FCA lists relying on untested AI vendor assurances as poor practice

Firms that lean on vendors' assurances about AI systems without testing them are showing poor practice, the Financial Conduct Authority said in examples of good and poor practice for financial services published on 19 October.

The paper says firms remain responsible for AI they buy in from outside suppliers. For insurers, that puts claims, underwriting and customer service tools sourced from technology vendors inside the same governance as models built in house.

The FCA said the examples do not create new requirements. They show how firms are applying existing rules, including the Consumer Duty and the Senior Managers and Certification Regime, to AI.

Good practice examples include keeping a central inventory of AI agents in use, and designing systems so that a firm does not depend on a single model provider. In another, an incident playbook approved by a senior manager sets red, amber and green thresholds for when an AI system must be escalated or switched off. One firm used blind human review, in which reviewers check outputs without seeing the AI's own decision.

The paper also includes sections aimed at smaller firms and a glossary of AI terms.

The vendor point matches the Bank of England and FCA's 2026 survey of AI in UK financial services, published on 26 October, in which 81% of firms said they relied on vendor assurance for high-materiality systems supplied by third parties. Only 24% said they had a deep understanding of those systems, against 77% for systems built in house.

Related coverage: FCA says senior managers are accountable for their firms' AI and FSB finalises 12 sound practices for AI at financial institutions.

Sources

• FCA, AI in financial services: good and poor practice, 19 Oct 2026
• Bank of England and FCA, Artificial intelligence in UK financial services 2026, 26 Oct 2026
• Coverwire, 19 Oct 2026

CoverWire is a news and information service. Nothing here is investment advice.