FCA publishes AI cases on customer harm and controls

The Financial Conduct Authority has put practical examples behind its approach to artificial intelligence in financial services. A firm that filters vulnerable customers out of an automated journey, relies on a reviewer who rarely challenges a model, or has no way to replace a critical AI supplier may have an AI control on paper without showing that it works for customers.

The FCA's good and poor practice publication, released on 19 October, draws on supervisory work, industry engagement and the regulator's AI testing initiatives. It covers customer outcomes, governance and operational resilience. The examples are illustrative and do not create new requirements or prescribe one design for every firm. Where applicable, the Consumer Duty, senior management and operational resilience rules already provide the legal framework.

That distinction matters. A reader should not mistake a case study for a new mandatory AI code. Firms still have to decide which controls fit a particular use, risk and customer impact. The publication gives them a clearer view of the evidence a supervisor may ask for when those decisions are challenged.

A control can solve the wrong problem

In one example, a firm limited changes in a model's performance and reduced unexpected answers. The resulting guardrail produced responses so generic that some customers were steered towards unsuitable options. The technical measure succeeded at its narrow aim while the customer outcome suffered. In another area for improvement, the FCA describes firms excluding people with vulnerability indicators from AI journeys by default, without ensuring they can get suitable support elsewhere.

The regulator also warns against assuming a text model can reliably spot a temporary vulnerability from a customer's words. It describes better practice in which staff help define the signals a chatbot should flag, a person has a clear route to support a customer, and the firm checks whether that intervention actually improves outcomes. These are anonymous examples, not findings that a named firm breached a rule. The FCA does not provide a representative failure rate for the industry in this publication.

The Consumer Duty guidance is the existing frame for judging the results. An AI system used for support, communication or access to a product does not shift responsibility for those results away from the regulated firm. The new examples make the question more concrete: can a firm show that different customer groups understand the output, receive an appropriate next step and can reach a person when the tool cannot help?

Who owns the decision after launch?

The FCA's governance examples move beyond a sign-off at deployment. It describes firms that document ownership before building an AI service, monitor outputs after launch, set thresholds for escalation and give staff authority to intervene. It also describes the opposite: teams adopting a tool before allocating responsibility, then discovering that no one has a clear route to challenge decisions when a problem appears.

Human review alone is not a cure. One anonymous case study shows reviewers gradually accepting model recommendations without enough scrutiny, even when there were signs of error. Another shows a more useful test: staff assessed affordability cases without seeing the AI's proposed decision while the system was being established. That allowed the firm to compare independent judgements and reduce the chance that a human merely endorsed the machine.

Senior managers do not need to be technical specialists, the FCA says, but they should take reasonable steps to understand risks in their areas and obtain the expertise needed to challenge them. The publication favours records showing who took a decision, what evidence they saw, when a concern was escalated and what changed. Those records matter if a customer disputes an AI-supported outcome or if performance deteriorates after a model update.

A supplier's assurance is not a fallback plan

The resilience chapter applies the same evidence test to outsourced AI. A firm remains responsible for services it buys. The FCA highlights inventories of live AI uses and their underlying models, notice of important supplier changes, tested contingency plans and the ability to switch provider where feasible. It gives an example of a firm that built around one model and had to redesign its product when that model was retired.

The paper does not say every firm must run two models. It says the risks of a single dependency must be understood and managed in proportion to the service. For firms within the FCA's operational resilience rules, the publication specifically points to mapping AI dependencies into planning and testing. A vendor's assurance without a firm testing the practical fallback may leave a critical service exposed.

The published text of an accompanying speech by Jessica Rusu, the FCA's chief data, information and intelligence officer, says the regulator is working with banks on how frontier models affect cyber defence. It also says the FCA intends to work with industry on a framework for agentic finance, including agent identity, delegated authority and accountability. That framework is an aim, not a rule already in force.

The immediate test for a bank, insurer or fintech is therefore less abstract than whether it has an AI policy. It is whether its chosen system has a defined customer purpose, a named owner, monitoring tied to real outcomes, a route to stop or correct harmful behaviour and a credible plan if a model or supplier fails. The FCA's examples do not settle every design choice. They do make weak evidence harder to hide behind a reassuring description of the technology.