Jessica Rusu, the FCA’s chief data, information and intelligence officer, set out the regulator’s position on AI in a speech at Bloomberg’s UK Policy Series on 19 October 2026. Alongside it, the FCA published examples of good and poor AI practice drawn from its testing with firms this year. The FCA’s joint AI survey with the Bank of England, due the following week, shows 86% of firms now use AI. There is no new rule. Firms that read the speech as a checklist will, in our view, be reading it correctly.
What the FCA published
The practice examples are organised around three themes: consumer centricity, accountability and governance, and operational resilience. Each theme maps to an obligation that already exists, which is the point. The FCA’s 2025 to 2030 strategy commits it to relying on existing standards and focusing on outcomes rather than imposing prescriptive new rules where possible. The speech applies that commitment to AI.
On consumers, Rusu anchored the examples in the Consumer Duty, which she described as an outcomes-based framework. The good practice cited was a firm that built a live list of vulnerability signals its chatbot can use to flag consumers who may need additional support to human advisers. The poor practice was firms developing AI tools without a clearly defined need, excluding vulnerable consumers by default, overstating capabilities, or deploying automated customer journeys without sufficient testing. Read that list against the Duty outcomes and it becomes an examination script for any automated customer journey.
On governance, the speech said too many firms are still under-investing. The FCA wants clear accountability, risk-based controls, human oversight, escalation triggers, and senior managers personally accountable for AI systems. Personal accountability for a named senior manager is, in our reading, SM&CR language applied to a model. The good example was a firm with an independent ethics panel that interrogates proposed AI use cases before deployment. The poor examples were firms that retrofit governance after deployment or fail to adapt monitoring as systems change. Rusu’s verdict: “That is the wrong way around.”
On resilience, the instruction was direct: stress-test AI systems, plan for failure, maintain fallback options, and understand supplier concentrations and dependencies, including reliance on a single model. This reads to us as the SYSC operational resilience expectations applied to a model vendor. A single-model dependency appears to be treated as a concentration risk like any other third-party dependency.
Incident reporting now covers AI failures
The sentence that matters most for a compliance head is on reporting. The FCA said its rules already require firms to report major incidents, and that this must extend to significant AI failures and near-misses. That is not a proposal. It is a statement of how the regulator reads an obligation firms already carry. Near-miss reporting for agentic AI was described as a national security priority and a regulatory one. If a model outage, a wrong instruction to a customer, or an agent acting beyond its mandate would be significant on the firm’s existing incident tests, the FCA appears to expect to hear about it, and we expect the near-miss category to be the one most firms are not yet capturing.
The FCA has not written an AI rulebook; it has published what it saw inside firms and told the market which side of the line each practice falls on.
What this is, and what it is not
Be precise about status. The examples are supervisory observation from firm testing, not rules, and the FCA said the material is not intended to be static guidance. We expect the examples to move as the technology does. The underlying obligations will not.
The agentic-finance framework is future work. The FCA said it will work with industry, fellow regulators and frontier labs to develop a trusted framework for agentic finance, covering agent identity, delegated authority, accountability and execution. It also said agentic systems require continuous, conditional assurance because a system safe at deployment may behave differently at scale, under stress or as the underlying models change. None of that is in force. It signals direction, and the direction is towards assurance that runs through the life of a system rather than a sign-off at launch.
The perimeter question is also open. Rusu noted that only 40% of consumers correctly recognise there is no recourse if something goes wrong after acting on advice from a general-purpose AI tool. The FCA’s answer is to call on AI providers for clear, proportionate and consistent disclaimers rather than to expand its remit. For a fintech integrating its services into an AI platform, the practical question is where the regulated activity starts in the customer journey. That is a question for legal advice, not for a compliance checklist.
What still applies
Nothing in the speech lifts an obligation. The Consumer Duty applies to an AI-driven journey as it applies to a human one. Senior manager accountability does not pause because a decision came from a model. Operational resilience expectations cover the vendor that hosts your model. Major-incident reporting is unchanged in form; the FCA has told firms what it thinks falls within it.
The wider programme is already moving. The Mills Review, published in July, looked at how AI could reshape retail financial services by 2030. The FCA is embedding six of the seven recommendations into live work immediately. The FCA’s stated method is testing, assurance, monitoring and surveillance directly with industry, not consultation. In our reading, that means firms are more likely to meet these expectations through a testing exercise or a supervisory conversation than through a consultation paper, and the record they can produce on the day will matter more than the policy they wrote last year. Our guide on audit readiness best practices for financial firms covers what that record should contain.
What firms should do
Treat the speech as the checklist and work through it this quarter.
-
Inventory every AI use case. Include the chatbot, the fraud model, the credit decisioning, the internal copilots and anything a vendor runs on your behalf. If you cannot list them, you cannot govern them, and the FCA’s poor-practice examples start with tools built without a defined need.
-
Map each use case to a Consumer Duty outcome. For every customer-facing journey, write down which outcome it serves, how vulnerable customers are identified, and where the path to a human sits. Where a journey has gone live without testing, document the testing now.
-
Name the SMF. One senior manager should be personally accountable for each AI system, with the statement of responsibilities updated to say so. Governance that follows deployment is the pattern the FCA called the wrong way around.
-
Add AI failure and near-miss to the incident playbook. Define what a significant AI failure looks like for your firm, who classifies it, and how it feeds the existing major-incident reporting process. Start logging near-misses even where no report is triggered; the record will be asked for.
-
Test the fallback for a model outage. Run the scenario where your primary model provider is unavailable or changes behaviour. Confirm the fallback works, who switches it on, and what the customer sees. Record the single-model dependency in your third-party register.
-
Stop the overclaims. Review marketing, in-app copy and investor materials for statements about what the AI does. Overstating capabilities is on the FCA’s poor-practice list.
Taft helps firms build the AI use-case inventory, the governance records and the incident procedures described above through its AI and automation studio. Taft is not a law firm and does not give legal advice; where the regulated perimeter or a senior manager’s personal position is in question, take legal advice.
Sources
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.