Consumer Duty and AI: what to check before and after deployment

The Consumer Duty requires firms in retail markets to deliver good outcomes for retail customers. The FCA has said the Duty applies to products and services, communications and support where AI is used — it is one of the two existing frameworks the regulator names in AI and the FCA: our approach.

This article sets out what to check before and after AI touches retail customers. Whether the Duty applies to a particular activity depends on your business; it covers retail market business as defined in PRIN 2A.

Where AI meets the Duty

AI can affect each of the four outcomes:

• Products and services — AI used in product design, eligibility or target market decisions.
• Price and value — AI used in pricing, or features whose cost is passed to customers.
• Consumer understanding — AI-drafted letters, emails, web content and chat responses.
• Consumer support — chatbots, AI triage of complaints, AI-assisted call handling.

It also touches the cross-cutting obligations: acting in good faith, avoiding foreseeable harm, and enabling and supporting customers to pursue their financial objectives.

Before deployment

The FCA’s good practice publication offers a useful sequence.

Start from the customer problem

Define the problem you are solving and the target market before choosing AI. A use case that starts from “we have a model, where can we use it?” is more likely to cause harm than one that starts from a customer need.

Test outcomes, not just accuracy

Test how outcomes vary across groups of customers, including customers with characteristics of vulnerability. Look at error rates and at what happens when the AI is wrong: who notices, and how quickly is it put right? The FCA notes as poor practice assuming a large language model reliably detects vulnerability without testing or safeguards. The FCA’s guidance on vulnerable customers (FG21/1) remains relevant.

Design for understanding

Customers should know when they are using an AI tool. AI-drafted communications must still be clear, fair and not misleading, and financial promotions remain subject to the promotion rules however they were drafted (COBS 4).

Keep a route to a person

Customers should be able to reach human support when they need it, and AI should not create barriers — for example, a chatbot that makes it hard to complain or cancel.

Decide where human review sits

For customer-facing output, decide from your risk assessment where a person must review before anything reaches the customer. See human oversight of AI.

After deployment

Monitor real-world outcomes

The FCA points to forward-looking monitoring of real-world outcomes, with thresholds, logs and audit trails. For AI this might include complaint rates, error and correction rates, escalation rates, outcomes by customer group and the share of interactions handed to a person.

Keep auditable records

Keep records of prompts, outputs, model versions, filters and escalation decisions, so you can investigate a problem and show how a communication was produced. This supports your record-keeping obligations and the outcome monitoring the Duty requires.

Report to the board

The Duty requires boards to review whether the firm is delivering good outcomes. AI should feature in that review where it affects retail customers, with management information that shows outcomes, not just activity. The FCA’s Consumer Duty guidance (FG22/5) covers governance and management information; note that the FCA has consulted on updated guidance that would replace it.

Act on what you find

Monitoring only matters if it leads to action: adjusting prompts and controls, adding review, retraining staff, or withdrawing a use case.

A practical checklist

How Dutira helps

Dutira lets firms register customer-facing AI use cases with Consumer Duty considerations in the risk assessment, hold AI-drafted communications and promotions for human approval, and keep a record of each request, the policy checks applied and the decision taken. Outcome monitoring of what customers experience still depends on the firm’s own customer data and processes. See the illustrative insurer scenario.