The FCA’s AI paper, read as a file

One firm in the FCA’s good and poor practice paper on AI deployed its tools before settling how to govern them. When risks emerged, “multiple teams thought oversight sat elsewhere”. Retrofitting governance “proved difficult and left gaps in accountability”, and the firm found it harder to show how it had identified and managed the risks.¹

The paper, published on 19 October 2026 and updated the next day, sets out no list of questions.² Its good practice and areas for improvement still suggest a file, the records a firm could reach for if an AI outcome were challenged. The file and the six questions below are an inference from the paper, not the FCA’s list.

The question for a Head of Compliance or COO is whether that file exists today for a given use case, the FCA’s term for a specific way a firm uses AI. The FCA does not expect senior managers to be technical specialists. But where decisions were poorly documented, “senior managers couldn’t show the steps they’d taken to assess and mitigate risks”.³

What the paper is

The FCA calls its examples “illustrative, non-exhaustive” and says they “do not create new requirements”.⁴ A “should” in the paper is therefore not a rule. Existing rules still apply, from the Consumer Duty to DISP, and one listed practice is marked a requirement: mapping AI dependencies into resilience planning, for firms in scope of SYSC 15A.⁵

The closest line to this argument says firms should consider whether their records, explanations and monitoring are “sufficient to support challenge and help them deal with complaints”.⁶ It sits in a section on consumer understanding and names no regulator. The paper does not say how supervisors will use it, and its examples “will evolve as practice develops”.⁷ It is quoted here as it stood on 5 November 2026.

Six questions, by inference

Each points at a record the paper describes.

Who owned this use case, who approved it, and on what evidence? Good practice has senior managers accountable “from the design stage onwards”, with “auditable records of decisions, including rationale, challenge, and escalation”.⁸
What did the tool do in this case? Firms kept “records of consumer prompts, outputs, model versions, applied filters and escalation decisions”, which helped with complaints and with investigating a challenged outcome.⁹
What did the person do? One small firm stressed recording whether review was needed, whether it happened, and whether staff approved, overrode or escalated.¹⁰
How does the firm know the outcomes are still good? The paper sets no timescale for reviews, and warns against monitoring technical metrics in place of outcomes.¹¹
What has the firm tested of what its vendor told it? “Some firms relied on vendors’ assurances without challenging or testing them”, and firms remain accountable for outsourced AI services.¹²
What happens when it fails? One firm had an incident “playbook” approved before sign-off. Another, with no transition plan, had to redesign its product when the model was retired.¹³

The case for leaving it alone

The strongest reply is that firms already have this, that people keep the decisions that matter, and that a further file adds cost without adding control. In the Bank of England and FCA survey of 26 October 2026, 94% of respondents reported firmwide AI policies, principles or standards.¹⁴ 80% reported AI agents deployed for decision support, where humans decide and execute. Even including planned deployment, no more than 9% expected agents to approve or decline customer outcomes.¹⁵

Where the file runs thin

A policy records what a firm intended. Many of the paper’s concerns sit lower down, at the use case and in operation: inconsistent evidence for decisions, and governance treated as “a point-in-time exercise”.¹⁶ In the survey, 85% routinely monitored user feedback and 39% customer impact.¹⁷

A person deciding does not settle it. Human review “may mask weaknesses in the model”, and in one firm reviewers increasingly accepted AI recommendations without sufficient scrutiny.¹⁸ Nor does a contract. Third-party implementations were 53% of the systems respondents rated high materiality. To understand those systems, respondents “most frequently relied on assurance by the vendor and contractual arrangements (81%)”, although other approaches were also widely reported.¹⁹ That finding is about reliance and does not say the assurances went untested.

None of this shows how any reader’s firm stands. The paper gives no count of firms that fell short, and the survey is what respondents reported. A file also records a control and is not one: a complete folder over a tick-box review documents the tick-box.

Pull one file

Choose one live use case that touches customers, and one outcome it produced. Ask for the records behind the six questions, and note what arrives. Where an answer is someone’s memory or a vendor’s brochure, you have found a gap. The paper says firms should respond proportionately to each use case, its risks and its potential impact, so the file for a low-risk use may be short.²⁰

The paper will evolve. A sign-off nobody wrote down will stay unwritten.

This is commentary on published sources, not legal or regulatory advice.

Drafted with AI assistance and reviewed by Ilja Orlovs before publication.

Questions the FCA did not write

Ilja Orlovs

What the paper is

Six questions, by inference

The case for leaving it alone

Where the file runs thin

Pull one file

Get in touch