UK Financial Regulator Publishes Good and Poor AI Practices for Banks and Financial Firms

Britain’s Financial Conduct Authority has published examples of good and poor artificial intelligence practices at banks and other financial firms, highlighting cases in which automated systems disadvantaged customers, human supervision became ineffective and businesses failed to plan for problems with outside technology providers.

Published on October 19, 2026, the material is based on the regulator’s supervisory work, industry engagement and AI testing initiatives. It addresses three areas of financial services: treatment of customers, oversight of AI systems and operational resilience. Its examples cover conventional machine learning as well as generative and more autonomous forms of AI.

The FCA is not introducing a separate AI rulebook. In its new good and poor practice publication, the regulator says the examples are illustrative rather than mandatory requirements or a universal checklist. Existing obligations, including the Consumer Duty and senior-management accountability rules, continue to apply whether firms develop their own models, buy technology or use AI embedded in other services.

The distinction matters for firms trying to expand AI beyond pilot projects. A chatbot that produces fast answers, for example, is not necessarily working well if customers cannot understand the responses or reach a person when they need help. Likewise, an accurate model may still create a compliance or business-continuity problem if nobody has clear authority to challenge its decisions or manage its failure.

When AI makes customer service harder

The FCA wants firms to establish a genuine customer need before deciding to automate a process. Its examples describe businesses testing results across different groups of consumers, comparing error rates and checking whether design choices unintentionally disadvantage people with accessibility needs, limited financial capability or other indicators of vulnerability.

One firm tested whether characteristics associated with vulnerability, including accessibility requirements, affected how its AI system assessed suspected fraud or accepted claims. The regulator presented that testing as useful because it allowed the business to refine its model and reduce unwanted differences in customer outcomes. The example does not identify the firm or establish how widespread the problem is across the industry.

Other practices raised a different concern: some businesses automatically kept potentially vulnerable customers out of AI-based journeys as a way to reduce risk. That exclusion can be justified in particular circumstances, but the FCA warned it could become unfair where customers are left without a suitable alternative route to assistance or the benefits of a service.

Technical safeguards can also produce unexpected harm. In one example, a firm successfully restricted changes in model behaviour and unusual responses, only to find that the tool had become too generic. Some customers were consequently directed toward inappropriate options. The lesson is not that safeguards should be removed, but that firms need to assess their effect on the actual customer experience rather than only the model’s technical performance.

For AI chatbots and communications tools, the regulator points to clear explanations of what a system can do, the limits of its answers and when human assistance is available. Stronger approaches restricted generative AI to approved information sources, retained records of prompts and responses, and established routes for staff to handle questions the system could not reliably resolve.

The publication also describes a firm that used a large language model to improve letters responding to customer questions and complaints. Staff reviewed the proposed wording before sending it, and the firm tested the approach with consumers. Participants found the communications clearer and received information sooner, according to the FCA, including when their complaints were rejected.

A separate chatbot example involved staff identifying terms that might signal a customer needed additional support. The business revised the chatbot’s questions and maintained a list of expressions that should prompt a referral. By contrast, the FCA criticised firms that assumed a language model could identify vulnerability reliably without enough testing, or designed automated journeys that made it difficult to switch to another support channel.

Senior managers remain responsible for AI decisions

Responsibility for AI does not move to the software supplier or the technical team simply because a model is complicated. The FCA says regulated firms remain accountable for systems they create, purchase and deploy, including the decisions and outcomes those systems produce. Senior managers do not need to become technical specialists, but they are expected to understand material risks within their responsibilities and seek the expertise needed to challenge them.

The regulator highlighted businesses that assigned ownership early, involved legal, compliance and risk functions in approvals, and kept records explaining why a system was adopted and what would happen if performance fell below acceptable levels. Some larger firms used AI committees; smaller firms adapted existing model-risk and supplier controls instead of creating elaborate new structures.

Where governance came later, problems were harder to address. One anonymised example concerned a business that launched AI tools before defining who should oversee them. When risks emerged, different teams assumed someone else was responsible. The lack of an established escalation route made it difficult to challenge decisions or demonstrate that relevant issues had been managed.

Putting a person into the process is not sufficient on its own. The FCA described another case in which reviewers increasingly approved automated recommendations without adequate scrutiny. With their roles poorly defined, staff became less likely to challenge outputs even when there were indications of error or uncertainty. A nominal human approval step could therefore conceal rather than correct weaknesses in the system.

An affordability-assessment example offered a contrasting approach. While an AI tool was being introduced, staff evaluated cases without first seeing its suggested answer. That allowed the business to compare independent human judgments with model results and reduced the danger that reviewers would simply follow the software’s recommendation.

The regulator also distinguished monitoring real customer outcomes from monitoring technical performance alone. Dashboards and spot checks can help firms detect drifting models, but they need thresholds that trigger investigation and people authorised to act. Firms should retain enough information to understand customer complaints and revisit their controls as a system changes after launch.

The FCA says proportionate arrangements are possible for smaller businesses. They may begin with narrowly defined use cases, sample checks and simpler approval processes, provided accountability is clear and the checks match the likely effect on customers and markets. The guidance does not suggest every firm needs a dedicated AI board.

A single AI provider can become a resilience risk

The FCA also addresses what happens when an AI product breaks, changes or becomes unavailable. Financial firms increasingly rely on external models and hosting services, but outsourcing a technology function does not remove the regulated firm’s responsibility for managing the resulting risks.

Good examples included businesses testing systems before launch, documenting which models support important services, checking suppliers’ assurances and making practical plans for outages. One firm designed a service to switch between underlying AI models and maintained alternative server capacity to handle surges in demand. Those choices reduced its dependence on a single model or hosting route.

The publication describes the opposite problem in a case involving a product built around one model without a workable replacement strategy. When the provider retired that model, the firm had to redesign its product. Better substitution and exit planning, the FCA said, could have limited the disruption and additional work.

Supplier oversight also needs to account for changes short of a complete shutdown. A provider might update a model or alter a service on which a bank’s customer support or internal operations rely. Firms cited as better prepared had contractual arrangements to learn about material changes, test their impact and decide when a fallback was necessary. The FCA criticised untested reliance on vendor assurances and the absence of viable exit options.

The wider regulatory approach remains based on outcomes rather than detailed AI-specific rules. The FCA has been gathering evidence through its AI Lab, including live testing and sandbox projects, and says the examples will evolve as practices develop. The immediate message to regulated businesses is practical: automation should improve outcomes for customers, and firms must be able to show who is responsible when the technology does not behave as intended.