AI in financial services: the Consumer Duty, accountability and the FCA's approach

Cue 1 A shelf of existing rulebooks, none labelled AI, all with arrows pointing at an AI tool

EMMA 00:00 George, my compliance officer says the FCA has no AI rules, so we can get on with it. Is that right?

GEORGE 00:08 Half right, and the wrong half is expensive. The Financial Conduct Authority says it doesn't plan to introduce extra regulations for AI. It'll rely on existing frameworks.

EMMA 00:19 So no rules.

GEORGE 00:20 No new rules. The existing ones all apply. The Principles for Businesses, the Consumer Duty, the Senior Managers and Certification Regime, systems and controls, outsourcing. None mentions AI. All of them apply to it.

Cue 2 The four Consumer Duty outcomes, each with a question put to a tool

EMMA 00:34 Start with the Consumer Duty.

GEORGE 00:36 It requires you to act to deliver good outcomes for retail customers. Four outcomes, and you can put each to a tool as a question. Products and services. Is it fit for the customers it's used with?

EMMA 00:50 Price and value?

GEORGE 00:52 Does AI driven pricing leave some customers paying more for reasons you can't justify?

Cue 3 A chatbot conversation with a distressed customer and no hand over, beside one that hands over to a person

EMMA 00:57 Understanding.

GEORGE 00:58 Can customers understand what an AI generated message or a chatbot is telling them? And do they know it's automated?

EMMA 01:06 And support.

GEORGE 01:06 Can a customer reach a human being? And are they as well supported as they'd be without the tool?

Cue 4 An organisation chart with a named senior manager holding responsibility, and a supplier outside the firm

EMMA 01:14 What about vulnerable customers?

GEORGE 01:15 That's where automated journeys fail quietly. A chatbot doesn't hear distress. A scoring model treats a missed payment after a bereavement like any other.

EMMA 01:25 So what do I need?

GEORGE 01:27 A way for the tool to recognise and hand over. A route that doesn't depend on the customer using the tool at all. And monitoring of whether outcomes are worse for vulnerable groups.

Cue 5 A timeline: Treasury Committee in January 2026, the Mills Review on 6 July 2026, guidance expected by the end of 2026

EMMA 01:40 If the supplier's tool gets it wrong, isn't that on them?

GEORGE 01:45 No. Under the Senior Managers and Certification Regime a named senior manager is responsible for each area and must take reasonable steps to prevent breaches. That doesn't move when you buy a tool. Outsourcing a function doesn't outsource the responsibility.

EMMA 02:01 Is anything about to change?

GEORGE 02:03 Probably. In January 2026 the Treasury Committee recommended the FCA give comprehensive and practical guidance on AI by the end of 2026. And on 6 July 2026 the FCA published the Mills Review, with seven recommendations.

EMMA 02:17 What's the headline?

GEORGE 02:18 The first recommendation. Review general purpose AI tools that sit outside the regulatory perimeter but give outputs that look like financial advice.

EMMA 02:27 Does that change what I have to do today?

GEORGE 02:31 No. They're recommendations. The Consumer Duty and the accountability regime are the law now.

Cue 1 A loan decision with four safeguards attached: told, representations, human intervention, contest

EMMA 02:36 George, we're about to let a model decide small loans on its own. What do I need to have thought about?

GEORGE 02:45 Start with the decision itself. Declining a loan has a significant effect on a person. Since 5 February 2026 the law permits that to be made solely by automated means on ordinary personal data, with safeguards.

EMMA 02:59 Which are?

GEORGE 03:00 The customer must be told. They must be able to make representations. To obtain human intervention. And to contest the decision.

Cue 2 A model with no protected characteristics still producing different outcomes for two groups through a postcode

EMMA 03:08 We'll have someone glance at the declines.

GEORGE 03:11 A glance won't do. The Information Commissioner's Office says, in draft guidance, that human involvement must be active rather than tokenistic. Someone who understands the system and has the authority to change the outcome.

EMMA 03:25 The model doesn't use race or sex. So no discrimination risk.

GEORGE 03:29 It doesn't need them. A postcode, a shopping pattern or a device type can produce different outcomes for groups defined by race, sex, age or disability. That can be indirect discrimination under the Equality Act.

Cue 3 A chatbot asked what should I do with my pension, with a line marked between information and advice

EMMA 03:43 But the model's accurate.

GEORGE 03:45 On average. A model can be accurate on average and unfair to a group. Average accuracy isn't a defence to the Equality Act or to the Consumer Duty.

EMMA 03:56 So I monitor.

GEORGE 03:57 You compare outcomes across groups, understand why they differ, and justify the difference or remove it.

Cue 4 A customer asking why, and a member of staff able to explain the decision in plain words

EMMA 04:04 Separate question. Our website assistant answers pension questions. Is that advice?

GEORGE 04:08 It might be. The line between information and a personal recommendation doesn't move because a tool's doing the talking. If someone asks what should I do with my pension, and it answers with a course of action for that customer, it may have crossed the line.

EMMA 04:26 It has a disclaimer.

GEORGE 04:28 A disclaimer doesn't change what it said. Test what it says when it's pushed. Restrict it to what you're permitted to do. And hand over to a qualified person where advice is needed.

Cue 5 A go live checklist of seven items with a switch marked off

EMMA 04:41 What if a customer asks why they were declined?

GEORGE 04:45 You have to be able to answer in terms they can understand. And so does your senior manager when the regulator asks. A tool nobody in the firm can explain is one the firm can't govern.

EMMA 04:59 Give me the list before go live.

GEORGE 05:02 A named owner and senior manager. A written statement of what it may and may not do. Testing against known and difficult cases. A data protection impact assessment and supplier due diligence.

EMMA 05:15 And for customers?

GEORGE 05:16 A human route. Monitoring of outcomes by customer group. And a way to switch it off. Then keep the evidence, because we monitor outcomes needs numbers behind it.