Could You Defend Your Use of AI to the FCA? 

Nothing unusual there.

After all, advisers have spent years looking for ways to reduce administrative burden and spend more time with clients. AI appears to offer exactly that. Faster output, lower costs, greater efficiency. What’s not to like?

An AI governance framework is rapidly moving up the agenda for firms operating in regulated markets. As artificial intelligence becomes more embedded within advice processes, firms need to think beyond efficiency and consider governance, oversight, accountability and evidence of good customer outcomes.

But imagine the FCA requests a sample of your files as part of a thematic review. It wouldn’t be the first time. Recent exercises such as the RIAAT review demonstrated the regulator’s willingness to look beyond policies and procedures and examine the evidence sitting behind firms’ decisions.

The files contain AI generated meeting notes, AI assisted client communications and content that has been reviewed and approved by an adviser.

The FCA asks a simple question:

“How did you satisfy yourself that the information provided to the client was accurate, suitable and understood?”

Could you answer that confidently?

Could you evidence it?

And would that evidence still make sense if the adviser involved had left the business two years earlier?

Because at that point, the discussion is unlikely to focus on how sophisticated the technology was. It is far more likely to focus on the AI governance framework surrounding it, the controls applied to its use, and the evidence demonstrating that good client outcomes remained at the centre of the process.

AI Governance Financial Services and Consumer Duty Responsibilities

An AI governance framework should support firms in meeting their Consumer Duty obligations by ensuring that the use of AI continues to promote good outcomes, clear communication and appropriate oversight.

One of the greatest strengths of a good adviser is their ability to understand people. Not products, processes or regulation, but people.

Most experienced advisers know instinctively when a client requires additional explanation, when they are uncomfortable with a recommendation, or when they have politely nodded their way through a meeting whilst understanding very little of what has actually been said. This understanding is built through relationships, conversations and experience.

The challenge for firms embracing AI is ensuring that efficiency does not inadvertently erode that understanding.

Consumer Duty requires firms to communicate information in a way that clients are likely to understand. Whilst an AI tool may produce a technically accurate explanation, technical accuracy does not necessarily equal understanding. A piece of communication can be grammatically perfect, technically accurate and still fail to connect with the person reading it.

The solution is not to avoid using AI within client communications. Instead, firms should ensure that human oversight extends beyond proofreading and considers whether the communication is likely to be understood by the client receiving it. Whoever reviews the output should ask whether the communication reflects their understanding of the client’s needs, characteristics and level of knowledge, rather than simply whether it reads well. Consumer Duty was never about producing documents. It was about creating understanding.

AI Often Exposes Existing Record Keeping Weaknesses

When B-Compliant reviews files, concerns relating to record-keeping remain one of the most common findings. Meeting notes can lack sufficient detail, rationales may be difficult to follow, and key conversations sometimes exist only in the memory of the adviser who conducted them.

A recommendation may have been entirely appropriate, but if the file only tells half the story, demonstrating how the client’s needs, objectives and circumstances were assessed becomes considerably more difficult.

This is where AI presents both an opportunity and a challenge. Used effectively, AI can help advisers capture conversations more accurately, reduce administrative burden and create more comprehensive records. However, technology alone will not solve poor documentation practices. If important context is not discussed, recorded or reviewed, AI cannot magically fill in the gaps.

Firms should therefore be cautious about viewing AI as a solution to record keeping weaknesses. A meeting summary generated in seconds is only valuable if it captures the information that matters. Likewise, a suitability report produced more efficiently does not necessarily provide stronger evidence if the underlying records fail to demonstrate the client’s needs, concerns and understanding.

Ultimately, the question is not whether AI can speed up the process. In many cases it can. The more important question is whether it helps firms create records that allow an independent person to understand the client’s journey from start to finish. If the answer is no, the issue is unlikely to be artificial intelligence. The issue is still documentation.

Foreseeable Harm Requires More Than Checking the Output

When discussing AI compliance, the most common advice tends to be remarkably simple:

“Just check the output.”

