The Financial Conduct Authority has published practical examples of good practice and areas for improvement for regulated firms using artificial intelligence. The material focuses on consumer outcomes, governance and accountability, and operational resilience. It is illustrative rather than a new set of rules.
What the FCA published
The FCA published AI in financial services: good practice and areas for improvement on 19 October 2026 and updated the page on 20 October. It draws on industry engagement, supervisory work and FCA AI Lab initiatives.
The FCA says the examples are illustrative, non-exhaustive and expected to evolve. They do not create new requirements, prescribe a single model or replace each firm's responsibility to decide what is appropriate and proportionate for its AI use cases, risks and potential impact.
Consumer outcomes come first
For consumer-facing uses, the FCA's examples begin with the consumer need rather than the technology. They include defining the target market and intended outcome, testing results across different consumer characteristics and scenarios, managing bias and accuracy, explaining AI's role and limits, monitoring live outcomes and maintaining routes for escalation to a person.
The FCA also identifies areas for improvement, including adopting AI without a clearly defined need, assuming outputs are clear without testing them, and creating inflexible automated journeys that can make support harder to access. These examples do not mean every payment or e-money firm must use the same testing programme. The relevant evidence depends on the use case and its possible effect on access, communications, support and vulnerable consumers.
Accountability across the AI lifecycle
The FCA says firms remain responsible for AI systems they develop, procure or use, including systems supplied by third parties. Its examples cover initial scoping, design, testing, deployment, ongoing monitoring, change and retirement.
Clear ownership is a recurring theme. The publication describes risk-based challenge before deployment, documented decisions, multidisciplinary involvement, named accountability and working escalation thresholds. It also shows that smaller firms can tailor existing governance and add targeted controls where needed instead of automatically creating a separate complex framework.
Human oversight must be meaningful. Reviewing an AI output is not enough on its own: the people involved need suitable information, authority and capability to challenge or intervene, supported by escalation routes that work in practice.
Operational resilience and suppliers
AI can introduce dependencies on models, data, infrastructure and external providers. The FCA's examples ask firms to consider these dependencies in resilience planning where applicable, including monitoring, incident response, continuity, fallback and exit arrangements.
Outsourcing an AI service does not remove the firm's responsibility. Useful questions include who owns the use case, what the supplier must deliver, how performance and material changes are monitored, what information the firm receives, and what happens if the tool is unavailable or behaves unexpectedly.
A proportionate starting point
For a firm that uses AI, a practical starting point is a use-case inventory linked to existing controls. For each material use case, the firm can record its purpose, affected consumers or operations, accountable owner, data and supplier dependencies, testing, monitoring, human intervention and fallback arrangements.
This is an evidence-led review technique, not an FCA checklist. Whether a particular use case needs further action depends on the firm's permissions, the applicable regulatory framework, the role and autonomy of the AI, outsourcing arrangements, risk and current controls.
Status and limitations
The FCA published the examples on 19 October 2026 and last updated the page on 20 October. The publication does not introduce a new effective date or implementation deadline. Existing FCA rules and regulatory frameworks continue to apply according to each firm's activities and circumstances.
This article provides general information. It does not assess any firm's systems or compliance and is not legal advice.