FCA's AI guidance: no new rules, but nowhere to hide

The FCA has drawn a line under the question of whether AI needs bespoke regulation in UK financial services. It does not. The regulator's new good and poor practice guidance maps existing frameworks, PRIN, SYSC, Consumer Duty, SM&CR and operational resilience, directly onto machine learning, generative and agentic AI deployments (Polar Insight Regulatory Tracker). The supervisory posture is now explicit: if a model harms a customer or breaks a service, the rulebook already tells the FCA whom to hold responsible.

Accountability without a new rulebook

The guidance is deliberately non-prescriptive, drawing on supervisory work and the FCA's AI Lab to illustrate expectations rather than impose a single model (Polar Insight Regulatory Tracker). That is less permissive than it sounds. By declining to write new rules, the FCA has removed the most common excuse for slow adoption of controls: regulatory uncertainty. Firms that have been running pilots under the cover of ambiguity now face a clear supervisory frame built from rules they have lived with for years.

The practical consequence is that AI risk ceases to be a technology conversation and becomes a Senior Managers and Certification Regime conversation. The guidance explicitly ties AI governance to SMF responsibilities, risk appetite setting and human oversight (Polar Insight Regulatory Tracker). Chief Risk Officers and Chief Operating Officers who have delegated AI oversight to data science or innovation functions should expect that arrangement to be tested in the next supervisory review. The question will not be whether a model works, but whether a named individual understood its limits and set a proportionate control framework around it.

Consumer Duty becomes the sharpest edge

The linkage to Consumer Duty and vulnerability is where the guidance bites hardest. The FCA expects AI to deliver good outcomes, including for customers in vulnerable circumstances, with transparency and understanding built in (Polar Insight Regulatory Tracker). That standard is difficult to meet with opaque generative models deployed in pricing, triage or communications. Firms that cannot explain, in plain terms, how an AI influenced a customer outcome are exposed on a rule the FCA has already shown it will enforce aggressively.

Operational resilience and third-party risk receive equal weight. The guidance applies outsourcing rules and critical dependency expectations to AI vendors (Polar Insight Regulatory Tracker). Given the concentration of foundation model providers, boards should assume their resilience exposure to a handful of AI suppliers now mirrors their exposure to major cloud providers, with the same board-level reporting obligations.

What to do before the next board cycle

The FCA has invited firms to benchmark against its good practice examples (Polar Insight Regulatory Tracker). Treat that as a soft deadline. The firms most exposed are those with mature AI deployment but immature mapping of AI risk to existing SYSC and PRIN obligations. The guidance's absence of new rules is not a reprieve. It is a signal that supervisory patience with the gap between innovation and accountability is thinning.