FCA flags poor AI practice and calls for clearer warnings

The Financial Conduct Authority (FCA) published observations on 19 October 2026 setting out what it regards as good practice, and what it regards as areas for improvement, in how firms use artificial intelligence (AI). The material draws on the regulator's supervision work, engagement with industry and initiatives run through its AI Lab. On the same day, Jessica Rusu, the FCA's chief data, information and intelligence officer, used a speech to ask AI providers to be clearer with consumers about the limits of what their models say about money.

Together the two interventions bear on UK firms using AI in retail journeys, and on UK consumers who are increasingly asking general-purpose chatbots about investments, pensions and borrowing. Some of the FCA's examples describe governance introduced only after a system had been deployed, which is part of why the observations read as corrective rather than preparatory.

One point needs stating up front, because it is easy to misread. The examples create no new requirements. The FCA's position is that existing frameworks already apply, including the Consumer Duty and senior management accountability. This is a supervisory publication, not UK AI legislation, and it is not the EU AI Act.

Outputs assumed to be understood, not tested

Among the areas for improvement, the FCA described firms that assumed consumers understood AI-generated outputs without testing comprehension across different groups of consumers. Others relied on AI to detect vulnerability in customers without putting sufficient safeguards around that detection.

The risk in both cases runs in the same direction. If a firm has not checked that a customer can follow what an AI system has told them, it does not know whether the customer is making an informed decision about a product that can charge interest, lose value or affect their credit standing. If a firm trusts a model to spot a vulnerable customer and that model is wrong, the customer who most needs careful handling is the one who does not get it.

The FCA also set out what it saw working. Positive examples included testing across consumer groups rather than a single notional user, challenge and sign-off before deployment, ongoing monitoring once a system is live, and clear routes to human support.

Excluding vulnerable consumers is not automatically safe

Some firms deal with the problem by keeping vulnerable consumers out of AI journeys by default. The FCA's observation is more careful than a simple prohibition: exclusion by default could be unfair where there is no alternative support that meets those consumers' needs, although exclusion can sometimes be appropriate.

That qualification is the whole of the point. Routing a customer away from an automated journey only helps if the route leads somewhere. A firm that excludes a customer and then offers nothing better has not protected them; it has reduced their access.

Governance that arrived after the system did

The third strand concerns accountability. The FCA found governance added after deployment, which left gaps in who was responsible for what. One anonymised example, case study J, describes teams each assuming that oversight of an AI system belonged to someone else.

The anonymised examples do not name firms and do not establish enforcement findings against any particular bank or lender. Nor do the observations establish how common these failings are across UK financial services; they are examples drawn from the FCA's work, not a measured failure rate for the sector.

What actually has legal force

The Consumer Duty requires firms within its scope to deliver good outcomes for retail customers. It is a UK requirement, set by the FCA, and it was already in force before any of this. A firm whose AI system produces outcomes it has never tested is being measured against that duty, not against a new AI rulebook.

The warning request, and where protection stops

In her published speech of 19 October 2026, Rusu called on AI providers to give clear, proportionate and consistent disclaimers explaining the limits of model-generated financial information and advice. She said warnings may work better at the point where AI-generated financial information is delivered, as consumers increasingly consult general-purpose large language models — systems built to generate language — and as regulated firms integrate their services into AI platforms.

The speech supplies no prescribed disclaimer wording, no implementation deadline and no provider commitment. It is a published draft, which may differ from what was delivered.

The substance behind the request is a boundary that many consumers do not see. The FCA's position is that general-purpose AI financial information sits outside its regulation of advice, and does not attract Financial Ombudsman Service (FOS) or Financial Services Compensation Scheme (FSCS) protection. An AI tool operated by an authorised firm that provides regulated advice could attract those protections — but eligibility is conditional. Authorisation alone does not guarantee protection for every activity, and an investment loss on its own does not establish an entitlement to compensation.

The FCA also warns that AI can produce confident but false answers — plausible-sounding output that is simply wrong, often called hallucination — as well as information that is out of date. Its consumer guidance directs people to verify financial information against original sources rather than acting on a model's summary.

How far the misunderstanding goes

FCA research gives some measure of the confusion. In fieldwork conducted on 24 July 2026 and published on 27 August 2026, 44% of respondents mistakenly believed that AI financial information was regulated, and 32% wrongly expected FSCS or ombudsman compensation if AI advice went wrong.

The sample was 666 UK respondents aged 18 to 40 who either owned investments or would consider buying within 12 months. It is not a sample of all UK adults, and the findings should not be read as such.

Two figures in circulation also need separating. Rusu's speech refers to 40% of consumers recognising the absence of recourse, while the August release's 32% measures a differently worded response about expecting compensation. The two are not complements of each other and should not be added together or treated as the same measurement.

What to watch

Three things would move this on: whether AI providers respond with the kind of disclaimers Rusu described, whether the FCA follows the observations with anything binding, and what the joint survey of AI adoption that Rusu said was due the following week actually measures. The practice webpage records an update on 20 October 2026, though the precise changes from its original version have not been established.

The official detail is with the regulator rather than with any intermediary. The good and poor practice examples sit on the FCA's AI in financial services publication (opens in a new tab), Rusu's speech is published as Building the future of finance in the age of AI (opens in a new tab), and the consumer-facing guidance on model-generated research is at Using AI for investment research (opens in a new tab) on InvestSmart.