We’ve even touched on that point already in this article. The trouble is that, whilst sensible, it is hardly groundbreaking advice. Telling firms to “check the output” is a little like telling advisers to “know their client”. Technically correct, but not particularly helpful when trying to understand what good governance looks like in practice.

Consumer Duty encourages firms to consider foreseeable harm. That means looking beyond whether a process works under normal circumstances and considering how it might fail. AI should be approached in exactly the same way.

For example, could an AI meeting summary miss something important that changes the context of the conversation? Could an automated communication create unintended confusion for a vulnerable client? Could an AI powered process introduce bias, inconsistency or overreliance on information that has not been adequately verified?

None of these scenarios are unlikely or extreme. They are entirely foreseeable. As a result, firms should assess them before implementing technology rather than after a problem arises.

An effective AI governance framework should identify where AI is being used, consider the potential risks associated with each activity and establish controls proportionate to those risks. This is a core principle of AI governance financial services and forms the foundation of effective oversight.

The objective is not to predict every possible failure. It is to demonstrate that reasonable thought was given to how harm could occur and how it would be managed.

AI Governance Financial Services Requires More Than Technology

One of the recurring themes in regulatory discussions around AI is accountability. Technology may generate an output, but responsibility remains with the firm. This becomes particularly important as firms begin to use AI across different parts of the business.

Whilst some organisations may have formally approved tools that have been through due diligence and governance processes, the reality is often far more complex. Employees may have access to Microsoft Copilot, AI functionality embedded within existing systems, or increasingly, the ability to create their own agents and workflows to solve day to day problems.

In many ways, this is where the governance challenge becomes more interesting. The question is no longer whether a firm has approved the use of AI, but whether it understands how AI is being used across the organisation. As awareness grows, employees are becoming more confident experimenting with the technology, building solutions to improve efficiency and automating tasks that were previously completed manually. Whilst this can deliver significant benefits, it can also create risks if governance arrangements fail to keep pace with adoption.

This is why firms should consider whether responsibility for AI has been clearly embedded within their governance framework. Who owns the risk? Is accountability sitting with Compliance because it is perceived to be a regulatory issue, or is it better aligned to Information Security, Technology or Operations? Does the individual responsible have the expertise, authority and resources required to provide effective oversight? In larger organisations, these questions may already have clear answers. In smaller firms, there is often a risk that accountability defaults to the nearest available person rather than the most appropriate one.

As AI becomes more embedded within day to day activities, firms may also need to consider whether existing governance arrangements remain fit for purpose. Are Statements of Responsibilities, policies and procedures aligned with the reality of how AI is being used? Have privacy notices been reviewed where client information is being processed through AI tools? Is the firm’s existing Senior Management Function structure being fully utilised, or are responsibilities sitting informally between departments without clear ownership?

We have already discussed the importance of reviewing AI generated outputs, but meaningful oversight goes much further than checking a document before it reaches a client. Effective governance requires firms to understand the technology they are using, the risks it presents and who remains accountable when things do not go according to plan. After all, “the AI said so” is unlikely to prove any more persuasive than “the computer said yes”.

The Question the FCA Will Really Ask

Much of the discussion around FCA AI guidance and AI governance in financial services focuses on the technology itself. In reality, the FCA is likely to be interested in something far simpler.

How do you know your customers are receiving good outcomes, and what evidence do you have to support that conclusion?

Whether a communication was drafted by an adviser, produced by a colleague or assisted by an AI tool is largely secondary to that question.

Firms that can demonstrate clear governance, strong record keeping, meaningful oversight and a genuine understanding of their clients are unlikely to struggle when explaining their use of AI.

Those that cannot may discover that their challenge was never really about artificial intelligence at all.

It was about governance.

Ultimately, AI governance financial services is not really about technology. It is about demonstrating that firms understand how AI is being used, who remains accountable for it, how risks are managed and how good customer outcomes continue to be delivered.