AI adoption and regulation: the latest FCA view

UK regulators have repeatedly clarified that existing regulatory frameworks apply to AI. Recent publications (see note below) highlight what that means in practice, and what to look out for in future, in response to the Mills Review recommendations.

Firms that have strong governance frameworks, with cross-functional design, testing and monitoring teams across the AI lifecycle will find that their approach is validated. Others, who have approached AI adoption as a pure technology transformation play, will find this sober reading.

While the publications provide some helpful clarity, some pressing questions remain outstanding, notably on accountability when AI agents act across firms, and on where the regulatory perimeter should sit for general-purpose AI (GPAI) tools that provide financial information and advice. We expect more activity in this space in due course.

Below, we set out our key takeaways, summarise the main findings in the FCA’s good and poor practice report, and assess the FCA’s response to each of the Mills Review recommendations.

Note: On 19 October, the FCA published a report on good practice and areas for improvement in firms’ use of AI and confirmed that it is taking forward six of the seven Mills Review recommendations in a speech by Jessica Rusu. See also our earlier analysis of the Mills Review.

Key takeaways: at a glance

• Retrofitting governance after deployment is not a suitable approach. In the FCA’s view, governance remains the area of greatest under-investment across the sector. It found that some firms deployed AI before considering governance, then tried to fit it into existing frameworks after key decisions had been made. This led to unclear accountability, weak management of AI-specific risks and oversight that worked on paper but not in practice.
  
• Senior manager accountability must be clear from the design stage and supported by evidence. The FCA does not prescribe a dedicated AI Senior Management Function (SMF), but firms should name a senior manager in the relevant business area with ultimate accountability, alongside clear technical ownership of the AI system. Firms should document roles, decisions and challenges throughout the AI lifecycle. Poor practice includes allowing technical teams to make business decisions without effective oversight.
• Human review is not a safe harbour, and meaningful oversight must be designed, not assumed. Human review can mask model weaknesses or become a box-ticking exercise if reviewers lack the authority, information or expertise to challenge and intervene. The FCA found that reviewers can become less likely to question AI recommendations, even where there were signs of error or uncertainty. Firms should define when intervention and escalation are required and keep records showing how human oversight operates in practice.
• Risk aversion is not the same as compliance and can itself cause consumer harm. The FCA found that measures intended to avoid AI risk could themselves cause harm. For example, some firms excluded consumers with vulnerability indicators from AI services without another route to the service or support they needed. Firms should therefore manage AI risk in a proportionate way, rather than avoid it at the expense of good consumer outcomes.
• A reminder that operational resilience explicitly includes AI solutions, and related stress-testing, fallbacks and near-miss reporting. The FCA expects firms to have a clear understanding of their AI dependencies, including those provided by third parties, and address them according to their individual business models and AI use cases. Operational resilience and third-party risk management emerge as the tools firms should use to address issues such as vendor lock-in, concentration risk and cyber security.
• AI agents shift the risk from what AI produces to what it does. By taking a sequence of actions towards a goal, such as managing payments or investments, they can cause harm at greater speed and scale. The FCA’s early good practice includes a central inventory of live agents, their owners, access and controls. It also expects continuous assurance and plans to develop a wider framework covering agent identity, delegated authority, accountability and execution.
• The FCA is embedding six of the Mills Review's seven recommendations. Varying levels of detail were released on how the recommendations would be taken forward (see Table 2). The FCA did not commit to a formal review of whether financial guidance from general-purpose Large Language Models (LLMs) should fall within regulation. Instead, it will clarify existing regulatory boundaries and seek clear and consistent disclaimers from AI providers. AI-enabled supervision is a priority and an immediate focus.

AI good and poor practice: what the FCA found

The FCA’s good and poor practice report addresses three core areas:

1. Consumer Duty and consumers in vulnerable circumstances

2. Governance and accountability

3. Operational resilience

It is relevant to any regulated firm that develops, buys, or uses AI, whether built in-house, supplied by a third party, embedded in another system, or used by staff to support decisions. It covers machine learning, generative AI, and AI agents. The FCA is clear that the examples are illustrative and will evolve as practice develops.

The breadth of scope matters. AI embedded in vendor software or used by staff is in scope, and the FCA highlights as good practice firms that routinely check suppliers for new or modified AI components. Firms that can map all their AI use cases and controls against each theme will be better placed to evidence that their approach is appropriate. We highlight below our reading of the FCA's key findings that we expect to matter most.

