FCA Sets Expectations for AI: What Do “Reasonable Steps” Look Like for Senior Managers?

The Financial Conduct Authority’s latest publication on artificial intelligence provides its clearest indication yet of what it expects from firms, and their senior managers, when AI is deployed in financial services.  

The FCA has not created new AI-specific rules. Instead, its examples of good practice and areas for improvement explain how existing requirements apply in practice. 

For senior managers in particular, the publication begins to answer an important question: what might “reasonable steps” look like when AI is increasingly embedded in the businesses for which they are responsible? 

No New AI Rulebook

The starting point remains familiar. Existing regulatory requirements apply to AI, including the Principles for Businesses, SYSC, the Consumer Duty, operational resilience requirements and the Senior Managers and Certification Regime. 

The FCA expressly says that its examples do not create new requirements or prescribe a single governance model.  

That is consistent with the Mills Review, which concluded that the UK's principles-based, outcomes-focused framework provides a credible foundation for AI-enabled financial services. The Mills Review nevertheless identified an important qualification: as AI moves from assisting humans towards greater autonomy, applying existing accountability requirements becomes more complex. 

What Does This Mean for Senior Managers?

This is where the FCA's latest publication is particularly useful.

The FCA does not expect senior managers to become technical AI specialists. It does, however, expect them to take reasonable steps to understand AI risks within their areas of responsibility, obtain appropriate information and expertise, provide effective oversight and challenge, and ensure that governance, controls and escalation arrangements remain appropriate.

Its examples put considerably more flesh on those principles. Good practice includes:

• mapping AI risks across Senior Management Functions (SMFs) and establishing clear accountability;
• allocating accountability from the design stage of an AI use case, rather than retrospectively;
• giving SMFs appropriate information and maintaining auditable records of decisions, challenge and escalation;
• establishing clear, threshold-based escalation routes; and
• providing targeted AI training to senior managers. 

One of the FCA’s case studies (“L”) describes how one firm assigned ultimate accountability for an AI tool to the SMF responsible for the business area in which the tool operated, while a separate model owner was responsible for the technical build. A governance process documented both roles. 

That example supports the view that AI is not necessarily a discrete business area to be placed wholesale under one specialist SMF. Responsibility may more naturally follow the underlying business activity and its risks. 

Governance Cannot Be a Paper Exercise

The FCA's examples also illustrate what may make it difficult for an SMF to demonstrate reasonable steps.

Poor practice includes delegating AI development entirely to technical teams without sufficient understanding or challenge; failing to connect identified risks with SMF accountability; and keeping inadequate records of how risks were assessed and mitigated.  

Nor is simply putting a human “in the loop” sufficient. The FCA warns against human review becoming a box-ticking exercise and says effective oversight requires the reviewer to have the authority, information, and capability to challenge or intervene.

A familiar theme is the emphasis on evidence: defined ownership, documented challenge, testing, monitoring, thresholds, escalation and records showing how oversight actually operated.

What Should Firms Take Away?

The FCA has stopped short of introducing an AI-specific accountability regime. But it has now provided a clearer supervisory benchmark against which existing governance and individual accountability may be assessed.

For firms, an important, practical question is whether the relevant SMFs can demonstrate that they understood the material risks, asked the right questions, received appropriate information, challenged where necessary, and ensured that controls continued to operate as the technology evolved.  

That may prove increasingly important as AI systems become more autonomous. As the Mills Review put it, accountability remains clear as autonomy increases but becomes harder to exercise.