AI is no longer optional in UK financial services. Firms are deploying large language models for client communication, document review, risk modelling and internal operations. Regulators have made clear that existing obligations apply to these systems, and that governance should precede deployment rather than follow it.
The regulatory perimeter
Three frameworks shape AI governance for UK-regulated firms:
- FCA principles and the Senior Managers & Certification Regime (SM&CR): accountability for AI outcomes sits with named senior managers. Firms cannot deflect responsibility to a model or a vendor. (fca.org.uk)
- UK GDPR and the Data Protection Act 2018: automated decisions affecting individuals require lawful basis, transparency, and, in some cases, human review. (ico.org.uk)
- The FCA's Consumer Duty: firms must show that AI-driven decisions deliver fair outcomes for retail customers, not just compliant processes.
These are legal requirements, not optional good practice. The controls below describe how to meet them; the specific form they take depends on your firm's regulated activities and the systems you deploy.
What regulators expect before deployment
Before an AI system touches customer data or client work, regulators expect to see documented controls. A defensible governance baseline includes:
- A use-case register mapping each system to the data it processes, the decisions it informs, and the senior manager accountable for it.
- A model risk assessment covering bias, drift, explainability and failure modes.
- A data protection impact assessment where personal data is involved.
- Human-in-the-loop checkpoints for any decision with material customer impact.
- A retention and deletion schedule aligned to the firm's data governance policy.
Why most firms are not ready
Most financial services firms have AI activity but not AI governance. Staff are using consumer tools with no policy. Pilots run on live data with no risk assessment. Procurement signs off on vendor models with no due diligence on training data. The gap between what regulators expect and what exists on the ground is where enforcement risk concentrates.
The practical starting point
Governance does not have to be a multi-year programme. A focused first step is a firm-wide AI inventory: every system, its purpose, its data, its owner and its risk rating. From there, controls follow the risk. The objective is not to slow adoption. It is to make adoption defensible.
Quantum & AI Technologies helps regulated firms build this baseline: a governance framework aligned to FCA, ICO and board expectations, and a deployment plan that carries it into live systems. Book a 30-minute consultation to discuss your firm's position.