White paper
Governing generative AI in UK financial services: a practical framework
A practical framework for regulated firms: the regulatory landscape, seven building blocks of AI governance, a maturity view and a 90-day plan.
Read the white paper PDF availableThe library
ArticleGovernanceAI governance for FCA-regulated firms: a practical guideWhat the FCA expects of firms using AI, which existing rules apply, and the seven building blocks of a practical AI governance framework.5 min readRead ArticlePolicyHow to write an AI acceptable use policy for a regulated firmWhat an AI acceptable use policy for a financial services firm should cover, how to make it enforceable, and how to evidence that staff understand it.4 min readRead ArticleRiskShadow AI in financial services: how to find it and what to do about itWhy employees use unapproved AI tools, the risks for regulated firms, and a practical plan to surface shadow AI and give people a governed alternative.4 min readRead ArticleGovernanceBuilding an AI use case register: the inventory every firm needsWhat to record in an AI use case register, how to risk-tier each use case, and how the register drives approvals, monitoring and reviews.4 min readRead ArticleAccountabilitySM&CR and AI: who is accountable, and how to show itHow the Senior Managers and Certification Regime applies to AI, how to allocate AI responsibilities and what evidence of reasonable steps looks like.4 min readRead ArticleConsumer DutyConsumer Duty and AI: what to check before and after deploymentHow the Consumer Duty applies when AI touches retail customers: testing outcomes, vulnerable customers, communications and ongoing monitoring.4 min readRead ArticleData protectionProtecting client data when employees use generative AIPractical controls to stop client and confidential data leaking into AI tools: data classification, masking, model limits, retention and UK GDPR.4 min readRead ArticlePeopleAI training for staff in financial services: what good looks likeHow to design role-based AI training, test understanding, run attestations that allow exceptions, and keep records that stand up to review.3 min readRead ArticleOversightHuman oversight of AI: review and approval that is not box-tickingWhere human review of AI is needed, how to design approval workflows that resist automation bias, and how to record meaningful decisions.3 min readRead ArticleThird partiesThird-party AI risk: due diligence on model providersHow to assess AI model and platform providers: data use, model changes, resilience, outsourcing rules and the questions to ask before you sign.3 min readRead Illustrative case studyWealth managementA wealth manager replaces shadow AI with an approved workspaceAn illustrative scenario: how a fictional wealth manager could move staff from public AI tools to a governed workspace, step by step.3 min readRead Illustrative case studyInsuranceAn insurer governs AI-drafted customer communicationsAn illustrative scenario: how a fictional insurer could use AI to draft customer letters while meeting Consumer Duty expectations.3 min readRead Illustrative case studyPaymentsA payments firm handles an AI data incidentAn illustrative scenario: how a fictional payments firm could detect, investigate and learn from client data pasted into a public AI tool.3 min readRead
How ready is your AI governance?
Eight questions, about three minutes. A self-assessment, not a certification.