The Financial Conduct Authority published AI in financial services: good practice and areas for improvement on 19 October 2026, and made an editorial amendment to chapter 4.1 on 20 October 2026. The publication sits in the FCA good and poor practice series. It records findings from supervisory engagement with firms and from the FCA AI Lab, which includes AI Live Testing and the Supercharged Sandbox. It is not a consultation and it opens no comment period.
The FCA states that the examples are illustrative and non-exhaustive and do not create new requirements. Existing obligations continue to govern. Those cited are the Principles for Businesses in PRIN, the threshold conditions in COND, the systems and controls requirements in SYSC, including the operational resilience requirements in SYSC 15A, the complaints rules in DISP, and the Senior Managers and Certification Regime. The Consumer Duty guidance in FG22/5 and the guidance on the fair treatment of vulnerable customers in FG21/1 are the stated reference points for consumer outcomes, alongside the Equality Act 2010.
Authorised firms running AI in retail journeys are told to define the consumer need and target market before deployment, to test outcomes across consumer characteristics, and to monitor outcomes once a model is live. Banks, insurers, consumer credit lenders and advice firms are warned against excluding vulnerable consumers from AI journeys and against automated journeys that make human support hard to reach. Senior managers carry named ownership of AI risks under the Senior Managers and Certification Regime, and the FCA criticises informal or retrospective sign-off and reviewers who rubber stamp model outputs. Firms dependent on a single model or vendor are told to map AI dependencies into resilience planning and to hold contingency and exit plans.
The FCA sets no compliance deadline, because the publication adds no obligation. Smaller firms are told that proportionate, risk-based approaches are acceptable, and the document carries worked instances of scaled governance and targeted testing. Vendor assurance is treated as insufficient on its own where the firm has not tested it. The FCA leaves firms to decide what is appropriate for their own AI use cases, which keeps the division of responsibility between firm and technology supplier a matter for contract.
Licentium advises authorised firms, model vendors and outsourced service providers on United Kingdom financial services obligations attaching to AI deployment. Work we undertake includes mapping AI use cases against the Consumer Duty and FG21/1, reviewing governance and sign-off records against SYSC and Senior Managers and Certification Regime expectations, assessing model and vendor concentration against the operational resilience requirements in SYSC 15A, and drafting contractual allocation of AI risk with technology suppliers.