What the FCA’s AI Guidance Means for Asset Managers

The FCA has published its good and poor practice observations on AI in financial services. It does not create a new AI rulebook or prescribe a single operating model. It is, however, an important supervisory signal.

For CCOs, COOs, and CTOs at buy-side firms with UK-regulated activities, the publication shows how the FCA is applying existing expectations on governance, accountability, resilience, and consumer outcomes to AI.

The key question is not whether a tool carries an AI label. It is whether the firm can explain what it does, why it is being used, who is accountable, and how risks are managed in practice.

This matters whether AI supports investment research, portfolio construction, investor reporting, operations, or internal decision-making.

The FCA Publication Signals How Existing Rules Apply to AI

The FCA’s examples show good and poor practice across the AI lifecycle, from initial design through to monitoring, intervention, change, and retirement.

This is noteworthy because it gives firms a clearer indication of the questions likely to arise in supervisory engagement. Firms should be prepared to show how they have identified AI use, assessed its impact, applied appropriate controls, and responded when the tool or its provider changes.

The publication is not a new requirement. It does, however, make the FCA’s current supervisory focus much clearer.

Good AI Governance Starts Before Deployment

Good practice starts with the use case, not the technology. The FCA describes firms defining the purpose of an AI use case and running a narrow pilot before deciding whether to scale it. This helps them understand the tool’s benefits and limitations before it creates a wider client, operational or market impact.

Poor practice begins when a firm deploys a tool first and tries to retrofit governance later. The result can be unclear ownership, weak documentation, and no effective route to challenge or escalate issues.

A practical starting point is a central register of AI use cases. Each material use case should have a defined purpose, named owner, risk rating, and clear boundaries for use.

The level of governance should reflect:

• Client, investor, market, and operational impact
• Data sensitivity and third-party dependencies
• The degree of autonomy and human involvement
• The firm’s reliance on the tool

This does not require a separate committee for every tool. It means the firm can show why a use case was approved and what controls apply.

Testing and Human Oversight Need to Be Meaningful

The FCA’s good practice examples include cross-functional challenge and formal sign-off before deployment. It also warns against human review becoming a tick-box exercise.

For higher-impact use cases, firms should test the tool in the context in which it will be used. This should include the risks identified, the standard the tool must meet, and the conditions attached to approval.

Human oversight only works when the reviewer has the information, authority, and time to challenge an output. They should be able to pause a process, override an output, or escalate an issue. Firms should monitor whether reviewers are genuinely doing so, rather than simply accepting AI-generated outputs.

This is particularly relevant where AI supports investment activity. Firms should consider whether AI-influenced positions remain within mandate restrictions, whether portfolio or style drift is emerging, whether valuations remain reliable, and whether human intervention is increasing.

Monitoring Should Link Risk to Action

Approval is not the end of governance.

The FCA’s good practice examples include thresholds, dashboards, audit trails, and escalation routes.

For each material AI use case, firms should be able to link:

• The risk identified
• The test completed before deployment
• The live metric or threshold that monitors the risk
• The person responsible for review
• The escalation route if the threshold is breached

This creates a clear line from risk assessment to testing, live monitoring, and action. It also allows firms to identify when a use case should be restricted, redesigned, or retired.

Senior Managers Remain Accountable for AI Risks

The FCA is clear that senior managers do not need to be AI specialists. They do need to take reasonable steps to understand the AI risks within their area, obtain the right expertise and provide effective challenge.

For material use cases, senior management should receive enough information to understand the purpose, risk rating, key controls, incidents, overrides, significant changes, and third-party dependencies.

Where a model changes, its scope expands, or its level of autonomy increases, firms should reconsider whether the existing governance and escalation arrangements remain appropriate.

Third-Party AI Does Not Remove Responsibility

Third-party tools can speed up adoption, but they do not remove the firm’s responsibility for how AI is used.

Vendor due diligence should go beyond a pre-contract questionnaire. Firms should understand how the provider manages model changes, what information it will provide, whether the tool can be tested in the firm’s own environment, and what happens if the tool fails or is withdrawn.

For higher-impact services, firms should have a realistic fallback. This may be an alternative provider, a previous approved model version, or a manual process. The fallback should be tested, not simply documented.

Independent Challenge Puts Policy into Action

Firms do not need a complex AI framework. They do need confidence that their arrangements work in practice.

Independent challenge can help separate policy from proof. A focused review of priority use cases can test whether ownership, controls, monitoring, and third-party arrangements reflect the firm’s actual AI use.