FCA AI guidance: what lenders must put in place

In October 2026 the Financial Conduct Authority published its first set of good and poor practice examples for AI in financial services, alongside a speech from its chief data officer. Here is the short answer for a lender: the FCA is not writing a new AI rulebook. It will hold you to the rules you already have (Consumer Duty, the Senior Managers regime, operational resilience under SYSC), and it has now set out what good and poor use of AI looks like against three areas: consumer outcomes, accountability and governance, and operational resilience. The examples are, in the FCA's own words, "illustrative, non-exhaustive".

So the work for you now is not to wait for new rules. It is to list your AI use cases, line them up against those three areas, and close the gaps before a supervisor asks. This is doubly true if AI is anywhere near a credit decision, because that is where consumer harm and your own P&L meet.

FCA AI guidance for financial services: what was published

The FCA put out two things on the same day. There is a speech, "Building the future of finance in the age of AI", and a standalone page of good and poor practice examples that the FCA calls a living resource ("They are illustrative, non-exhaustive and will evolve as practice develops"). It does not create new requirements or prescribe a single model. The signal is that existing rules are enough, and the FCA will now read them with AI in mind.

Why this matters right now: AI is no longer a side project in UK finance. The joint Bank of England and FCA survey found that "86% of respondents reported using artificial intelligence (AI), up from 75% in 2024." Almost every regulated firm is already in scope of what the FCA is describing, whether or not it has written any AI governance down.

If you want the longer read on how fast this moves inside a lending shop, I wrote about it here: AI is deciding who gets credit faster than your lending policy can keep up. The FCA's examples are, in effect, the regulator catching up to the same gap.

Take the AI check: 10 questions, about 3 minutes, and see where AI would pay off first in your firm.

FCA good and poor practice on AI: the three areas, side by side

The examples are grouped into three buckets. It is worth reading them as a checklist, because the poor-practice lines are the ones a supervisor will recognise in a weak firm.

Consumer outcomes. Good: firms tested for unfair or unjustified differences across consumer groups and scenarios, told consumers clearly that an AI-enabled tool was in use, and kept records of prompts, outputs, model versions, applied filters and escalation decisions. One firm used AI to spot vulnerability indicators, such as key words in consumer responses, and flagged them to human advisers. Poor: overstating what a system can do, assuming outputs are clear without testing them, and leaving long gaps between reviews of live outcomes or defining escalation triggers too vaguely.

Accountability and governance. Good: structured challenge, testing and sign-off before deployment, with senior managers owning the risks from the design stage onwards for each use case, and committees set up to handle ethical dilemmas. Poor: designing and deploying AI without first working out how to govern it, having no formal process to test and approve use cases, thin expertise in second- and third-line oversight, and senior managers delegating the whole thing to technical teams.

Operational resilience. Good: deciding deliberately where to host models, designing so you can switch providers, and testing contingency plans for a change in your AI supplier ("This is a requirement for firms in scope of SYSC 15A"). Poor: not considering your dependence on AI models at all, and not planning for the chosen model becoming unavailable. This bucket is getting heavier fast: the survey found "Generative AI accounted for 56% of all reported AI systems, compared with 17% for foundation models in 2024," and "80% of respondents reported having AI agents deployed." More of your stack now sits with a handful of outside model providers, so concentration risk is a real board question, not a theoretical one.

AI governance for lenders UK: what to put in place now

You do not need a thick AI policy by Friday. You need to make the FCA's examples true for each of your use cases, starting with anything that touches a lending decision, collections contact or a vulnerable customer. Here is the order I would work in.

List every AI use case. Underwriting models, collections prioritisation, chatbots, fraud scoring, summarisation tools your analysts paste into, all of it. You cannot govern what you have not written down.
Name an accountable senior manager per use case. Not the vendor, not "the data team". A named person who owns the risk from design onwards, which is exactly the good-practice line.
Put a challenge-and-sign-off gate before deployment. Structured testing, a bias check across consumer groups, and a documented decision. Retrofitting governance after go-live is the poor-practice example the FCA calls out.
Test and log. Keep prompts, outputs, model versions, filters and escalation decisions. If you cannot reconstruct why a customer got a given outcome, you have an audit problem and a Consumer Duty problem.
Tell customers when AI is in play, and plan for the recourse gap. The chief data officer's speech warned that "only 40% of consumers correctly recognise that there is no recourse if something goes wrong." That is a complaints-handling and vulnerability design issue you own.
Plan for a provider going dark. Can you fall back if your model vendor is unavailable? Write and test the plan.
Fold AI into incident reporting. The FCA was explicit: "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses."

If you are not sure where the biggest payoff (or the biggest exposure) sits across the firm, that is worth sizing before you build anything. A short read on the hygiene basics is here: Five things your team should never paste into a public AI tool.

Frequently asked questions

Does the FCA's AI guidance create new rules for lenders?

No. The FCA published good and poor practice examples it describes as "illustrative, non-exhaustive and will evolve as practice develops". They do not create new requirements or prescribe a single model. The FCA is relying on existing rules, read with AI in mind, rather than a separate AI regime.

Which existing rules apply to AI in credit and lending?

The main ones are Consumer Duty for consumer outcomes, the Senior Managers and Certification Regime for accountability, and SYSC operational resilience rules. The FCA notes that testing contingency plans for a change in AI model "is a requirement for firms in scope of SYSC 15A". Incident reporting also applies: the FCA says the requirement to report major incidents "must extend to significant AI failures and near-misses".

Do we have to tell customers we are using AI?

The FCA lists it as good practice: firms made it clear to consumers that an AI-enabled tool was in use and explained how it worked. That matters because the speech noted only 40% of consumers correctly recognise there is no recourse if general-purpose AI advice goes wrong, so clear disclosure and a proper complaints route are part of meeting Consumer Duty.

Why is operational resilience in the FCA's AI examples?

Because firms increasingly depend on a few outside model providers. The joint survey found generative AI made up 56% of reported AI systems and 80% of respondents had AI agents deployed. The FCA's good practice is designing so you can switch providers and testing contingency plans; the poor practice is not considering that dependence at all.

Sources

Bank of England and FCA, 2026-10-26 (bankofengland.co.uk)
Financial Conduct Authority, 2026-10-19 (fca.org.uk)
Financial Conduct Authority, 2026-10-19 (fca.org.uk)