FCA Compliance and AI: What Your Firm Needs to Know

The number one objection we hear from financial services firms considering AI is: "Our compliance team will never approve this." It's a reasonable concern. You operate in one of the most heavily regulated industries in the UK. Getting AI wrong could mean regulatory action, client harm, and reputational damage.

But here's what we've found: compliance teams don't object to AI. They object to poorly implemented AI with no guardrails. When you show them a system with proper controls, audit trails, and human oversight, they're often the biggest advocates — because good AI makes their job easier, not harder.

What the FCA actually says about AI

The FCA has been increasingly clear about its expectations for firms using AI and machine learning. The key principles from their published guidance:

• Accountability cannot be delegated to a machine. If an AI system produces an output that affects a client, a human at the firm is responsible for that output. This means human review is not optional — it's regulatory requirement.
• Firms must be able to explain their AI. If the FCA asks why a particular recommendation was made or a particular action was taken, "the AI decided" is not an acceptable answer. You need audit trails that show the inputs, the reasoning, and the human approval.
• Consumer duty applies to AI interactions. The Consumer Duty requires firms to act in customers' best interests. If an AI chatbot gives a client incorrect information, the firm is liable — just as if a human employee had given the same incorrect information.
• Data protection is non-negotiable. Client data used in AI systems must comply with UK GDPR. This includes data minimisation (only process what you need), purpose limitation (only use data for stated purposes), and clear data processing agreements with any third-party AI providers.

The six questions your compliance team will ask

1. "Where does client data go?"

The right answer: client data is processed in the UK or EU, by a provider with a signed Data Processing Agreement (DPA), on infrastructure where data is encrypted in transit and at rest, and is never used to train AI models.

The red flag: any provider who can't tell you exactly where data is processed, or who uses client data to improve their general model.

2. "Is there always a human in the loop?"

For any AI output that reaches a client — a drafted email, a meeting summary, a chatbot response about a specific product — there must be a human review step. The AI produces a draft; a qualified human approves it.

For internal tools (like searching your own knowledge base or summarising internal documents), human review is best practice but the risk profile is lower.

3. "What if the AI makes a mistake?"

Good AI systems are designed with the assumption that they will sometimes be wrong. The safeguards include:

• Confidence scoring — if the AI isn't confident in its answer, it escalates to a human rather than guessing
• Source citations — every AI response should reference the document it drew from, so a human can verify
• Guardrails — hard rules that prevent the AI from making pricing commitments, giving personal advice, or discussing topics outside its knowledge base
• Audit trails — every interaction logged, showing what the AI generated, what a human edited, and what was sent to the client

Try our compliance red-liner demo — it shows exactly this kind of guardrail in action →

4. "Does this create a new regulatory risk?"

AI tools introduce risk the same way any new tool does — through implementation, not through the technology itself. A spreadsheet with incorrect formulas is a compliance risk. A chatbot with incorrect information is a compliance risk. The mitigation is the same: testing, validation, review, and ongoing monitoring.

In practice, well-implemented AI often reduces compliance risk because:

• AI-generated meeting notes are more complete than notes written from memory hours later
• AI compliance checkers catch issues that humans miss due to fatigue or familiarity
• AI chatbots give consistent, accurate answers (from verified documents) rather than varying answers depending on which team member picks up the phone

5. "How do we maintain records and audit trails?"

Every AI interaction should be logged with:

• Timestamp
• Input (what the user asked or submitted)
• AI output (what was generated)
• Human edits (what was changed during review)
• Final approved version (what was filed or sent)
• Approver identity

This gives your compliance team a complete trail that's actually easier to audit than the current process (where an adviser writes notes from memory with no record of what was actually said in the meeting).

6. "What happens if the provider disappears?"

Valid concern. The right approach:

• You own your data, your documents, and your configurations
• Nothing should be locked behind a proprietary platform that you can't extract
• Your AI provider should give you full documentation so another developer could maintain the system if needed
• Contractual provisions for data return and transition support

A practical compliance checklist for AI adoption

Before your firm adopts any AI tool, work through this with your compliance team:

1. Obtain and review the provider's Data Processing Agreement
2. Confirm data processing location (UK/EU) and encryption standards
3. Confirm that data is not used for model training
4. Define which AI outputs require human review before reaching clients
5. Establish the audit trail format and retention period
6. Test the AI on real scenarios (not just the demo) to verify accuracy
7. Document the AI tool in your firm's technology register
8. Add AI-specific items to your annual compliance review
9. Brief all staff on proper use and limitations
10. Set up a monitoring process for ongoing accuracy

The bottom line

AI is not inherently a compliance risk. Badly implemented AI is a compliance risk — just like badly implemented anything else. The firms that get this right treat AI adoption as a compliance project from day one: they involve their compliance team early, they insist on guardrails and human oversight, and they document everything.

The result is a firm that's both more efficient and more compliant than it was before.