Image: Pexels, used under the Pexels License.
This is for the IFA practice, the small broker, the payments start-up and the consumer credit firm that has a chatbot, an AI note-taker or an AI-drafted letter somewhere in its customer journey. The FCA hasn't written AI rules for you. It has done something more useful for supervisors: it has published what good and poor AI practice looks like, with "Smaller firms focus" boxes scattered through it.
The publication, "AI in financial services: good practice and areas for improvement", came out on Monday, October 19, 2026, alongside a speech by Jessica Rusu, the FCA's chief data, information and intelligence officer, at Bloomberg's UK Policy Series. She said the regulator's joint survey with the Bank of England, due next week, shows 86% of firms now use AI, and that on governance "too many firms are still under-investing." The examples come from supervisory work, industry engagement, AI Live Testing, the Supercharged Sandbox and an "AI in smaller firms" event. The FCA is explicit that they "do not create new requirements." They sit under rules you already follow:
Image: AI Policy Desk chart, built from section 1.1 of the FCA's October 19, 2026 publication.
The checklist
Each line is something the FCA described as good practice or flagged as an area for improvement. The right-hand column tells you where to read it on the FCA page.
Accountability
| Check | Done when | FCA section |
|---|---|---|
| Every material AI use case has a named senior manager | A list, one row per use case, with the SMF holder's name, signed before go-live | 3.3 |
| Owners are set at design, not after launch | The owner's name is on the project before anyone picks a vendor | 3.3, 3.1 |
| Risk appetite is written down per use case | Each row says what "acceptable" means and what triggers escalation | 3.5 |
| Ownership covers third-party tools | Vendor-supplied AI (CRM assistants, note-takers) is on the list too | 3.3 |
| Senior managers have had targeted training | A dated record that the owner was briefed on that use case's risks | 3.3 |
The FCA doesn't expect your senior managers to be engineers. It does expect them to take "reasonable steps" to understand the risks in their area, and it criticised firms that handed AI decisions entirely to technical teams. The Law News write-up quotes Peter Lee, head of AI governance at Simmons & Simmons: "If monitoring does not keep pace as AI systems change, senior managers will struggle to show they have taken reasonable steps."
Human review that leaves a trail
| Check | Done when | FCA section |
|---|---|---|
| You know where review is required | Each use case says whether a person must check outputs before they go out | 3.4 |
| Review is logged, not assumed | The log shows review needed, review done, and approved, overridden or escalated | 3.3 (smaller firms) |
| Reviewers can't just click "approve" | Spot checks of reviewed items; reviewers can escalate without asking permission | 3.4 |
| For new tools, reviewers decide blind | During set-up, staff judge some cases without seeing the AI's answer, then compare | 3.4 (case study N) |
That second row is lifted almost word for word from a smaller firm the FCA cited, which recorded "whether staff needed to review AI outputs, whether this happened, and whether they approved the outputs, overrode them or escalated issues." The FCA's warning case is the opposite: a firm where human review "became a tick-box exercise over time." Our human-in-the-loop guide covers how to design the review step itself.
Customers
| Check | Done when | FCA section |
|---|---|---|
| The customer need is defined before the tool | One paragraph per use case: which customers, what problem, what outcome | 2.1 |
| Vulnerable customers aren't shut out by default | If you route them away from the AI, there's another route that works as well | 2.1 |
| Customers are told it's AI and what it can't do | The chat window or letter says so, and says when to ask a person | 2.2 |
| Nothing overstates accuracy | Marketing and in-product copy reviewed against the tool's real error rate | 2.2 |
| Chatbots answer only from approved material | Sources are limited, with an escalation route to a person | 2.2 |
| Interactions are recorded | Prompts, outputs, model version, filters and escalation decisions are kept | 2.2 |
| Live outcomes are reviewed on a set rhythm | A named person reviews a sample on a schedule you chose and wrote down | 2.3 |
The FCA sets no fixed review interval, but it criticised "long gaps between reviews of live outcomes" and vague escalation triggers. Pick a rhythm you'll keep, then keep it.
Testing without a data science team
| Check | Done when | FCA section |
|---|---|---|
| A small, curated test set exists | Example cases reviewed by people, including vulnerability markers | 2.1 (smaller firms) |
| Outputs are compared across scenarios | Same question, different customer profiles; differences are explained or fixed | 2.1 |
| You don't trust the model to spot vulnerability on its own | Tested on real-looking cases, temporary vulnerability included | 2.3 |
| Start narrow | One domain-specific use case runs well before the next one starts | 3.5 (smaller firms) |
Image: Pexels, used under the Pexels License.
Vendors and failure
| Check | Done when | FCA section |
|---|---|---|
| Higher-impact vendors have a documented assessment | Written review, named internal owner, service and escalation terms, periodic review | 3.3 (smaller firms) |
| Vendor claims are tested, not taken on trust | You've run your own checks on anything the vendor promised | 4.2 |
| The contract gives notice of model changes | A clause requiring notice and detail of significant model changes | 4.2 |
| There's an exit if the model is retired | A fallback (manual process or second provider) you've actually tried | 4.2 (case study T) |
| AI dependencies are in your resilience mapping | Required for firms in scope of SYSC 15A | 4.1 |
| AI failures and near-misses go to your incident process | Your incident log has an AI category and a near-miss line | Speech |
| Cyber insurance has been checked for AI incidents | You've asked your broker whether an AI-caused incident is covered | Speech |
Case study T is the one small firms should read twice: a firm built a product around one model with no transition plan, and "when the model was retired, the firm had to redesign the product." Vendors change models under you already; in July we covered Anthropic's reversed decision to let a model quietly degrade some answers.
How to fill it in
Start from your AI register. If you don't have one, our free AI register template already has fields for vendor, risk classification, human oversight and responsible owner. Add three: accountable SMF, whether review is logged, and fallback. Then work down the checklist one use case at a time, highest customer impact first.
For thresholds, copy the shape of case studies M and P. One firm had its SMF approve an incident "playbook" before sign-off, with red, amber and green ratings that decided between "enhanced monitoring or temporary shutdown." Here's what that looks like for a single tool:
Image: AI Policy Desk illustration. The structure follows FCA case studies M and P; the thresholds are our example, not FCA figures.
On near-misses, Rusu tied the FCA's position to the UK AI minister's: "As the AI Minister has recognised, near-miss reporting for agentic AI is becoming a national security priority." If you want a starting format, our agent incident and near-miss log from Kanishka Narayan's speech last week works as is.
What it doesn't cover
- The disclaimer request isn't aimed at you. Rusu asked general-purpose AI providers for "clear, proportionate and consistent disclaimers" on financial answers; Finance Magnates notes it set no deadline. Your own disclosure duty comes from the Consumer Duty row above.
- Fair value, data protection and equality law sit outside these examples. The FCA says so and points to the ICO for data protection; our UK AI regulation overview covers the other regulators.
- Frontier AI and cyber are out of scope of this round; the FCA points to a separate statement with the Bank of England and Treasury.
- It will change. The FCA calls the examples "illustrative, non-exhaustive" and says it'll update them, so put a review date on your checklist.
We read both FCA pages in full on October 20 through a text reader, because fca.org.uk blocks automated browsers; we couldn't take screenshots of them, so the charts above are rebuilt from the text. We couldn't confirm when the Bank of England survey will publish beyond "next week."
