This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.
How Should an FCA-Regulated Firm Review Its AI Governance Framework?
The FCA has not published a single AI governance rulebook. A regulated firm should assess how its existing obligations apply to each AI use case, document the risks and owners, and retain evidence that the controls work.
For each AI use, ask the compliance reviewer to identify the obligations that apply to the firm's activity. Record the purpose, affected customers, data, supplier dependencies and responsible owners before selecting controls or describing the framework as compliant.
Keep the applicability assessment alongside the control records, with unresolved questions assigned to the responsible reviewer.
The Building Blocks of an FCA-Ready AI Governance Framework
The table below requires source and applicability review before it can be relied on. Its descriptions do not establish the firm's duties. Ask the qualified reviewer to check each claimed FCA expectation, statutory reference and allocation of responsibility against the particular activity.
| Pillar |
FCA Expectation |
| 1. Clear Accountability |
Responsibility: ask the compliance reviewer to identify the relevant requirements for the firm's activity. Map the confirmed decisions and evidence to the actual governance and responsibility allocation. |
| 2. Robust Risk Management |
Risk review: assess the AI use's technology, customer and market risks. Have the reviewer establish the applicable rules and required evidence rather than attributing a universal process to SYSC 7. |
| 3. Effective Human Oversight |
Oversight: specify who can review, challenge and stop the proposed workflow. Test those routes and confirm any applicable requirements with the responsible reviewer. |
| 4. Rigorous Data Governance |
Data: identify the inputs, provenance limits, quality checks and bias tests relevant to the decision. Record gaps and the applicable requirements identified by the reviewer. |
| 5. Third-Party Vendor Management |
Suppliers: establish the review needed for the actual product, activity and data. Record contract, model, security and evidence gaps, with the responsible reviewer confirming the firm's applicable obligations. |
| 6. Transparency and Explainability |
Explanations: test what the firm can establish about the actual decision and communicate accurately. Refer explanation gaps and possible customer effects to the responsible reviewer; no automatic Consumer Duty conclusion is established here. |
The Pro-Innovation Façade
Base the firm's decision on the obligations identified for the proposed use. Record the assessment and approval conditions before treating the use as permitted.
Ask the compliance reviewer to assess customer outcomes and market-integrity concerns relevant to the activity. Record the controls selected and any issue requiring further legal review.
If the firm is considering a testing service, check the current entry conditions and terms. Keep that decision separate from the assessment of obligations for the intended deployment.
The Bottom Line: It is About Demonstrating Control
Prepare records that explain the AI use, its assessed obligations and the controls in operation. Keep the policy, approvals and evidence of actual reviews available for questions about the activity.
The following are illustrative preparation prompts, not quotations from an FCA request:
- "Show us how your board is overseeing the risks of AI."
- "Show us your risk assessment for your algorithmic pricing model."
- "Show us how you are ensuring your AI-powered chatbot is not misleading vulnerable customers."
- "Show us the due diligence you conducted on your AI vendor."
Link each control described in the framework to its owner, procedure and available operating record. Identify any gap between the intended control and observed practice.
Refer missing evidence to the responsible compliance reviewer to assess its significance and the action required. This article does not determine whether a particular firm has breached a duty.
Take the Next Step
For an AI Audit discussion, bring the firm's tool inventory, control records and unresolved compliance questions. Agree the work to be assessed and its boundaries before commissioning it.
Book a Discovery Call → or learn more about the AI Audit.
Need help assessing an AI workflow and its unresolved risks?
For a proposed AI use, record the decision or service affected, data, supplier and review owner. Take unresolved Consumer Duty, SM&CR, model-risk and client-data questions to the responsible compliance reviewer before approval.
