FCA Finds UK Firms Deployed AI Before Governance Was in Place

What happened

Why it matters

• ·The FCA's published findings function as a de facto supervisory standard. Firms that cannot demonstrate AI inventories, named owners, and pre-deployment approvals now face a documented gap against a regulator-stated expectation, not merely a best-practice shortfall.
• ·The SM&CR exposure is direct. If an AI system lacks a named accountable senior manager, the regulator has a basis to pursue individual liability when something goes wrong. This is separate from any firm-level action.
• ·Firms operating AI without AI-specific risk management are relying on generic frameworks that the FCA has now explicitly found inadequate. Updating those frameworks requires time; firms that have not started are already behind the supervisory curve.

Governance controls affected

What to do now

• ☐Run a complete AI inventory against the FCA's five documented gaps: for each system, confirm you have a named accountable senior manager, a pre-deployment approval record, and an AI-specific risk assessment on file.
• ☐Map every production AI system to a named SM&CR senior manager and document that mapping formally, so it can be produced to examiners on request.
• ☐Review whether your existing model risk or technology risk framework explicitly covers AI-specific risks such as model drift, bias, and hallucination, and update it if it does not.
• ☐Establish a pre-deployment approval gate that requires sign-off on regulatory boundary assessment and accountability assignment before any new AI system goes live.
• ☐Schedule a point-in-time test of your AI oversight controls, including whether monitoring alerts are reviewed, escalation paths are staffed, and post-incident reviews are completed.

What to watch next

The FCA has indicated AI will remain a supervisory priority through 2027, and these findings are likely to inform forthcoming FCA guidance on AI governance in financial services. Firms should monitor whether the FCA issues formal guidance that converts these findings into binding expectations. They should also watch whether the UK Regulations Requiring an ICO Code of Practice on AI and Automated Decision-Making (SI 2026/425) creates overlapping obligations for automated decisions within the same systems. Supervisory reviews in banking and investment are expanding into AI controls following the FCA's lead. Firms with cross-sector operations should treat these findings as a baseline that other UK regulators may adopt.