The Financial Conduct Authority (FCA) has released a set of good and poor practice observations on the use of AI across financial services. The paper stops short of introducing a dedicated AI rulebook or mandating a specific operating model, but it sends a clear supervisory message to firms.
According to ACA Group, for chief compliance officers, chief operating officers and chief technology officers at buy-side firms with UK-regulated activities, the publication shows how the regulator intends to apply its existing expectations on governance, accountability, operational resilience and consumer outcomes to AI.
The central test is not whether a tool is branded as AI, but whether a firm can explain what the tool does, why it is used, who owns it and how its risks are controlled in practice. That holds true whether AI is supporting investment research, portfolio construction, investor reporting, operations or internal decision-making.
The FCA’s examples span the full AI lifecycle, from design through monitoring, intervention, change and eventual retirement. This offers firms a useful preview of the questions likely to surface in supervisory conversations, including how AI use has been identified, how its impact has been assessed and how firms respond when a tool or its provider changes.
Strong governance, the regulator suggests, begins with the use case rather than the technology. Good practice involves defining a clear purpose and running a narrow pilot before scaling. Poor practice involves deploying first and bolting on governance afterwards, which can leave ownership unclear, documentation thin and escalation routes absent.
A central register of AI use cases, each with a named owner, risk rating and defined boundaries, is a sensible starting point. The depth of governance should reflect client and market impact, data sensitivity, third-party reliance and the degree of autonomy involved.
Testing and human oversight must also carry real weight. The FCA highlights cross-functional challenge and formal sign-off before deployment, while warning that human review can easily become a box-ticking exercise. Reviewers need the information, authority and time to pause, override or escalate. In investment settings, firms should watch for breaches of mandate restrictions, style drift, unreliable valuations and rising levels of intervention.
Approval does not end the governance process. For each material use case, firms should be able to connect the identified risk to pre-deployment testing, live thresholds, a responsible reviewer and a clear escalation path.
Senior managers are not expected to be AI specialists, yet they remain accountable. They must understand the risks within their remit, draw on appropriate expertise and provide effective challenge, particularly when a model changes or its autonomy grows.
Outsourcing does not shift responsibility either. Vendor due diligence should extend well beyond a pre-contract questionnaire, and higher-impact services need a tested fallback, whether an alternative provider, an earlier model version or a manual process.
Ultimately, firms do not need an elaborate AI framework. They need evidence that their arrangements genuinely work, and independent challenge of priority use cases can help bridge the gap between policy and proof.
Read the full ACA Group post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
