FCA says senior managers are accountable for their firms' AI

The Financial Conduct Authority has set out good and poor practice for firms using AI, telling insurers and brokers that senior managers remain accountable and significant near-misses should fall within incident reporting.

The regulator published its examples on 19 October alongside a speech by Jessica Rusu, its chief data, information and intelligence officer, at the Bloomberg UK Policy Series. The material draws on supervisory work, industry engagement and FCA AI Lab initiatives including AI Live Testing.

The examples do not create new requirements or prescribe one model, the FCA said. They show how existing provisions, including the Consumer Duty, the Senior Managers and Certification Regime, operational resilience rules and outsourcing requirements, apply when firms use AI.

"Firms need clear accountability, risk-based controls, human oversight, escalation triggers, and senior managers personally accountable for AI systems," Rusu said in the FCA's drafted version of the speech.

The FCA identified firms deploying technology before fitting governance around it. It also found unclear divisions of responsibility between technology and business teams, human review becoming "a 'box-ticking' exercise" and firms relying on vendor assurances without testing them.

Firms are responsible for systems they develop, buy and deploy, including their outputs and outcomes, the regulator said. They can outsource AI services, but remain responsible for them. Senior managers do not need to be technical specialists, but the FCA expects them to take reasonable steps to understand the risks in their areas.

The publication includes two claims examples. One firm tested whether vulnerability indicators, including accessibility requirements, affected fraud suspicion or claim acceptance, then used the results to improve its model.

Another assessed AI-generated claims information for completeness, faithfulness to source documents, conciseness, reasoning and safety. It combined checks by staff with an automated "LLM-as-a-judge" approach.

"Stress-test AI systems. Plan for failure. Maintain fallback options. Understand supplier concentrations and dependencies, including reliance on a single model," Rusu said. She also told firms to have proper cyber insurance.

Rusu said existing FCA rules require firms to report major incidents, and that this must extend to significant AI failures and near-misses.

She said a joint FCA and Bank of England survey, due to be published next week, found that 86% of firms use AI. She also called for providers of general-purpose AI tools to apply clear, proportionate and consistent disclaimers to financial information.

The focus on fallback options also makes model concentration a governance issue. The FCA cited a firm that had to redesign a product when a model with no alternative was retired. It will now work with industry, regulators and AI labs on an agentic finance framework covering identity, delegated authority, accountability and execution.

Related coverage: FSB finalises 12 sound practices for AI at financial institutions and EU publishes EN 18286, the first harmonised standard under the AI Act.

Sources

• FCA speech: Building the future of finance in the age of AI
• FCA: AI in financial services, good practice and areas for improvement
• Financial Planning Today: FCA reveals 86% of financial firms now use AI
• The Paypers: FCA publishes AI good and poor practice for financial firms

CoverWire is a news and information service. Nothing here is investment advice.