AI training for staff in financial services: what good looks like

AI changes how people work faster than most training programmes change. Staff need to know how to use AI well, where the limits are, and what to do when something goes wrong — and the firm needs records that show they do.

This article covers how to design AI training for a regulated firm, test understanding and run attestations that produce honest answers.

The regulatory backdrop

Several parts of the Handbook bear on staff competence:

• SYSC 5.1 sets expectations that employees have the skills, knowledge and expertise needed for their responsibilities (scope depends on the type of firm).
• The Training and Competence sourcebook (TC) applies where firms carry on certain activities, largely with retail clients.
• The individual conduct rules in COCON apply to most staff of SM&CR firms, including acting with due skill, care and diligence.

The FCA’s good practice publication points to role-specific training, including for human reviewers on automation bias.

Design training by role

Everyone

A short foundation course covering:

• What generative AI is good at and where it fails — including confident, plausible errors (“hallucinations”).
• The firm’s AI acceptable use policy: approved tools, data rules and what needs approval.
• Protecting client and confidential information.
• How to report an AI incident or concern.

Customer-facing staff

Additional content on AI-drafted communications, the Consumer Duty, vulnerable customers, and when a person must review or take over.

Advisers and investment staff

Where AI must not be used (for example to produce personal recommendations outside approved processes), and how to check AI-assisted research.

Marketing

Financial promotion rules apply to AI-drafted promotions, and the approval process for them.

Reviewers and approvers

How to review AI output critically, how automation bias works, what a meaningful review looks like, and how to record a decision. See human oversight of AI.

Senior managers

Accountability, risk appetite, the management information they should expect, and the questions to ask. See SM&CR and AI.

Test understanding

Completion alone shows attendance, not understanding. Short knowledge checks at the end of each module — scenario-based where possible — give better evidence:

• Set a pass mark and allow retakes, recording each attempt.
• Mark answers on the server, not in the browser, so results are reliable.
• Issue certificates on completion, tied to the course version.
• Schedule refreshers, and require them when policies change materially.

Attestations that tell you the truth

An attestation asks people to confirm statements — for example “I have used only approved AI tools for firm work”. Done badly, attestations become a box people tick to make a reminder go away.

Done well, they let people say “not entirely” and explain:

• Tie each attestation to policy versions, so you know what people were attesting to.
• Allow exceptions with an explanation for each statement, rather than forcing a single confirmation.
• Follow up exceptions — understand what happened and fix the cause, without penalising honesty.
• Escalate overdue attestations to line managers, and report completion and exceptions to management.

Declared exceptions are one of the best sources of information about shadow AI.

Records

Keep records of who completed which course version, when, with what result; who attested to which statements against which policy versions; and what happened to each exception. These records support your record-keeping obligations (SYSC 9.1) and are central to evidencing your arrangements.

Measuring whether training works

Useful measures include completion and pass rates by department, common wrong answers (which show where guidance is unclear), attestation exceptions over time, and whether incidents fall in areas where training was refreshed.

How Dutira helps

Dutira includes role-based AI courses with knowledge checks marked on the server, certificates and scheduled refreshers, and attestation cycles tied to policy versions that let people declare exceptions, with follow-up actions and escalation. Starter courses are provided for review; firms load their own approved content. See Training & Audit.