FCA Finds UK Firms Deployed AI Before Governance Was in Place
What happened
The UK Financial Conduct Authority (FCA) published findings from its October 2026 review of AI adoption across regulated firms, revealing that deployments frequently preceded governance decisions. AI adoption and regulation: the latest FCA view, Deloitte's practitioner analysis, identifies five gaps the regulator documented: unclear accountability for AI systems, weak AI-specific risk management, ineffective oversight mechanisms, incomplete AI inventories, and absent pre-deployment approval processes. The FCA had previously signaled this direction when it confirmed that AI near-misses must be reported under existing rules. These findings extend that supervisory posture into a documented benchmark. The regulator did not name individual firms but described patterns that supervisors observed across the sector. Firms that cannot map each AI system to a named accountable person face heightened risk under the Senior Managers and Certification Regime (SM&CR). SM&CR assigns personal liability to senior individuals for functions within their remit.
Why it matters
- ·The FCA's published findings function as a de facto supervisory standard. Firms that cannot demonstrate AI inventories, named owners, and pre-deployment approvals now face a documented gap against a regulator-stated expectation, not merely a best-practice shortfall.
- ·The SM&CR exposure is direct. If an AI system lacks a named accountable senior manager, the regulator has a basis to pursue individual liability when something goes wrong. This is separate from any firm-level action.
- ·Firms operating AI without AI-specific risk management are relying on generic frameworks that the FCA has now explicitly found inadequate. Updating those frameworks requires time; firms that have not started are already behind the supervisory curve.
Stay ahead of stories like this
Get every UK AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- The next quarter will test whether compliance programs can keep pace with AI systems that breach containment, reshape capital markets, and enable fraud at a scale no prior control framework anticipated.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Run a complete AI inventory against the FCA's five documented gaps: for each system, confirm you have a named accountable senior manager, a pre-deployment approval record, and an AI-specific risk assessment on file.
- ☐Map every production AI system to a named SM&CR senior manager and document that mapping formally, so it can be produced to examiners on request.
- ☐Review whether your existing model risk or technology risk framework explicitly covers AI-specific risks such as model drift, bias, and hallucination, and update it if it does not.
- ☐Establish a pre-deployment approval gate that requires sign-off on regulatory boundary assessment and accountability assignment before any new AI system goes live.
- ☐Schedule a point-in-time test of your AI oversight controls, including whether monitoring alerts are reviewed, escalation paths are staffed, and post-incident reviews are completed.
What to watch next
The FCA has indicated AI will remain a supervisory priority through 2027, and these findings are likely to inform forthcoming FCA guidance on AI governance in financial services. Firms should monitor whether the FCA issues formal guidance that converts these findings into binding expectations. They should also watch whether the UK Regulations Requiring an ICO Code of Practice on AI and Automated Decision-Making (SI 2026/425) creates overlapping obligations for automated decisions within the same systems. Supervisory reviews in banking and investment are expanding into AI controls following the FCA's lead. Firms with cross-sector operations should treat these findings as a baseline that other UK regulators may adopt.