AI governance for FCA-regulated firms: a practical guide

AI governance is the set of decisions, controls and records that let a firm use artificial intelligence while staying in control of the risk. For a UK firm regulated by the Financial Conduct Authority, it is not a separate regime: it is how you apply the rules you already follow to a new kind of tool.

This guide explains what the FCA has said, which parts of the Handbook are most relevant, and how to build a framework that works for the AI your people actually use.

What the FCA has said about AI

The FCA’s position is set out on its page AI and the FCA: our approach. The regulator describes its approach as principles-based and outcomes-focused, and says it does not plan to introduce extra regulations specifically for AI. Instead it relies on existing frameworks, naming the Consumer Duty and the accountability of senior managers under SM&CR.

Two further publications fill in the detail:

• AI Live Testing. In April 2026 the FCA announced the second cohort of its AI Live Testing initiative, which helps firms explore risk management and live monitoring before and during deployment. Testing runs to the end of 2026, with an evaluation report expected in the first quarter of 2027. Taking part is not described as approval.
• Good and poor practice. In October 2026 the FCA published AI in financial services: good practice and areas for improvement. It sets out observations with illustrative case studies, and the FCA says the examples do not create new requirements. It is still the best available benchmark for what supervisors expect to see.

The message across all three is consistent: firms are expected to apply their existing obligations to AI, and to be able to show how.

Which existing rules matter most

Which rules apply depends on your permissions, business model and SM&CR category, so treat this as a starting map rather than a checklist.

• The Principles for Businesses (PRIN 2.1) apply to every authorised firm. Principle 2 (skill, care and diligence), Principle 3 (management and control) and Principle 11 (relations with regulators) are the most directly relevant to AI.
• Systems and controls (SYSC 4.1) require robust governance arrangements: clear lines of responsibility, effective processes to identify, manage, monitor and report risks, and internal controls.
• Record-keeping (SYSC 9.1) requires orderly records of your business and internal organisation — including, in practice, how you decided to use AI and how you control it.
• SM&CR places accountability on named senior managers. See SM&CR and AI.
• The Consumer Duty (PRIN 2A) applies to retail market business, including where AI is used in products, communications and support. See Consumer Duty and AI.
• Outsourcing and operational resilience apply when AI depends on third-party providers. See third-party AI risk.

Data protection law (UK GDPR) also applies wherever AI processes personal data. It is regulated by the ICO, not the FCA, but your governance needs to cover both.

The seven building blocks of an AI governance framework

1. Policy

An AI acceptable use policy tells people which tools they may use, for what, with which data, and what needs approval. It should be short enough to read and specific enough to apply. Our guide to writing an AI acceptable use policy covers the content.

2. Inventory

You cannot govern what you cannot see. A central register of AI use cases, each with an accountable owner, risk rating, approval record and review date, is the backbone of everything else. The FCA’s good practice publication highlights a central inventory of AI agents with owners, access and controls. See building an AI use case register.

3. Risk assessment

Not every use of AI needs the same scrutiny. Drafting an internal summary is not the same as generating a personal recommendation. Simple risk tiers — the FCA describes tiers that intensify testing and monitoring — let you put effort where it matters.

4. Controls

Controls turn policy into practice: which models each role can use, which data can be sent to them, what is masked or blocked, and what is held for human approval. Controls work best when they sit in the path of every request rather than relying on people remembering the policy.

5. People

Staff need role-specific training, and reviewers need to understand automation bias — the tendency to accept a machine’s answer. Attestations that let people declare exceptions, rather than forcing a blanket “I confirm”, surface problems you would otherwise miss. See AI training for staff.

6. Oversight and monitoring

The FCA points to forward-looking monitoring of real-world outcomes, with thresholds, logs and audit trails, and to human review decided by risk assessment rather than applied as a box-ticking step. See human oversight of AI.

7. Evidence and management information

Boards are expected to set risk appetite for AI and receive regular management information. Evidence should be produced by everyday operation — decisions logged as they happen, attestations timestamped against policy versions — not assembled the week before an audit.

Do not forget everyday AI

Many governance programmes start with models built in-house: credit models, fraud detection, pricing. Those matter. But the fastest-growing exposure in most firms is general-purpose generative AI used by employees — drafting emails, summarising documents, researching. That use is often invisible, and it is where client data most easily leaks. See shadow AI in financial services.

A framework that covers only “models” and not everyday use leaves the largest gap open.

A practical starting sequence

1. Find out what is happening. Ask staff what they use, review network and expense data, and record everything in a register.
2. Publish an interim policy. Even a one-page policy, acknowledged by staff, is better than none.
3. Provide an approved route. People use unapproved tools when there is no approved one.
4. Tier and approve use cases. Start with the highest-risk uses.
5. Train and attest. Role-based training, followed by attestations that allow exceptions.
6. Monitor and report. Agree the management information the board will see, and how often.

If you want a quick view of where you stand, the AI governance readiness assessment takes about three minutes.

How Dutira helps

Dutira brings these building blocks into one platform: a governed AI workspace where every request passes policy checks, a use case register with risk-routed approvals, training and attestations, monitoring, and an evidence centre. It supports a firm’s own compliance arrangements; responsibility for meeting regulatory obligations stays with the firm. See the platform.