What does the FCA’s AI update mean for financial services?

The 41% of financial services compliance professionals who believe we need more regulatory clarity on AI are increasingly finding their wishes granted. The Financial Conduct Authority (FCA) has issued an update on AI in financial services that includes:

• An update on the regulator’s own approach to AI
• Examples of good practice and areas for improvement
• A speech by Jessica Rusu, FCA chief data, information and intelligence officer on “Building the future of finance in the age of AI”

The update also outlines where the FCA’s current regulations and frameworks apply to how firms are adopting and using AI, and how it affects operational resilience.

What does the FCA consider “good practice” for AI?

From engaging with the industry, the FCA has shared examples of how firms are approaching and adopting AI use in ways that are effective and protect markets and consumers. However, these examples are “illustrative, non-exhaustive, and will evolve as practice develops.”

The guidance and examples do not “prescribe a single model or replace firms’ responsibility for considering what is appropriate and proportionate for their own AI use cases, risks, and potential impact.”

Firms are also reminded that they are “responsible for AI systems they develop, procure, and deploy — including their outputs and outcomes.”

The FCA’s update splits the examples across a range of themes, including governance and accountability and operational resilience.

AI Governance good practice

While the regulator recognizes that there is no “one-size-fits-all” model for good AI governance, effective approaches share common features:

• Proportionate, risk-based governance throughout the life cycle
• Clearly designed human oversight and escalation triggers
• Multidisciplinary governance, supported by continuous monitoring
• Senior managers who are accountable for AI systems and take reasonable steps to mitigate risk

Specific examples of good practice in AI governance included:

• Structured challenge, testing, and sign-off before deployment, involving staff from areas across the business
• Establishing central AI governance bodies with members from across the business
• Incorporating AI oversight into existing governance frameworks
• Building governance layers for agentic AI, including escalation routes and compliance controls
• A firm also added AI-specific questions to supplier assessments and established regular checks of key suppliers

Areas for improvement included retrospective governance of AI already in use, rather than taking a “governance first” approach to implementation, and establishing standalone AI-specific procedures not linked to wider governance structures.

Operational resilience for AI

As with governance, there is no true universal model for firms to ensure AI deployments are resilient and secure, but common successful approaches include similar elements:

• AI systems and architecture reflect the sensitivity and security requirements of their use cases
• Operational resilience planning maps dependencies on AI models, including those provided by third parties, a requirement of SYSC 15A
• Firms take steps to avoid becoming overly reliant on specific AI models or third parties

Good practice for prioritizing operational resilience while building AI included:

• Establishing whether to host AI models on company-owned architecture or third-party cloud environments, assessing security, capability, and risk
• Supporting business continuity with backup infrastructure and ensuring third-party suppliers maintained backups in multiple locations
• Piloting lower-risk use cases and stress-testing tools to identify and mitigate issues early before full deployment. This included one firm opening up an AI demo to members of staff and incentivizing them to “break it.”

The FCA found that some firms had not considered their use of AI or dependence on models as part of their operational resilience planning, and did not assess the potential impact of moving from low-risk to high-risk applications on business continuity. Learn more about why Global Relay build and hosts its own technology to support operational resilience.

Senior managers and AI best practice

Although the FCA clarifies that it doesn’t “expect senior managers to be technical specialists,” the regulator does expect that they “take reasonable steps to understand the risks arising from AI use within their area of responsibility,” and to obtain further appropriate expertise and information where necessary. Good practice exhibited by senior managers included:

• Assigning clear senior manager ownership to AI risks, including specifically tailored roles for technical, research, and business owners, as well as overall oversight
• Establishing clear accountability and risk ownership from the design stage onwards
• Access to documented governance processes and appropriate information so senior managers can make informed decisions, and leave auditable records of these decisions
• Dedicated training for senior managers
• One firm required relevant senior manager approval of a “playbook” for each AI tool setting out how incidents would be identified and handled before that tool was deployed

Which existing FCA regulations apply to AI?

The FCA’s update outlines how the existing regulatory framework “sets a strong foundation for how AI adoption should continue to support market stability and support good consumer outcomes.” The regulator divided the existing rules that can be applied to AI into four categories:

• Safety, security, robustness: Regulations including the FCA’s Principles for Business (PRIN), Senior Management Arrangements, Systems, and Controls (SYSC), rules around operational resilience, and the critical third parties regime
• Fairness, appropriate transparency, and explainability: Includes the Consumer Duty, Threshold Conditions (COND), related ICO guidance, and the Equality Act 2010
• Accountability and governance: The Senior Managers and Certification Regime (SM&CR) and other regulations noted above
• Contestability and redress: Dispute Resolution: Complaints Sourcebook (DISP)

The FCA also acknowledged that other regulations and frameworks will apply to AI use, including the ISO Standards on Artificial Intelligence and ICO guidance on AI and data protection.

 The future of finance in the age of AI

In a speech released on the same day as the AI update, Jessica Rusu, FCA chief data, information and intelligence officer, set out how the regulator intends to continue to support the financial services industry’s ongoing adoption of AI.

With global AI spend estimated to reach more than $2.6 trillion in 2026, and an upcoming survey conducted by the FCA and the Bank of England finding that 86% of firms now use AI, Rusu’s assertion that “firms are moving from experimentation to deployment” is undeniable. Rusu underlined that “firms are not bystanders in that process,” and reinforced many of the key messages from the regulator’s AI update:

• Many firms are “still under-investing” in AI governance
• “Clear accountability, risk-based controls, human oversight, escalation triggers, and senior managers personally accountable for AI systems” are essential to responsible AI adoption
• Firms need to invest in cyber and operational resilience, as FCA rules “already require firms to report major incidents, and that must extend to significant AI failures and near misses”

Rusu also discussed the position that the FCA and other regulators are in regarding the pace of technological change:

“AI is moving faster than any regulatory framework was designed. That means regulators will increasingly need to make judgments without precedent, while ensuring that trust remains at the heart of financial services.”

The speed of AI development means that dedicated AI regulation could well be obsolete before the ink had a chance to dry. By mapping AI use cases to existing regulations, and supplementing them with additional guidance as new use cases emerge and evolve, regulators give firms guardrails to ensure that AI is implemented responsibly and effectively. By taking a “compliance and governance first” approach to AI and engaging with existing rules and regulatory updates, firms can ensure that good practice makes perfect.

Firms looking to ensure their AI use meets both emerging regulatory guidance and the application of existing regulations can take a range of proactive steps, including capturing and archiving data from AI collaboration and communication platforms and reviewing their third-party and vendor’s AI posture.