The Financial Conduct Authority (FCA) has published examples of good and poor practice in artificial intelligence (AI), setting out how regulated firms should manage consumer outcomes, governance and operational resilience. Drawing on supervisory work, industry engagement and its AI Lab initiatives, the publication delivers the practical examples previewed alongside July’s Mills Review and applies the FCA’s existing regulatory framework. Firms remain responsible for outcomes from AI they develop, procure or deploy. Good consumer practice starts with a defined need and target market, tests for bias across different consumer characteristics, explains the tool’s role and limits, and monitors live outcomes. Poor practices include excluding vulnerable consumers without suitable alternative support, overstating AI capabilities and relying on technical guardrails that steer consumers toward inappropriate options. Governance should cover the full AI lifecycle, with clear senior management accountability, documented decisions and thresholds for intervention or escalation. Senior managers need not be technical specialists, but should understand relevant risks and obtain appropriate expertise. Human review must provide meaningful challenge rather than substitute for controls addressing underlying model risks. The FCA identified weaknesses where firms deployed tools before establishing governance, monitored technical performance rather than outcomes, or allowed reviewers to accept recommendations without scrutiny. On resilience, firms should incorporate AI dependencies into applicable operational resilience planning, test contingency arrangements and maintain visibility of supplier model changes. Untested vendor assurances and dependence on a single provider without viable alternatives or exit plans leave firms exposed to disruption. Controls should be proportionate, with smaller firms able to use narrower pilots, simpler risk tiers and targeted testing while retaining clear accountability.
UK Financial Conduct Authority publishes AI good and poor practice on consumer outcomes, governance and operational resilience
The UK Financial Conduct Authority has published AI good and poor practice examples covering consumer outcomes, governance and operational resilience, following its earlier commitment to provide practical clarity under existing rules. Firms should test for bias and consumer understanding, establish accountable oversight before deployment, and monitor actual outcomes rather than technical performance alone. They remain responsible for outsourced AI and should test supplier assurances, contingency arrangements and exit options.