SM&CR and AI: who is accountable, and how to show it

The Senior Managers and Certification Regime (SM&CR) is built on a simple idea: specific people are accountable for specific parts of a firm. The FCA has described SM&CR accountability as relevant to the safe use of AI in its statement AI and the FCA: our approach.

So who is accountable for AI? This article explains how SM&CR applies, how firms are allocating AI responsibilities, and what evidence of “reasonable steps” looks like.

How SM&CR applies to AI

SM&CR has three parts:

• The Senior Managers Regime — individuals performing senior management functions are approved by the regulator and have statements of responsibilities. Which prescribed responsibilities apply depends on the firm’s SM&CR category (SYSC 24).
• The Certification Regime — firms certify staff in certain roles as fit and proper.
• The Conduct Rules — individual conduct rules in COCON apply to most staff, with additional rules for senior managers.

There is no prescribed responsibility that is specifically about AI. AI is a tool used across the business, so responsibility follows the activity: the senior manager responsible for an area is responsible for how AI is used within it. Firms then decide whether to give one senior manager an overarching responsibility for the AI framework itself.

Ways firms allocate AI responsibility

There is no single right answer, and the FCA does not prescribe one. Common patterns include:

• Framework owner plus business ownership. One senior manager — often the Chief Operations function, Chief Risk function or a technology-focused senior manager — owns the AI governance framework, while each business line’s senior manager is responsible for AI used in their area.
• Risk-led. The Chief Risk function owns the AI risk framework and appetite, with first-line owners for each use case.
• Committee-supported. An AI governance committee provides challenge and approval, with clear terms of reference — but accountability still rests with individuals, not the committee.

Whatever model you choose, write it down. The FCA’s good practice publication points to mapping AI responsibilities across senior managers from the design stage, with documented, auditable information on rationale, challenge and escalation.

Reasonable steps and the duty of responsibility

Under FSMA section 66A, a senior manager can be held responsible for a breach in their area if they did not take the steps a person in their position could reasonably be expected to take to avoid it. For AI, reasonable steps are likely to include:

• Knowing what AI is used in their area — through the AI use case register.
• Understanding the risks — through risk assessments and management information they actually read.
• Approving higher-risk uses deliberately — with conditions, and with the reasons recorded.
• Challenging — and recording the challenge and the response.
• Making sure controls exist and work — through monitoring and control testing.
• Acting on problems — escalation, remediation and, where relevant, considering whether the regulator should be told.

The common thread is evidence. A senior manager who took the right steps but cannot show it is in a weaker position than one whose decisions, challenges and follow-up are on record.

What management information should a senior manager see

Useful AI management information is short, regular and trend-based. It typically covers:

• The AI use cases in their area, by risk tier and status.
• Approvals pending and decided, including any past target time.
• Monitoring: activity, exceptions and alerts against thresholds.
• Incidents and remediation actions, with owners and due dates.
• Training completion and attestation results, including declared exceptions.
• Third-party issues, such as significant model changes from a provider.

Boards are expected to set risk appetite for AI and receive regular management information; the senior manager’s view should roll up into that.

Conduct rules and everyday AI use

Because the individual conduct rules apply to most staff, how people use AI is a conduct matter as well as a policy one. Acting with due skill, care and diligence includes checking AI output before relying on it. Clear policy, role-based training and honest attestations help individuals meet these standards — and give the firm evidence that it set and communicated expectations. See AI training for staff.

A short checklist

1. Decide and document who owns the AI governance framework.
2. Map AI use cases to the senior manager responsible for each area.
3. Update statements of responsibilities and, where relevant, responsibilities maps.
4. Agree the AI management information each senior manager and the board receive.
5. Make sure approvals, challenge and escalation are recorded as they happen.
6. Review the allocation when the use of AI changes materially.

How Dutira helps

Dutira records the firm’s own allocation of AI responsibilities, routes approvals by risk with separation of duties, and gives senior managers a dashboard and quarterly reports with recorded challenge — so decisions and reasonable steps are documented as part of everyday work. It does not assume any particular senior manager is responsible for AI; that decision stays with the firm. See the management dashboard.