Introduction
The Financial Conduct Authority (FCA) published a comprehensive guidance titled "AI in financial services: good practice and areas for improvement" on 19 October 2026 together with a speech by Jessica Rusu, the FCA’s Chief Data, Information and Intelligence Officer, detailing the regulator's strategy. The FCA is not introducing new rules or making formal, firm-specific compliance determinations. Instead, it is emphasising that firms remain responsible for customer outcomes when using AI and must be able to show how they have applied, and complied with, existing regulatory expectations in practice.
So, rather than creating a new AI-specific rulebook, the FCA’s message is that established frameworks, including the Principles for Businesses, the Consumer Duty, the Senior Managers and Certification Regime, and operational resilience requirements, already apply to AI deployment.
The key takeaway from these publications is therefore not simply the FCA’s focus on the technology itself, but its expectation that firms understand customer needs before deploying AI tools, appropriately support vulnerable customers, put in place clear ownership and risk-based controls, and, above all, ensure senior management accountability.
AI good practice and areas for improvement: Key takeaway for consumer finance firms
For consumer finance firms, the priority will be to understand customer needs before selecting the technology and to scrutinise the customer journey end to end. Firms should be able to demonstrate that AI is delivering fair outcomes in line with the Consumer Duty, while managing risks around bias and accuracy, maintaining explainability, documenting key decisions and clearly communicating to customers how AI is used and where its limitations lie. As discussed in our previous article, these considerations are central to effective AI governance.
View our table where we examine the key focus areas for consumer finance firms and, drawing on the report, the relevant good practices and areas for improvement.
Concluding remarks
The FCA’s approach to artificial intelligence is moving decisively from observation to active supervision. As AI becomes increasingly embedded across UK financial services, with 86% of firms reportedly using or exploring it, the regulator’s focus is shifting from understanding the technology to testing how it operates in practice, where the risks lie and whether firms can control them.
Ms Rusu confirms in her speech that the FCA is embedding 6 of the 7 recommendations in the Mills Review into live work immediately, with a focus on testing, assurance, monitoring and surveillance. She says this work is being informed through direct engagement with firms, including via its innovation services, AI Lab and Sandbox-style activity. On Agentic Finance Ms Rusu mentions that the FCA will work with industry, fellow regulators and frontier labs to develop a trusted framework for agentic finance, including clear approaches to agent identity, delegated authority, accountability and execution.
The FCA’s message is clear: firms cannot treat AI as a standalone innovation issue or assume that existing governance arrangements will be sufficient. They will need to show that they understand how their AI systems function, that there is meaningful human oversight over important decisions, and that appropriate safeguards are in place to prevent consumer harm. They will also need to think beyond individual use cases and consider how AI-related failures could create wider operational or market disruption.
Ultimately, the direction of travel is towards greater regulatory scrutiny, not less. Innovation may be encouraged, but it will not displace accountability. Firms using AI will increasingly be expected to demonstrate not only that the technology delivers value, but that it does so in a way that is explainable, governable and resilient. For firms, the practical implication is straightforward: AI governance, oversight and contingency planning are now central to regulatory compliance, not peripheral to it.
