On 19 October the FCA published a set of examples of good and poor practice in how financial services firms use AI. It came out alongside a speech by Jessica Rusu, the FCA’s chief data, information and intelligence officer, at the Bloomberg UK Policy Series.
On paper it’s a document for regulated firms. It creates no new rules. It simply sets out what the FCA saw when it looked at firms using AI this year: what worked, and what didn’t.
That’s exactly why it matters to everyone else. Most growth-stage companies I work with are using AI somewhere in the business. Very few have anyone regulating how. When the board asks “are we doing this properly?”, there’s usually no good answer, because nobody has said what properly looks like. Now a UK regulator has, in plain examples.
What the FCA saw going wrong
The poor practice list reads like a description of most scale-ups. A few stand out.
Governance after the fact. Firms built and launched AI tools, then tried to fit them into existing processes afterwards. By then the key design decisions had been made and nobody could say who owned them. In one case, when problems appeared, several teams each assumed oversight sat with someone else.
Approvals that weren’t really approvals. No formal process to test, challenge and sign off a use case. Different standards for different tools. Control functions barely involved.
Human review as a tick-box. Firms leaned on “a person checks it” as their main control. Over time reviewers stopped challenging and accepted whatever the AI produced. The human in the loop was hiding the problem, not fixing it.
Measuring the model, not the outcome. Monitoring tracked technical metrics instead of whether customers were actually getting the right result.
Taking the vendor’s word for it. Firms accepted supplier assurances without testing them, and built products around a single model with no plan B. One firm had to redesign a product when its chosen model was retired.
No paper trail. Decisions were poorly documented, so nobody could show what risks had been considered or why a tool was signed off.
What good looked like
The good practice is not exotic, and none of it needs a 200-person risk team. The FCA specifically calls out how smaller firms did it.
- Start with the problem. Define the need and who it’s for before deciding AI is the answer. Pilot narrowly before scaling.
- Decide where AI should help, where it should act alone, and where it should step aside and hand over to a person.
- Test outcomes across different groups of users, including people in vulnerable circumstances, not just average accuracy.
- Put a named person in charge of each material use case from the design stage, not after launch.
- Have the board set a risk appetite for AI, then turn it into red, amber and green thresholds with agreed actions at each level.
- Design human review so reviewers have the authority, information and training to push back. One firm had staff assess cases without seeing the AI’s answer first, so they wouldn’t just defer to it.
- Keep a register of every AI tool, who owns it, what it touches and which vendor sits behind it.
- Get notice of vendor model changes written into the contract, and have a tested fallback if a provider fails or a model disappears.
Why this matters if you’re not regulated
Three reasons.
You still carry the legal risk. Data protection law, equality law, consumer protection law and your own contracts all apply to what your AI does. “The vendor’s model did it” is not a defence.
Someone will ask. Investors in due diligence, enterprise customers in procurement questionnaires, acquirers, insurers. “What does your AI governance look like?” is becoming a standard question, and “we’re careful” is not an answer. If you don’t yet know which tools your team is using, start there.
It’s cheapest to get right now. Every failure the FCA describes was harder to fix because governance came second. Building a light framework while you have five AI tools rather than fifty costs a fraction of retrofitting one later.
What proportionate looks like
The useful thing about the FCA’s approach is that it doesn’t push a single model. It talks about scaling oversight to the size of the firm and the risk of each use case, often through the governance you already have.
For a growth-stage company that usually means:
- A register of AI use cases, each with a named owner.
- Simple risk tiers, so low-risk internal tools move fast and customer-facing or decision-making tools get proper scrutiny.
- A short approval step before anything material goes live.
- Outcome-based monitoring with clear triggers to escalate or switch off.
- Vendor due diligence and contract terms that cover model changes and exit.
- A record of what was decided and why.
That’s not bureaucracy. It’s the minimum you need to answer the board, the investor and the customer honestly.
How TEP can help
At The Edwards Practice I work where legal and operations meet, which is exactly where AI governance tends to fall through the gaps. I’ve built a practical framework for growth-stage companies based on the FCA’s examples, scaled for businesses that don’t have a compliance department. We start with a short diagnostic of where you are, then build the register, tiers, approval process and vendor controls that fit how your business actually runs. It sits naturally inside a Fractional General Counsel engagement.
If your board is asking what good looks like, book a discovery call.
Sources
- FCA, “AI in financial services: good practice and areas for improvement” (published 19 October 2026, updated 20 October 2026)
- FCA, “Building the future of finance in the age of AI”, speech by Jessica Rusu at the Bloomberg UK Policy Series (19 October 2026)
This post is general commentary, not legal advice.