FCA AI Good and Poor Practice: What Firms Need to Do Next

The FCA's 19 October 2026 publication provides concrete examples of how firms are governing AI effectively — and where weaknesses are emerging. It does not introduce a new AI rulebook, but offers a useful benchmark for Boards, senior management and risk functions.

Executive summary: five messages

1. Existing rules apply. AI adoption must remain consistent with Consumer Duty, SYSC, SM&CR, operational resilience and outsourcing requirements.
2. Accountability cannot be outsourced. Firms remain responsible for AI developed internally, purchased externally or embedded in other systems.
3. Human oversight must work. A nominal reviewer can become a rubber stamp; effective challenge requires expertise, authority and clear escalation thresholds.
4. Monitor outcomes, not just models. Static approvals and technical metrics alone may miss drift, harmful outputs and consumer impacts.
5. Plan for AI dependency failure. Supplier changes, model retirement, concentration and ineffective fallbacks can undermine resilience.

What the FCA found

Implications for operational risk management

AI should be incorporated into enterprise and operational risk frameworks, rather than managed as a disconnected governance universe. Existing RCSAs, risk appetite, KRIs, incident management, scenario analysis and assurance can be adapted to reflect AI-specific exposures.

Priority actions

• Inventory material AI use cases, including agents, embedded capabilities and externally supplied models; assign accountable business owners.
• Assess inherent and residual risks, including hallucinations, bias, data leakage, model drift, automation bias and autonomous actions.
• Use risk tiering to calibrate approval, validation, monitoring and intervention controls.
• Test whether human review actually detects and corrects errors, rather than simply recording approval.
• Develop outcome-focused KRIs, including model overrides, harmful outputs, drift, incidents and overdue reassessments.

Key control lesson: A human in the loop is not necessarily an effective control. The FCA's Case Study O illustrates how reviewers can become less likely to challenge AI recommendations over time.

Implications for operational resilience

Material AI dependencies should be considered in mapping and scenario testing for important business services where applicable. This includes the models, providers, hosting arrangements, data and people necessary to sustain delivery.

• Test model unavailability, degradation, erroneous outputs, malicious manipulation and sudden supplier changes.
• Identify concentration risks where multiple services rely on the same AI model or provider.
• Test manual workarounds, alternative models and switching arrangements — not merely their documented existence.
• Consider the distinction between service availability and acceptable outcomes. An AI-supported service may remain online while generating harmful or unreliable decisions.

Consumer Duty intersection: Avoiding an impact tolerance breach does not automatically demonstrate that foreseeable consumer harm has been prevented. Scenario tests should examine both continuity and customer outcomes.

Implications for third-party risk management

The FCA highlights procurement-stage AI assessment, vendor-change notification, periodic reassessment, concentration management and credible exit options. These can be integrated into the 3 Os of TPRM lifecycle.

1. Onboarding — identify and assess

Determine whether a supplier uses AI, including AI embedded within otherwise conventional services. Assess the use case, materiality, model governance, security, data handling, limitations and downstream dependencies. Feed the results into inherent and residual risk assessment and control tiering.

2. Ongoing — monitor and control

Monitor material model updates, performance, incidents, contractual notifications and changes in supplier AI usage. Refresh materiality and risk assessments as the service evolves; an initially immaterial AI dependency may become material later.

3. Offboarding — exit and substitute

Evaluate switching feasibility, alternative providers, integration dependencies, data portability and tested fallback plans. FCA Case Study T describes a firm forced to redesign an AI-enabled product after its underlying model was retired.

Six questions for Boards and executive committees

1. Where is material AI deployed, including within third-party services?
2. Who owns the risks and outcomes of each material AI use case?
3. How does risk appetite translate into approval, monitoring and shutdown thresholds?
4. Can management demonstrate that human oversight and technical controls are effective?
5. Have critical AI dependencies, concentration risks and fallback options been tested?
6. Can the second and third lines provide informed, independent challenge?

Suggested 90-day action plan

These timings are suggested management priorities, not FCA deadlines.

JADEtc Academy perspective

The FCA's publication reinforces an established risk management principle: everyone and every system is fallible. The aim is not to promise perfect AI, but to build governance that can identify errors, challenge assumptions, detect emerging weaknesses and correct them before they cause unacceptable harm.

For financial institutions, the opportunity is to strengthen existing operational risk, resilience and third-party risk arrangements so they keep pace with AI adoption — without adding unnecessary governance complexity.

Primary source: FCA, AI in financial services: good practice and areas for improvement (published 19 October 2026; updated 20 October 2026). This article distinguishes FCA observations from JADEtc Academy analysis and recommendations.