FCA Good Practice for Financial Services AI

Overview

The Financial Conduct Authority's AI in financial services: good practice and areas for improvement supports safe and responsible artificial intelligence adoption through practical examples from industry engagement, supervisory work, and its AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox. Its scope encompasses artificial intelligence used directly in consumer- or client-facing products and services, as well as artificial intelligence used internally to improve operational efficiency. The publication recognises potential benefits such as greater operational efficiency, lower service costs, and more accessible, tailored financial services, while re-emphasising that firms remain fully responsible for the resulting consumer outcomes.

This document constitutes non-binding good-practice guidance rather than primary legislation or a new set of binding administrative rules. Section 1.2 expressly states that its examples are illustrative, non-exhaustive, and expected to evolve over time. They neither create standalone regulatory obligations nor prescribe a single mandatory governance model, and they do not replace firms' legal responsibility to decide what is appropriate and proportionate for their specific use cases, risks, and potential market impacts. Its primary practical significance lies in showing how existing legal and regulatory obligations apply to AI-enabled activities across the financial sector. An omitted example, including one concerning fair value assessments, does not remove the operational need to consider the corresponding existing regulatory requirement.

Definitions and Scope

The publication does not establish a statutory definition of artificial intelligence or introduce a legally determinative taxonomy of AI systems. Section 1.2 identifies machine learning, generative AI, and agentic AI as examples of technologies to which its developing supervisory practices may be relevant, directing regulated entities to the regulator's online AI jargon buster for descriptive definitions. Its approach is therefore strictly use-case and outcome-focused rather than dependent on a fixed statutory classification threshold. For regulatory analysis, the essential inquiries concern how a system is deployed, who it affects, what specific risks it creates, and whether the firm's operational controls function effectively in practice.

Several operational concepts shape the illustrative examples without becoming new formal legal definitions. Human oversight includes interpreting, challenging, overriding, and escalating model outputs, with relevant staff understanding the system's core purpose and operational limitations. Model drift is identified as an evolving risk that ongoing monitoring should actively detect. Bias testing examines unfair or unjustified differences in outcomes across relevant consumer groups and synthetic scenarios. Auditable records include user prompts, system outputs, model versions, applied safety filters, and operational escalation decisions. Vulnerability is addressed through consumers' individual circumstances and support needs; the publication cautions against assuming that a large language model can reliably identify customer vulnerability from plain text alone.

Governance and Institutional Framework

The existing regulatory framework forms the foundation for responsible artificial intelligence adoption, supporting financial market stability and positive consumer outcomes. Firms' AI use is also subject to legal frameworks overseen by other statutory regulators, including data protection authorities. Within financial institutions, section 3 calls for proportionate oversight, clear executive accountability, and risk-based controls throughout the entire artificial intelligence lifecycle. Regulated firms remain responsible for systems they directly develop, procure from third-party vendors, and deploy, including all outputs and resulting market outcomes. The publication does not establish a new regulator, require a mandatory organizational structure, or transfer regulatory accountability to technology suppliers merely because a system is purchased externally.

Good governance practice includes multidisciplinary challenge, rigorous pre-deployment testing, and formal sign-off before operational deployment, combined with clear accountability and executive oversight. Larger institutions may establish central artificial intelligence boards or data ethics committees to share organizational learning, establish core principles and risk tolerances, and support senior leadership without creating operational bottlenecks. Smaller institutions can incorporate AI oversight directly into existing enterprise risk and compliance committees. Governance structures should cover the whole consumer journey and integrate seamlessly with established management frameworks. Fragmented responsibility, isolated governance, retrospective controls, and inadequate involvement of control functions represent key operational weaknesses. Senior managers must remain accountable and take reasonable steps to mitigate identified risks.

Key Focus Areas and Consumer Outcomes

Consumer outcomes are central to section 2. Regulated firms should identify consumer needs, target market characteristics, and core objectives prior to designing or deploying AI-supported financial products and services. Particular care is required where artificial intelligence directly influences service access, issue prioritization, or customer support and guidance. Good practice involves deciding upfront which specific operational tasks AI should support or automate and where it should abstain, redirect, or escalate to human staff. Bias testing should systematically evaluate relevant consumer groups and deployment scenarios, followed by prompt corrective action and comprehensive retesting. Technical guardrails must be continually assessed for their real-world effects, as a control addressing one technical model risk can inadvertently create a new operational problem for consumers.

Consumer understanding and operational support are equally critical. Regulated entities should explain the role and limitations of artificial intelligence in clear, understandable terms, testing customer comprehension where appropriate, and avoiding inflated claims regarding model accuracy or reliability. Approved source material, automated checks, and established escalation routes can significantly reduce inappropriate generative model responses. Consumers in vulnerable circumstances should not be automatically excluded from AI-driven service journeys without evaluating whether suitable alternative support channels or equivalent benefits remain available. Good practice incorporates clear channel choices, structural continuity when switching between support channels, and continuous learning from unexpected service outcomes. Inflexible customer interfaces, vague escalation triggers, and excessive technical confidence in vulnerability detection algorithms severely undermine customer support outcomes.

Implementation Framework

Section 3.1 identifies essential lifecycle stages that proportionate governance should address: initial scoping, system design and development, testing and validation, operational deployment, ongoing outcome monitoring, and system decommissioning. Implementation should always begin with defining the consumer problem and intended outcome rather than deciding to adopt artificial intelligence for its own sake. Firms can then thoroughly assess the specific use case's risk profile, establish appropriate automation boundaries, assign executive responsibility, and conduct structured internal challenge before launch. Governance must be designed alongside the technical system, rather than added retrospectively after core architectural decisions have constrained available controls or obscured accountability.