Table 1: Overview of key good and poor AI practices identified by the FCA
(Deloitte analysis)

Our reflections on governance

The FCA's publication offers a granular view of how AI governance will be assessed. In our view, the central governance issue for firms can often be structural. Some firms still concentrate governance at the point of approving an AI use case for deployment, leaving the rest of the AI development lifecycle under-governed. This creates risks at both ends, as Figure 1 illustrates.

Figure 1: Accountability across the AI lifecycle

Early in the AI lifecycle, firms that failed to establish before deployment whether AI was the right tool for the consumer need, or to assign a named senior manager accountable for the outcome, found it harder to establish both once systems were live. Retrofitting governance after launch also made it more difficult to manage AI-specific risks or to tailor oversight to the use case.

At later stages of the AI lifecycle, model change and retirement are often overlooked. Many firms rely on third-party models, which providers can update or withdraw on their own timetable. In the FCA’s good practice examples, firms treated significant model changes as a governance event, for example through contractual notice, testing before integration and, in one case, a specialist group approving high-risk changes. By contrast, one firm without a viable alternative had to redesign its product when the underlying model was retired.

Focusing on the middle stages of the lifecycle, the FCA's good practice examples shared a common feature. Governance was mapped across the whole consumer journey, and ownership was assigned by use case rather than by model. This distinction is important. A model is a technical component, whereas a use case carries a consumer outcome, and it is there that accountability should sit. This reinforces our view that the focus should increasingly be on AI systems (which includes the model, workflows, and the human in the loop), not just individual models.

On agentic AI, the FCA's message is also clear. Systems that act with greater autonomy and change over time, including AI agents, cannot be governed through periodic review alone, and the FCA expects them to be subject to continuous assurance. Examples of good practice, such as designing governance before deployment and keeping a central register of agents, suggest that for firms already piloting agentic systems this should be a present, rather than a future, consideration.

Finally, the FCA's examples show that new structures are not necessarily needed. What matters is applying existing frameworks consistently across the full lifecycle of each AI system. In our view, firms that can demonstrate this continuity of oversight will be better placed to scale AI responsibly and to meet supervisory expectations.

The Mills Review response: direction, rather than detail

The FCA's response to the Mills Review, set out in a speech – rather than as a formal publication – delivered by Jessica Rusu, confirmed that the FCA is embedding six of the seven recommendations into live work, with a focus on testing, assurance and monitoring rather than further consultation. However, the speech does not set out a recommendation-by-recommendation plan. The table below therefore reflects our reading of what was said against each recommendation.

Table 2: Overview of the FCA’s response to the Mills Review recommendations

The Mills Review response sets a clear direction of travel but, for now at least, leaves much of the detail and timing to be clarified. The FCA's firmest commitment is around its own use of AI. This reinforces a point we made in our initial analysis of the Review, namely that supervision is likely to change quickly and feel very different. In practice, firms should expect faster, more data-led supervisory engagement, where quality, timeliness and consistency of their risk and regulatory data will come under increasing scrutiny.

The regulatory perimeter is likely to remain the most contested issue, as consumers increasingly turn to GPAI tools for financial information and advice. The FCA has for now chosen to clarify where the regulatory perimeter sits in relation to unregulated LLM-driven guidance and financial advice, rather than committing to extend it. It has also called on AI providers to give clear, proportionate and consistent disclaimers on AI-generated financial information. We expect this call to be welcomed. However, it is unlikely that the regulated financial services industry will feel the commitments made so far go far enough. The FCA's own figures illustrate the scale of the challenge. Four in five less experienced investors aged 18 to 40 have used AI to help with investing, yet only 40% of consumers recognise that they have no recourse if something goes wrong after acting on advice from a general-purpose AI tool. In our view, disclaimers alone are unlikely to close this gap, particularly as they rely on voluntary action by firms the FCA does not regulate. Separately, the FCA's further work on AI agents, near-miss reporting and the perimeter will also be important to follow.

Conclusion

The FCA's good and poor practice publication gives firms the most detailed, practical view yet of what the FCA considers effective AI governance and where it has seen firms fall short. It may not fully satisfy those who had called for formal guidance, but grounding expectations in observed practice gives firms a practical reference point. We expect supervisors to use it, and firms' ability to evidence their approach through documented decisions, clear ownership and outcome-focused monitoring is likely to come under closer scrutiny.

For boards, the implication is that AI governance should now be treated as part of established oversight of strategy, risk and consumer outcomes, rather than as a separate technology issue. And while firms that have invested early in AI governance should be well placed, areas still under development, particularly agentic finance and the regulatory perimeter, will require continued attention as the FCA's approach evolves.