The FCA has published an AI practice map—what changes for financial firms?
The UK regulator says existing duties already apply to AI and illustrates better and worse practice across consumer outcomes, governance and resilience. The examples create no new requirements and disclose no firm-level results.
The short version
3 key points
- What changed
- The FCA says regulated firms remain responsible for consumer outcomes when AI supports products, communications, decisions or service channels.
- Why it matters
- Customers should receive understandable explanations, a workable route to human support and the ability to challenge outcomes.
- What to watch
- FCA enforcement or supervisory findings that show how the examples are applied in practice
Existing duties now have concrete AI examples
The Financial Conduct Authority has published a practical map of stronger and weaker AI practice for UK financial firms. Its central message is continuity: Consumer Duty, governance, accountability, operational-resilience and outsourcing obligations still apply when a firm builds, buys or lets staff use AI. The 19 October publication does not create a new rulebook or prescribe one model.[1]
Records, thresholds and exit plans matter
The regulator describes firms keeping records of prompts, outputs, model versions, filters and escalation decisions; setting risk thresholds; and comparing AI-supported processes with human-led ones. For third-party systems it highlights inventories, notice of model changes, tested contingency plans and viable alternatives. One anonymised poor-practice example describes a firm having to redesign a product when its chosen model was retired because it had no transition plan.[1]
Who it affects
Customers should receive understandable explanations, a workable route to human support and the ability to challenge outcomes.[1]
Keep in mind
The FCA says the examples are illustrative, non-exhaustive and do not create new requirements.
No denominator, named firm, prevalence estimate, comparative effect size or complete outcome dataset is published.
An observed practice is not proof that the same control will work for every product, model or customer group.
Source analysis · 1 linked source. Original source date: 19 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
Existing duties now have concrete AI examples
The Financial Conduct Authority has published a practical map of stronger and weaker AI practice for UK financial firms. Its central message is continuity: Consumer Duty, governance, accountability, operational-resilience and outsourcing obligations still apply when a firm builds, buys or lets staff use AI. The 19 October publication does not create a new rulebook or prescribe one model.
For consumer-facing systems, the FCA points to defining the need before choosing AI, testing outcomes across characteristics and scenarios, explaining the tool's role and limits, and preserving routes to human support. It warns against assuming outputs are understandable, automatically excluding people with vulnerability indicators, or trusting a language model to identify temporary vulnerability without sufficient testing.[1]
Records, thresholds and exit plans matter
The regulator describes firms keeping records of prompts, outputs, model versions, filters and escalation decisions; setting risk thresholds; and comparing AI-supported processes with human-led ones. For third-party systems it highlights inventories, notice of model changes, tested contingency plans and viable alternatives. One anonymised poor-practice example describes a firm having to redesign a product when its chosen model was retired because it had no transition plan.[1]
The distinction that matters
How the FCA frames responsible AI use
The regulator organises its examples around three linked responsibilities.
Consumers
Test access, understanding, support and vulnerability
Show good outcomes and routes to challenge
Governance
Assign owners, thresholds, records and escalation
Keep people accountable across the lifecycle
Resilience
Map providers, changes, failures and exit options
Reduce disruption and concentration risk
What the publication cannot establish
The evidence comes from FCA engagement with firms, industry and consumer bodies, charities, policymakers, technology providers and academics, plus AI Live Testing, its sandbox and other initiatives. The regulator does not state how many organisations or systems informed each observation, identify the firms, publish comparative outcome measures or estimate how often the weak practices occur. The examples are therefore supervisory signals, not a prevalence study or proof that named controls always work.
For customers, the practical test is whether AI changes access, explanations, complaint handling or support—and whether a person can intervene when needed. Evidence that would strengthen the assessment includes denominators, before-and-after consumer outcomes, error and disparity rates, complaint and redress data, and results from resilience exercises. Firms should treat the map as a prompt to demonstrate outcomes under existing obligations, not as a compliance checklist that guarantees safety.[1]
Watch the background, then check the evidence
Illustrative photo · not a video frame
UNESCO · 11 min 27 sec · Background explainer
UNESCO Talks: Interview with 2024 Nobel laureate Professor Daron Acemoglu
YouTube loads only when you choose; playback starts when you press play.
Economist Daron Acemoglu discusses how choices about AI affect workers, inequality and society. Pair the interview with our comparison of task exposure, hiring and skills evidence.
Evidence check: An expert interview from 2024, offering a perspective on policy and work rather than a measured forecast of job losses.
Published 2024-10-14. Source checked 14 October 2026. Check captions on the publisher’s video page.
Read the AI and jobs guidePhoto: Dylan Gillis / Unsplash · Licence
Evidence check
The FCA says the examples are illustrative, non-exhaustive and do not create new requirements.
No denominator, named firm, prevalence estimate, comparative effect size or complete outcome dataset is published.
An observed practice is not proof that the same control will work for every product, model or customer group.
Reporting basis: Source analysis. Original source date: 19 October 2026.
Continue the story
Read next
Also about financial regulation
What does frontier AI change for banks?
Canada's federal prudential regulator says frontier AI is compressing cyber-defence time and increasing dependence on a small number of model and cloud providers. The 8 October update is a supervisory risk assessment, not evidence of a new bank failure, breach or enforcement action.
Read the 9 min reportAlso about financial regulation
What will Hong Kong expect from banks using AI agents?
The HKMA's new ART framework moves banking oversight toward named ownership, live monitoring, dependency maps and possible kill switches. A fuller agent-governance proposal is still to come.
Read the 4 min reportExplore the full source and evidence record
What this means for people
- Customers should receive understandable explanations, a workable route to human support and the ability to challenge outcomes.
- Staff and senior managers remain accountable for AI-supported decisions rather than transferring responsibility to a model or supplier.
Global context
The publication applies to FCA-regulated activities in the United Kingdom. Firms may also face data-protection, equality and other sectoral rules, while institutions outside the UK need to map the ideas to their own legal and supervisory regimes.
What the evidence does not yet show
- The FCA says the examples are illustrative, non-exhaustive and do not create new requirements.
- No denominator, named firm, prevalence estimate, comparative effect size or complete outcome dataset is published.
- An observed practice is not proof that the same control will work for every product, model or customer group.
What to watch next
- FCA enforcement or supervisory findings that show how the examples are applied in practice
- Published consumer-outcome, disparity, complaint and redress measures
- Evidence from resilience tests involving model retirement, provider failure or sudden model change
Living evidence record
Impact record IAI-1QQ0G1L
Evidence stage
Announced
Confidence
Developing
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
20 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what UK Financial Conduct Authority published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 20 October 2026
Research question, topics and regions
How the FCA's new supervisory examples translate existing UK financial-services duties into practical AI controls
Topics: Financial regulation · Consumer Duty · Vulnerable customers · AI governance · Operational resilience
Regions: United Kingdom
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.