Operational controls should reflect the specific deployment context alongside the firm's size, technical capability, and overall risk profile. Smaller firms may effectively utilize simplified risk tiers, phased system rollouts, targeted human review, and existing corporate governance structures. Sample outputs, vulnerability markers, and outcome comparisons across diverse scenarios can successfully identify unfair variations without requiring large-scale technical testing infrastructure. Carefully filtered and human-reviewed reference datasets can provide high-quality benchmarking standard outputs. For highly autonomous agentic systems, good practice includes nested governance layers, clear escalation routes, and automated compliance controls spanning complex multi-step workflows. These governance examples represent practical options rather than mandatory specs, formal certification prerequisites, or prescribed minimum testing volumes.

Monitoring and Evaluation

Section 3.2 emphasizes continuous monitoring of real-world operational outputs, consumer outcomes, and evolving system risks. Good-practice examples include centralized monitoring dashboards with defined risk thresholds and performance benchmarks, post-implementation review committees, periodic spot checks, automated output scoring, comprehensive interaction logs, and detailed audit trails. Regulated entities can also systematically gather operational staff feedback regarding whether employees accepted, modified, or rejected model outputs and the specific reasons for doing so. Structured evaluation frameworks help benchmark generative models against explicit operational criteria, while direct comparisons with human-led workflows indicate whether additional controls are necessary. Monitoring must actively enable prompt human intervention whenever systems create risks to consumers, financial market integrity, or operational resilience.

Point-in-time governance, narrow technical accuracy metrics, and reactive or static monitoring mechanisms are identified as major areas for improvement. Effective oversight depends on properly trained personnel and capable second- and third-line control functions. Role-specific training programs should address senior managerial accountability, technical risk controls, and the independent critical judgment required of human reviewers, including specific mitigation of automation bias. Governance frameworks must be reviewed periodically as underlying technologies and supervisory expectations evolve. Section 2.3 specifies no fixed mandatory interval for reviewing live outcomes: firms must determine an appropriate frequency suited to their specific use cases. More frequent outcome reviews, backed by clear responsibilities and swift escalation pathways, help identify and remediate potential consumer harm at an early stage.

Penalties, Liability, and Appeals

The publication does not create a standalone regulatory offence, statutory penalty schedule, civil cause of action, or AI-specific administrative appeal mechanism. Its illustrative guidance examples should not be treated as independently enforceable statutory rules. Nevertheless, the deployment of artificial intelligence does not alter or displace existing legal and regulatory obligations, and firms remain fully liable for consumer outcomes delivered through their products, services, communications, and customer support channels. Section 3 confirms firm responsibility for internally developed, outsourced, and procured software systems. Any supervisory or enforcement consequences would necessarily stem from underlying legal statutory frameworks, such as the Consumer Duty or Senior Managers and Certification Regime, rather than a standalone sanction for omitting a good-practice example.

Challenge and effective complaints handling represent vital practical requirements. Section 2.2 encourages firms to maintain adequate operational records, explanations, and outcome monitoring to support robust complaint resolution and customer challenge. Maintaining records of system prompts, model outputs, underlying software versions, active filters, and escalation decisions enables institutions to explain outcomes clearly and investigate disputed decisions effectively. Purely technical system explanations are inadequate if the firm cannot identify poor customer outcomes, understand underlying causal factors, or provide effective customer redress. The guidance does not alter statutory compensation caps, limitation periods, appeal filing deadlines, or established procedural dispute channels.

Relationship to Other Instruments

Section 1.1 explicitly links artificial intelligence adoption to the existing regulatory architecture and refers to the FCA's AI Update publication as setting out that statutory baseline. Section 2 specifically directs regulated entities to Finalised Guidance FG22/5 on the Consumer Duty, as well as Finalised Guidance FG21/1 regarding the fair treatment of vulnerable customers. These relationships are substantive: selecting and operating AI tools must maintain complete alignment with existing obligations regarding product governance, clear customer communications, fair value, and consumer support. This publication does not replace existing regulatory instruments or exhaust the full scope of statutory considerations required under them.

The guidance explicitly notes that its examples do not cover every facet of the Consumer Duty, such as detailed fair value assessments. This omission must not be construed as creating an exemption for AI-enabled financial services. The publication also acknowledges legal frameworks overseen by other statutory regulators, including data privacy and competition authorities, without establishing an exhaustive cross-regulator mapping. References to AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox, describe part of the supervisory evidence-gathering context; participation in these initiatives is strictly voluntary and does not grant immunity or exemptions from existing statutory requirements. No new regulatory filing form, mandatory registration system, or formal conformity assessment process is introduced by this guidance.

International Alignment

The publication is specifically tailored to artificial intelligence deployment within United Kingdom financial services and does not establish an international treaty, bilateral mutual-recognition arrangement, or cross-border regulatory passport. Its core focus on proportionality, lifecycle risk management, active human oversight, and positive consumer outcomes reflects a domestic supervisory strategy rather than a formal declaration of compliance with foreign AI legislative frameworks. It does not incorporate international technical standards as mandatory legal conditions. Consequently, financial institutions should not treat compliance with these good-practice examples as proof of meeting artificial intelligence regulatory requirements in overseas jurisdictions.

Cross-border operational coordination remains essential for multinational financial institutions. Section 3.1 highlights potential risks where risk controls and supervisory responsibilities are fragmented across international business units or regional entities. Firms operating internationally can utilize these governance principles to establish unified global ownership and risk oversight while independently assessing local statutory requirements in each operating jurisdiction. The publication's recognition of parallel legal frameworks supports a clear division of compliance responsibilities, without establishing legal equivalence with foreign regulations, incorporating external international instruments by reference, or establishing a timeline for harmonizing global AI regulations.

Implementation Timeline

Compliance Checklist

Sources and References