ONE WORLD AI Discuss a pilot

Rules, execution
and evidence.

OWAI INSIGHTS · UNITED KINGDOM / FINANCIAL SERVICES

FCA and AI agents: accountability without a new rulebook

The FCA has chosen not to write an AI-specific rulebook. Instead it applies its existing, outcomes-focused framework to how firms design, deploy and oversee AI. For firms introducing agents that can act — issue refunds, change records, contact customers — that makes the question practical: can the firm show who was accountable for each action, and that customers were treated in line with the Consumer Duty?

LAST REVIEWED / 28 SEPTEMBER 2026Discuss your workflow
01

The FCA’s approach

The FCA’s position is that firms remain responsible for how they use AI under the rules that already apply to them, including the Principles for Businesses, the Consumer Duty, the Senior Managers and Certification Regime (SM&CR) and the systems-and-controls requirements. Alongside supervision it supports firms that want to test AI, for example through the AI Lab and the Supercharged Sandbox.

In July 2026 the FCA published the Mills Review of the impact of AI on retail financial services. It noted significant consumer interest in AI that can act within pre-set goals, alongside concerns about trust and control, and builds on the existing framework rather than proposing AI-specific rules.

02

Accountability under SM&CR

Using AI does not dilute senior management accountability. When an agent can take an action, the firm should be able to point to the Senior Manager responsible for the business area and to the controls that govern what the agent may do — including when a person must approve, and who that person is. Outsourcing a model to a third party does not transfer that accountability.

03

Consumer Duty outcomes

The Consumer Duty requires firms to deliver good outcomes for retail customers and to be able to evidence them. An agent that handles refunds, complaints or product changes affects those outcomes directly. Firms will want to show that the agent’s permitted actions are consistent with fair value and customer support expectations, that foreseeable harm has been considered, and that exceptions reach a person with the authority to decide.

04

What firms should be able to show

For each consequential action an agent can take, a firm should be able to answer:

  • Which actions the agent may take on its own, and under which limits — for example refunds up to a set amount.
  • Which actions require approval, by which role, and how that role’s authority is recorded.
  • That the connected system cannot act without an approved decision, including on retries, fallbacks and service accounts.
  • What evidence remains afterwards: the proposal, the rule applied, the decision, the approver and the result — in a form compliance, internal audit and supervisors can review.
05

How OWAI OS relates

OWAI OS turns those answers into operating controls. Your compliance team maintains the rules as versioned policy; each AI-proposed action is checked against it before anything runs; actions that need approval go to the role your policy names; and each decision leaves verifiable evidence tied to the policy version and the approver. It supports your own assessment under the FCA framework; it does not determine compliance.