Financial Conduct Authority and AI in the UK

The FCA has stated its approach to AI is principles-based, working within existing regulatory frameworks rather than creating new AI-specific rules. For fintech firms running AI on dedicated UK hosting, the expectations look like familiar governance with AI-specific detail added.

Contents

• Senior Managers Regime
• Outsourcing rules
• Consumer duty
• Operational resilience

Senior Managers Regime

AI systems used for regulated activities need an accountable senior manager. Document who owns the AI outcome and how oversight works. Model cards, decision logs, and audit trails support this.

Outsourcing

FCA’s outsourcing rules treat critical third-party dependencies with specific requirements around exit plans, due diligence, and monitoring. Dedicated hosting providers are generally lower-risk outsourcing than hyperscale cloud because:

• Clearer contractual scope
• Single provider relationship, not a chain of sub-processors
• Exit is straightforward (lift model weights, redeploy elsewhere)

Consumer Duty

Consumer Duty obliges firms to deliver good customer outcomes. For AI decisions affecting customers (credit, pricing, access), demonstrate the model’s fairness, robustness, and explainability. Dedicated model hosting supports this because you fix the model version while investigating or improving it.

Operational Resilience

Firms must identify important business services and their dependencies, set impact tolerances, and demonstrate ability to remain within them during disruption. AI inference that supports a regulated service is a dependency. Dedicated hosting with clear SLAs is easier to map to operational resilience requirements than elastic cloud with many sub-processors.

See PCI DSS compliance and UK AI Act.