AI governance for UK financial services firms

UK financial services firms govern AI under rules they already follow. The FCA and the PRA have chosen not to write AI-specific rules. Instead they expect firms to apply the Consumer Duty, the Senior Managers and Certification Regime (SM&CR) and existing model risk and operational standards to AI, alongside UK GDPR. This guide sets out what each regulator has said, as of October 2026, and the governance work it implies. The wider UK approach is covered on the UK AI regulation page.

The FCA’s position

On 8 June 2026 the FCA said it is not going to introduce new regulations for AI. It will rely on existing frameworks and its expectations on governance and controls, naming the Consumer Duty and SM&CR. The same post describes the FCA’s AI Lab, which runs the AI Live Testing programme for firms testing AI in real-world conditions with regulatory support, and the Supercharged Sandbox for earlier-stage ideas. The second AI Live Testing cohort launched in 2026, with a report on what it learned expected early in 2027.

On 6 July 2026 the FCA published the Mills Review, its review of AI and the future of retail financial services. It made seven recommendations to the FCA Board and Executive, from securing the regulatory perimeter to monitoring the transition to autonomous models and enabling the foundations for agentic finance. The FCA chair credited the regulator’s outcomes-focused approach, relying on the Consumer Duty and the senior managers regime, for keeping pace with AI. The FCA said it will publish AI good and poor practice material later in 2026.

What the Consumer Duty asks of AI

The Consumer Duty requires firms to deliver good outcomes for retail customers. It is outcome-based, so it applies to an AI system in the same way it applies to a person or a spreadsheet doing the same job. A firm using AI in pricing, credit decisions, claims, advice, servicing or communications has to be able to show that the system supports good outcomes and does not cause foreseeable harm.

For AI that means testing outcomes across customer groups, including customers with characteristics of vulnerability, before and after deployment. It means checking that AI-generated communications are clear and accurate. And it means monitoring the system in production, because a model that performed well at launch can drift. The work is close to a bias assessment and an ongoing drift review, recorded against each system so the firm can show its board and the FCA what it found.

What SM&CR asks of AI

SM&CR makes named senior managers accountable for the activities in their statement of responsibilities. There is no separate AI role. If AI is used in an activity, the senior manager responsible for that activity is responsible for how the AI is governed, and needs to be able to show they took reasonable steps.

In practice that turns into three things. An inventory of where AI is used, so each use can be mapped to a senior manager. A clear owner for each material system, with the authority to stop or change it. And management information that lets the senior manager see how the system is performing and what has gone wrong. A register of AI systems with owners and risk tiers is the usual starting point.

PRA SS1/23 and model risk

The PRA’s SS1/23, Model risk management principles for banks, was published on 17 May 2023 and took effect on 17 May 2024. The current version took effect on 23 April 2026 after low-impact amendments. It applies to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval for credit risk, market risk or counterparty credit risk.

SS1/23 sets five principles. They are model identification and model risk classification, governance, model development, implementation and use, independent model validation, and model risk mitigants. A sub-principle covers identifying and managing the risks of AI in modelling techniques such as machine learning. For AI, the principles ask a bank to identify every model including AI and vendor models, classify each by risk, have someone senior accountable for model risk, validate models independently, and apply mitigants such as overrides and restrictions where a model is uncertain.

Firms outside SS1/23’s formal scope often use it as a reference point, because it is the clearest statement from a UK prudential regulator of what good model risk management looks like.

UK GDPR and automated decisions

Many financial services decisions are made about individuals, so UK data protection law applies alongside the FCA and PRA. Since 5 February 2026, UK GDPR Articles 22A to 22D allow significant decisions based solely on automated processing, such as an automated credit refusal, only with safeguards. The person must be able to get information about the decision, make representations, obtain human intervention and contest it. The ICO’s guidance on AI and data protection explains how the rest of UK GDPR applies, from lawful basis to fairness and accuracy.

Third parties

Most firms use AI they did not build, from vendor scoring models to general-purpose AI inside productivity tools. The FCA and PRA hold the firm responsible for outcomes and risk either way, and existing outsourcing and operational resilience expectations still apply. Vendor AI risk management covers the due diligence and contract terms that let a firm govern an AI system it does not control.

Where Aicura fits

Aicura supports this work. The AI register records every system and model with its owner, the activity it supports and its risk tier. Assessments hold the risk and impact work for each system, oversight records who is accountable and where a person reviews decisions, and monitoring tracks behaviour in production. Pro adds assessment against ISO/IEC 42001 and the NIST AI RMF, which many UK firms use to structure their governance. It does not replace the firm’s own judgement or the regulators’ requirements, and the decisions stay with the firm.