From good and poor practice to agentic finance: the FCA’s evolving approach to AI

On 19 October 2026, the UK Financial Conduct Authority (FCA) published examples of good practice and areas for improvement in firms’ use of AI, alongside a speech by its chief data, information and intelligence officer, Jessica Rusu. Together, the publications provide further detail on the FCA’s expectations for AI adoption, with a focus on consumer outcomes, governance and operational resilience.

The FCA continues to focus on applying existing regulatory requirements, rather than introducing a standalone AI-specific financial services regime. Drawing on engagement with firms and testing through its innovation initiatives, its latest publication sets out examples of what the FCA considers to be good practice, as well as areas for improvement, under the existing regulatory framework. 

Importantly, the publication creates no new requirements and prescribes no single governance model. Instead, it provides a practical reference point against which firms can assess their existing AI arrangements. The FCA also intends to update its expectations as the technology continues to evolve.

What does the FCA expect from firms using AI?

Several themes emerge from the FCA’s examples of good and poor practice.

• Consumer Duty: firms remain responsible for the consumer outcomes delivered through AI-supported products, services, communications and support. The FCA highlights building tools “without establishing the consumer problem, target market or foreseeable harms” as a primary area for improvement.

• Governance: senior managers are expected to understand the AI risks within their areas of responsibility, rather than act as technical experts. However, the FCA warns that oversight remains an area where too many firms are still under-investing.

• Operational resilience: AI use and model dependencies should be fully integrated into operational resilience plans. Firms must stress-test AI systems, plan for failures and maintain robust fallback options, particularly when moving from low-risk to more material use cases.

What comes next?

Firms, AI developers and providers should keep a close eye on several developments in the coming months:

• The proposed perimeter review: Rusu’s speech does not set out the timing or scope of the review envisaged by the Mills Review into the scale, nature and impact of general-purpose large language models outside the regulatory perimeter. Further detail on how the FCA takes this recommendation forward will be critical in understanding which activities need to be regulated and what rules they would be subject to.

• The trusted framework for agentic finance: further detail will help firms assess how the framework might apply to their own deployments of and interactions with agentic AI systems, especially in the context of agentic finance and agentic commerce.

• Expectations for AI developers and providers: the FCA has called on AI providers to help consumers understand the limits of financial information and advice generated by their models through clear, proportionate and consistent disclaimers. This signals the FCA’s interest in influencing practices beyond the regulatory perimeter, particularly where AI-generated outputs may influence and shape consumers’ financial decisions.

Taken together, the FCA’s latest publications reinforce the direction of travel: AI may be changing how financial services are designed and delivered, but firms are still expected to meet their existing regulatory obligations.

Read our full briefing, AI in financial services: FCA good and poor practice and the road to agentic finance here.