The Financial Conduct Authority (FCA) has released a set of good and poor practice observations on the use of artificial intelligence across financial services.
According to ACA Group, the regulator is not introducing a dedicated AI rulebook, nor is it mandating a single operating model. Even so, the publication sends a clear supervisory message that buy-side firms with UK-regulated activities would be unwise to ignore.
For chief compliance, operating and technology officers at asset managers, the document shows how the FCA intends to apply its existing expectations on governance, accountability, resilience and consumer outcomes to AI. The central test is not whether a tool is branded as AI.
Instead, firms must be able to explain what a tool does, why it is used, who owns it and how its risks are controlled. That applies equally to investment research, portfolio construction, investor reporting, operations and internal decision-making.
The observations span the full AI lifecycle, from design through to monitoring, intervention, change and eventual retirement. In practice, this gives firms a preview of the questions supervisors are likely to raise. Businesses should be ready to demonstrate how they have identified AI use, assessed its impact, applied proportionate controls and reacted when a tool or its provider changes.
Strong governance, the FCA suggests, begins before deployment. Good practice involves defining the purpose of a use case and running a narrow pilot before scaling. Poor practice arises when firms launch first and attempt to bolt on governance afterwards, leaving ownership unclear, documentation thin and escalation routes absent. A central register of AI use cases, each with a defined purpose, named owner, risk rating and usage boundaries, is a sensible foundation.
The intensity of oversight should reflect client, market and operational impact, data sensitivity, third-party dependencies, the degree of autonomy and the firm’s reliance on the tool.
Testing and human oversight must also be meaningful. The FCA highlights cross-functional challenge and formal sign-off before go-live, while warning against review becoming a box-ticking exercise. Reviewers need the information, authority and time to pause, override or escalate. Where AI influences investment activity, firms should watch for mandate breaches, style drift, valuation reliability and rising levels of human intervention.
Approval does not mark the end of governance. Firms should link each identified risk to a pre-deployment test, a live monitoring threshold, a responsible reviewer and a clear escalation path. This also helps determine when a use case should be restricted, redesigned or retired.
Senior managers need not be AI specialists, but they remain accountable. They must understand the risks in their area, secure the right expertise and provide effective challenge, particularly when a model changes, its scope widens or its autonomy grows.
Finally, outsourcing does not transfer responsibility. Vendor due diligence should extend well beyond a pre-contract questionnaire, covering model change management, testing rights and failure scenarios. For higher-impact services, firms need a fallback, whether an alternative provider, an earlier approved model or a manual process, and it should be tested rather than merely documented.
Read the full ACA Group post here.
Copyright © 2026 FinTech Global
