AI can support client communication, document review, risk modelling and internal operations in financial services. Existing regulatory and data-protection obligations can apply to these uses. Their application depends on the firm's activities, the data processed and the decisions involved.
The regulatory perimeter
Three areas deserve particular attention:
- FCA rules and accountability: identify the rules relevant to your regulated activities. Where the Senior Managers & Certification Regime (SM&CR) applies, allocate responsibilities in line with the relevant senior management functions. Using a model or supplier does not remove the firm's own obligations.
- UK GDPR and the Data Protection Act 2018: establish a lawful basis, provide the required information and protect personal data. Check the rules applicable to automated decision-making, including any required safeguards and meaningful human review, for the particular use case.
- Consumer Duty: where the Duty applies, consider the effect of AI on retail customer outcomes and the evidence needed to assess those outcomes.
Applicable rules are binding. The controls below are a practical starting point, not a universal regulatory checklist or a guarantee of compliance. Separate legal obligations, published supervisory guidance and recommended practice when designing your firm's controls. Seek advice on the requirements relevant to your activities.
Practical controls to consider before deployment
- Maintain a use-case register describing each system, its data, the decisions it informs and its accountable owner.
- Assess relevant risks, including bias, explainability, reliability, drift and failure modes.
- Screen each use case for data-protection risk and complete a DPIA before processing where required, including where processing is likely to result in high risk to individuals. The mere involvement of personal data does not automatically require a DPIA.
- Define human review and escalation proportionately to the risks, and implement any safeguards required for the decisions involved.
- Set a retention and deletion schedule appropriate to the data, purpose and applicable obligations.
Where governance gaps can arise
Governance gaps can arise when staff use unapproved tools, pilots process personal data without appropriate assessment, or suppliers are engaged without adequate due diligence. These are examples of risks to check, not a claim about how most financial services firms operate.
The practical starting point
Start with an AI inventory covering each system's purpose, data, owner and risk rating. Map the obligations relevant to each use case, then select controls and evidence proportionately. Review the assessment as systems, suppliers and applicable requirements change.
Quantum & AI Technologies helps firms develop governance documentation and implementation plans. This support does not replace the firm's regulatory responsibilities or tailored legal advice. Book a 30-minute consultation to discuss your firm's position.
Sources
- FCA: AI and the FCA, our approach
- ICO: when a data protection impact assessment is required
- ICO: rights related to automated decision-making, including profiling
Editorial review: 11 October 2026. Requirements and guidance can change; check current sources and obtain advice for your circumstances.