The FCA has published an AI practice map—what changes for financial firms?
The UK regulator says existing duties already apply to AI and illustrates better and worse practice across consumer outcomes, governance and resilience. The examples create no new requirements and disclose no firm-level results.
The short version
- What happened
- The FCA says regulated firms remain responsible for consumer outcomes when AI supports products, communications, decisions or service channels.
- Who it affects
- Customers should receive understandable explanations, a workable route to human support and the ability to challenge outcomes.
- What remains unproven
- The FCA says the examples are illustrative, non-exhaustive and do not create new requirements.
Keep in mind
The FCA says the examples are illustrative, non-exhaustive and do not create new requirements.
No denominator, named firm, prevalence estimate, comparative effect size or complete outcome dataset is published.
An observed practice is not proof that the same control will work for every product, model or customer group.
Source analysis · 1 linked source. Primary analysed source date: 19 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
Existing duties now have concrete AI examples
The Financial Conduct Authority has published a practical map of stronger and weaker AI practice for UK financial firms. Its central message is continuity: Consumer Duty, governance, accountability, operational-resilience and outsourcing obligations still apply when a firm builds, buys or lets staff use AI. The 19 October publication does not create a new rulebook or prescribe one model.
For consumer-facing systems, the FCA points to defining the need before choosing AI, testing outcomes across characteristics and scenarios, explaining the tool's role and limits, and preserving routes to human support. It warns against assuming outputs are understandable, automatically excluding people with vulnerability indicators, or trusting a language model to identify temporary vulnerability without sufficient testing.[1]
Records, thresholds and exit plans matter
The regulator describes firms keeping records of prompts, outputs, model versions, filters and escalation decisions; setting risk thresholds; and comparing AI-supported processes with human-led ones. For third-party systems it highlights inventories, notice of model changes, tested contingency plans and viable alternatives. One anonymised poor-practice example describes a firm having to redesign a product when its chosen model was retired because it had no transition plan.[1]
The distinction that matters
How the FCA frames responsible AI use
The regulator organises its examples around three linked responsibilities.
Consumers
Test access, understanding, support and vulnerability
Show good outcomes and routes to challenge
Governance
Assign owners, thresholds, records and escalation
Keep people accountable across the lifecycle
Resilience
Map providers, changes, failures and exit options
Reduce disruption and concentration risk
What the publication cannot establish
The evidence comes from FCA engagement with firms, industry and consumer bodies, charities, policymakers, technology providers and academics, plus AI Live Testing, its sandbox and other initiatives. The regulator does not state how many organisations or systems informed each observation, identify the firms, publish comparative outcome measures or estimate how often the weak practices occur. The examples are therefore supervisory signals, not a prevalence study or proof that named controls always work.
For customers, the practical test is whether AI changes access, explanations, complaint handling or support—and whether a person can intervene when needed. Evidence that would strengthen the assessment includes denominators, before-and-after consumer outcomes, error and disparity rates, complaint and redress data, and results from resilience exercises. Firms should treat the map as a prompt to demonstrate outcomes under existing obligations, not as a compliance checklist that guarantees safety.[1]