There is no separate FCA rulebook for artificial intelligence, and firms keep waiting for one. The regulator's position has been consistent: existing rules already cover it. That is more demanding than a new rulebook would be, because it means AI has to satisfy obligations written without it in mind.
This is the engineering reading of those obligations — what they mean for what you actually build. Your compliance officer owns the interpretation; we build the systems that can answer them.
Accountability has a name on it
Under the Senior Managers regime, responsibility sits with a person, not a system. "The model decided" is not available as an answer. Somebody is accountable for the outcome, which means they need to be able to see what the system did and why.
What that requires in the build: every automated decision recorded with its inputs, the model version, the output and what happened next. If a senior manager cannot reconstruct a decision, they cannot be accountable for it in any meaningful sense.
Consumer Duty needs evidence, not intent
Consumer Duty asks firms to demonstrate good outcomes for customers, and demonstrate is the operative word. It is a standard of proof, not of intention.
What that requires: the ability to show how a system treated customers across a population, not one example. If your AI prices, ranks, prioritises or communicates, you need to be able to answer "did this disadvantage anyone systematically" with data rather than assurance.
A model vendor is an outsourcing arrangement
Calling a third-party model API is a dependency on an external provider. The existing expectations around outsourcing and third-party risk apply: you should understand what happens if it degrades, changes behaviour or disappears.
What that requires: a documented fallback, monitoring that would notice a change in output quality, and a record of which model version was in use when — because providers update models, and behaviour moves with them.
Operational resilience means degrading, not collapsing
Resilience expectations focus on important business services staying within tolerance during disruption. An AI component sitting in the path of one of those services is in scope.
What that requires: a defined behaviour when the model is unavailable or slow. Failing to a human queue is a legitimate answer. Failing silently is not.
The gap in most builds
None of the above is about model quality. Every one is about evidence — what the system did, what changed, who reviewed it, what happens when it breaks. That is the layer AI tooling never generates, because the tools do not know the questions exist.
It is also the layer that is expensive to retrofit. Audit trails and access boundaries are architecture decisions, not features: they are made on day one whether or not anyone notices making them.
We build that layer in from the first commit for FCA-regulated and compliance-heavy firms. If you are not sure where your current systems stand, a Reality Check is a week and a fixed fee to find out.
This is the part we do — the crossing from a demo to a system that survives production.