples. These include a firm that:

• used an independent, multidisciplinary panel to challenge proposed AI use cases, including their implications for human ownership and bias;
• adapted its existing model-risk and third-party governance processes by introducing specialist approval for high-risk model changes, AI-specific supplier assessments and contractual controls;
• allocated accountability for each AI use case at the design stage, with ultimate responsibility resting with the Senior Manager responsible for the relevant business area;
• assessed generative AI outputs against criteria such as completeness, faithfulness to source material, adequacy of reasoning and safety; and
• translated its AI risk appetite into red, amber and green performance thresholds, with predefined responses where performance deteriorated.

The FCA also identifies practices requiring improvement. These include deploying AI before establishing clear governance, relying on generic or informal approval processes, monitoring only technical performance rather than customer or market outcomes, and treating human review as a substitute for addressing weaknesses in the underlying system. In one example, an initially meaningful human review process became a box-ticking exercise as reviewers increasingly accepted AI-generated recommendations without sufficient scrutiny. 

Firms should consider whether they:

• maintain a sufficiently complete inventory of AI use cases, including third-party and agentic systems;
• allocate clear business, technical and SMF ownership from the outset;
• subject higher-risk use cases to appropriate testing and independent challenge;
• translate board-level risk appetite into practical thresholds and escalation arrangements;
• retain auditable records of testing, approval, challenge, overrides and incidents; and
• equip second- and third-line functions with the expertise needed to challenge AI-specific risks effectively.

The publication does not suggest that firms need an entirely separate governance architecture for AI. Existing model-risk, operational-resilience, outsourcing, product-governance and Consumer Duty frameworks may provide the foundation. However, firms should assess whether those frameworks adequately address AI-specific risks and remedy any gaps before deployment, rather than attempting to retrofit governance once a system is already operating.