FCA Publishes AI Good and Poor Practice Observations for Firms

The Financial Conduct Authority (FCA) published AI good practice and poor practice examples on October 19, 2026, and said firms that outsource AI services to a third party remain responsible for them.

The paper, titled “AI in financial services: good practice and areas for improvement”, creates no new requirements. The FCA said the examples do not prescribe a single operating model and are illustrative and non-exhaustive.

For compliance, risk and technology teams, the paper shows how supervisors plan to apply existing rules to AI. Those rules include the Consumer Duty, the Senior Managers and Certification Regime (SM&CR), operational resilience and the outsourcing and critical third parties regimes. The FCA said it will update the examples as the technology evolves, and it updated chapter 4.1 on October 20 with an editorial amendment.

What the FCA AI good practice paper contains

The examples come from industry engagement, supervisory work and the FCA’s AI Lab, which runs AI Live Testing and the Supercharged Sandbox. They sit in three chapters: the Consumer Duty and consumers in vulnerable circumstances, governance and accountability, and operational resilience.

On governance, the FCA lists as good practice structured challenge and sign-off before deployment, and oversight built into existing governance. It also lists a central inventory of AI agents with owners and access, and boards that treat AI as a strategic issue and set an AI risk appetite.

The poor practice list is as specific. It includes informal or generic approval processes and “retrospective governance”, where controls are added after design decisions are made. It also lists monitoring of technical metrics only, and second and third-line functions without AI expertise.

Human review gets its own warning. The FCA names relying on human review to compensate for model weaknesses as poor practice, and says review can become a “box-ticking” exercise.

Jessica Rusu, the FCA’s chief data, information and intelligence officer, made the same point in a speech published the same day. Some firms, she said, “retrofit governance after technology has already been deployed”, which she called “the wrong way around”.

Third-party AI in the FCA good practice paper

Chapter 4.2 covers third-party relationships. The FCA states: “Firms can outsource AI services, but remain responsible for them.”

The FCA’s good practice examples for third-party AI are concrete. Firms reduce single-vendor dependence and design systems that can work with different providers. They keep clear inventories of AI use cases and providers, a close cousin of the third-party inventory that third-party risk management programs already maintain. They also use contracts to get notice of significant model changes, plan and test contingencies for provider changes, and assess suppliers’ own use of AI during procurement.

The poor practice examples mirror them. The FCA names overreliance on untested vendor assurances, overreliance on hard-to-replace providers, and single-platform dependence without exit options.

Chapter 4.1 adds a rule reference. Mapping AI dependencies into resilience planning is, the FCA noted, “a requirement for firms in scope of SYSC 15A”, the operational resilience part of its Senior Management Arrangements, Systems and Controls sourcebook. Rusu told her audience to understand supplier concentrations and dependencies, “including reliance on a single model”.

The FCA’s existing outsourcing and critical third parties regimes are among the rules the paper lists as already applying. The paper does not create a separate regime for AI suppliers.

Which firms are in scope of the AI paper

The FCA does not break scope down by firm type. Section 5 says the paper applies to regulated firms that develop, deploy, procure or use AI in connection with regulated activities, consumer journeys, operations or governance.

That covers in-house tools, third-party tools, embedded tools and tools staff use to support decisions. Banks, asset managers and fund firms are therefore in scope to the extent they run regulated activities in the UK. The FCA said there is no one-size-fits-all approach and that firms should respond proportionately.

The chapters apply unevenly. SYSC 15A applies only to firms within its scope, and the Consumer Duty chapter bears most heavily on firms with retail customers. Frontier AI and cyber risks are out of scope of this version, and the FCA points instead to a joint statement with the Bank of England and HM Treasury. Data protection and equality law sit with other regulators and are not addressed.

SM&CR and the Consumer Duty tie to FCA AI practice

On accountability, the FCA said it does “not expect senior managers to be technical specialists”. It does expect them to take reasonable steps to understand AI risks in their area and provide effective challenge.

Good practice under that heading is clear senior management function ownership of AI risk from the design stage, documented and auditable decisions, threshold-based escalation routes and targeted training. Poor practice is delegating AI development to technical teams without effective challenge, weak audit trails, and no link between a risk identified and the senior manager accountable for it.

The Consumer Duty chapter makes firms responsible for consumer outcomes from AI-supported tools. Good practice is defining the consumer problem and target market first, testing for bias across groups and monitoring live outcomes. Poor practice includes building a tool without defining foreseeable harms, excluding vulnerable consumers from AI journeys by default and overstating what the AI can do.

ACA Group’s reading for buy-side firms

ACA Group, a compliance consultancy, published its reading on October 22 in a post titled “What the FCA’s AI Guidance Means for Asset Managers”. It addresses chief compliance, operating and technology officers at buy-side firms with UK-regulated activities.

ACA’s central point on third-party AI outsourcing matches the FCA’s good practice message. “Third-party tools can speed up adoption, but they do not remove the firm’s responsibility for how AI is used,” wrote the post’s author, Devon Rogers-Scorah.

The post adds practitioner detail that goes beyond the FCA text. Vendor due diligence, it said, should go beyond a pre-contract questionnaire to cover how providers handle model changes, whether the tool can be tested in the firm’s own environment and what happens if it fails or is withdrawn. For higher-impact services, ACA recommends a fallback such as another provider, an earlier approved model version or a manual process, tested rather than only documented.

Those fallback options are ACA’s recommendations. The FCA paper asks for contingencies to be planned and tested but does not list them.

An independent view on the FCA AI good practice message

Lawyers at Lewis Silkin reached the same reading of the paper from outside the buy-side consultancy market. Wendy Saunders, partner and co-head of financial services, and Helen Hart, managing knowledge lawyer, wrote in an October 23 analysis that “firms cannot outsource responsibility to algorithms, technology vendors or large language models”.

They added that existing FCA rules already apply to AI, so governance should not be treated as a separate exercise. They also wrote that “simply adding human review does not automatically reduce risk”.

Both readings leave the same practical question for boards. The Rusu speech and the paper itself point to evidence of working controls in live use, rather than a policy document. Teams building that evidence can start from the board-level questions on AI in third-party risk and the legal team priorities for 2026.

What comes next for FCA AI good practice

The FCA has not set a deadline, because the paper creates no obligations. Rusu said in her speech that incident reporting under existing rules “must extend to significant AI failures and near-misses”. The FCA also plans to develop a framework for agentic finance with industry and other regulators, with no date given.

The FCA said it will update the good and poor practice examples as the technology changes, and the next revision is the item to watch for new third-party AI examples.