The AI race versus regulatory reality: can financial services firms keep pace with their own innovation?

The FCA has recently published guidance identifying "good and poor practice" on the use of AI in financial services. It is not a new AI handbook, and no bespoke AI rulebook appears imminent. Rather, the publication makes clear that existing FCA regulatory frameworks apply pervasively to firms' use of AI, and sets out, in practical terms, what the FCA considers firms should be doing and where they are falling short.

For a closer look at the FCA's findings and what regulated firms should be doing now, read our analysis of the FCA's AI good practice guide.

This piece focuses not on restating the FCA's findings, but on the significant and persistent commercial pressures financial services firms face to adopt AI quickly, and the tension that pressure creates between advancing the firm's commercial goals and storing up the next regulatory problem.

The defining challenge facing regulated firms is not AI adoption itself, but that the pace of deployment is outstripping the pace at which firms are building the governance frameworks to support it.

Firms are likely to find themselves at different points on a spectrum: at one end, those deploying AI at speed with a view to fitting governance around it retrospectively; at the other, those embedding governance and guardrails before AI is fully deployed. The FCA's publication indicates it will scrutinise firms that have rolled out AI tools without first putting in place a clear framework for overseeing them. Retrofitting controls after implementation decisions have been taken is inherently more difficult and we anticipate that this will be a regular subject of FCA action in the near future.

Where FCA supervision may focus

The publication suggests the FCA is particularly focused on consumer-facing AI. A firm's operational AI use carries one level of risk, but a generative AI chatbot handling affordability questions or suggesting next steps to a vulnerable consumer carries a materially different one. AI in products and services must be designed to meet consumers' needs, characteristics and objectives, as required by the Consumer Duty. The treatment of vulnerable consumers is a particular area of focus. The FCA noted instances where firms automatically removed consumers displaying vulnerability indicators from AI-driven journeys altogether. While that may be defensible in certain contexts, blanket exclusion used for managing risk rather than responding to it is precisely the outcome the Consumer Duty is intended to guard against.

Beyond consumer-facing AI, supervisory attention may reasonably be anticipated in further areas. The use of public-facing AI tools by employees outside approved models presents obvious conduct, confidentiality and data security risks. The FCA also emphasises that firms outsourcing AI services remain responsible for those services, and firms can expect the FCA to test whether their outsourcing arrangements provide adequate visibility and control. Existing contracts may not have been drafted with AI in mind, and firms may lack protections around matters such as the use of data and auditability. Firms must also think ahead to how AI tools and services will be decommissioned and replaced as models inevitably become outdated.

What good looks like and getting ahead

When deployed responsibly, AI can deliver significant benefits to firms and consumers. The examples of good practice in the publication show firms moving quickly and innovating, but doing so thoughtfully, starting with a clear consumer problem, target market and intended outcome before deciding whether AI is the right tool. The distinction between good and poor practice is not one of ambition or pace, but of timing. Firms that treat governance as a precondition of deployment, rather than a response to it, will find the FCA a far more accommodating counterpart when questions inevitably arise.

The commercial consequences of getting this wrong are easy to underestimate. A finding, for example, that consumer-facing AI has produced poor outcomes at scale could trigger redress obligations including public censure. Outsourcing gaps exposed in a supervisory review can leave firms locked into non-compliant arrangements that do not have a quick exit and, in each case, the commercial cost of remediation is likely to exceed what it would have cost to build the correct framework in the first place.

Firms seeking to assess their readiness should ask themselves the following questions:

• Could you demonstrate to the FCA what your AI does, why it was considered appropriate, what safeguards are in place and how customer outcomes are being monitored?
• Do your supplier and outsourcing contracts give you adequate visibility and control over AI being used in the delivery of services to your firm?
• Who owns the risk for each AI use case, and was accountability assigned at the design stage rather than retrofitted after something went wrong?

The FCA's publication should sharpen the question for all firms: not whether to adopt AI, but whether the governance framework around it is developing at the same pace. The longer that gap persists, the harder it becomes to close, and the greater the firm's exposure when the FCA looks behind the technology.

Authors: Jordan Gray and Joe Dominy

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at November 2026. Specific advice should be sought for specific cases. For more information see our terms & conditions.