Why Consumer Duty is the most important AI compliance framework for UK financial services

The FCA (Financial Conduct Authority) has made its position clear and repeated it consistently: there will be no standalone AI rulebook for UK financial services. Instead, the FCA expects firms to demonstrate that existing governance frameworks, Consumer Duty, the Senior Managers and Certification Regime (SM&CR), SYSC, and operational resilience requirements, already cover AI. Consumer Duty, which came into force for open products and services in July 2023 and extended to closed products and services in July 2024, is the primary framework through which the FCA assesses AI's impact on retail customers.

This matters because Consumer Duty fundamentally changed the regulatory paradigm. Firms can no longer demonstrate compliance by showing they followed a compliant process. They must empirically prove that customers actually experienced good outcomes. When AI is embedded in the customer journey, in pricing, suitability assessment, communications, debt support, or claims, the question becomes: can the firm demonstrate that the AI-assisted outcome was fair, understandable, and in the customer's interest? That is a harder question to answer than whether the AI system was technically compliant.

In January 2026, FCA Executive Director Sheldon Mills launched a long-term review of AI in retail financial services, the most significant FCA initiative in this space since Consumer Duty itself. The review examined how AI use is likely to progress from assistive tools toward advisory and, eventually, more autonomous or agentic systems acting with less direct human involvement. The FCA published the Mills Review on 6 July 2026, setting out seven recommendations to the FCA Board on the regulatory perimeter, supervisory approach, and preparation for more autonomous AI in retail financial services. Firms using advisory or autonomous AI should review these recommendations directly, as they will shape the FCA's approach going forward.

The four Consumer Duty outcomes, how AI creates risk in each

Products and services. AI systems used in product design, suitability assessment, or recommendation must not embed biases that systematically disadvantage any customer segment. Algorithmic bias in credit scoring, investment risk profiling, or product eligibility determination is an active FCA concern. A firm cannot use "the algorithm decided" as a defence, the Consumer Duty obligation to deliver appropriate products to appropriate customers sits with the firm, not the model.

Price and value. AI-driven pricing must deliver fair value. The FCA has been explicit that hyper-personalisation enabled by AI must not result in certain customers paying significantly more for equivalent products, or in effectively uninsurable categories emerging based on algorithmically-assessed risk. Under the Consumer Duty fair value assessment, firms must be able to explain why AI-generated prices represent fair value relative to benefits received. FCA supervisory activity for 2025/26 explicitly lists AI-driven pricing as a focus area, particularly in protection insurance, premium finance, and long-term savings.

Consumer understanding. AI-generated communications, letters, emails, chatbot interactions, automated advice, must be clear, accurate, and appropriate for the customer's situation. The FCA expects firms to test AI-generated communications on real customers, not just assess them internally. Generic disclosures that AI is involved are insufficient; customers must understand how AI affects decisions that matter to them. The FCA and ICO published a joint statement on 27 March 2026 covering vulnerability-related data sharing, including expectations on automated decision-making and profiling under UK GDPR, such as the right to information about automated decisions and to human intervention.

Consumer support. AI-powered customer service, chatbots, automated query resolution, AI triage, must not create barriers that prevent customers from getting the support they need. The FCA is particularly focused on AI's interaction with vulnerable customers: systems optimised for efficiency that fail to identify or appropriately escalate vulnerable customer needs create foreseeable harm that Consumer Duty prohibits. Firms must be able to demonstrate that AI customer support channels meet the same standards as human channels for the outcomes they deliver.

SM&CR accountability for AI, who is personally responsible

The Senior Managers and Certification Regime creates personal accountability for AI at the executive level. The FCA has confirmed that no new AI-specific function will be created; instead, existing SMF roles carry AI accountability. Under SM&CR: SMF24 (Chief Operations) is accountable for ensuring AI systems embedded in operational processes comply with FCA rules; SMF4 (Chief Risk) is accountable for AI risk management; SMF16 (Compliance Oversight) is responsible for ensuring AI systems comply with Consumer Duty, SYSC, and data protection requirements. Where AI systems cause customer harm, the FCA will look to these individuals to demonstrate their oversight was adequate.

Statements of Responsibilities (SoRs) should be reviewed to ensure AI governance is explicitly assigned. Firms that have not clearly allocated AI accountability within their SM&CR framework are exposed, if an AI system causes harm, the absence of clear accountability is itself a governance failure.

What the FCA's AI Lab and supervisory initiatives mean for compliance planning

The FCA AI Lab, launched in late 2024 and expanding through 2026, operates as a testing and engagement environment comprising components including an AI Sprint for policy ideation, an AI Spotlight to showcase real-world deployments, and intensive testing through the Supercharged Sandbox (Cohort 1: 23 firms) and AI Live Testing (Cohort 2 began testing in April 2026). The targeted support framework (PS25/22) has been active since April 2026 for firms developing AI-enabled support in regulated contexts.

For compliance planning: firms that proactively engage with the FCA AI Lab, demonstrate robust Consumer Duty outcomes evidence for AI-assisted decisions, and can show SM&CR accountability is clearly assigned for AI are best positioned. The FCA's 2025/26 supervisory priorities for AI are explicitly: AI touching customer journeys, pricing, underwriting, claims, debt support, and advice journeys must show clear evidence of Consumer Duty-aligned good outcomes; and firms using algorithmic models must ensure governance keeps pace with innovation. TLT's March 2026 analysis of FCA priorities confirms these as the live supervisory focus areas.

Practical compliance steps for FCA-authorised firms

Map every AI system in use to the Consumer Duty outcome it affects and document how you evidence good outcomes from that system. Assign SM&CR accountability for each material AI system in writing. For any AI system used in pricing, conduct a fair value assessment that addresses how AI-generated prices represent fair value. For AI-generated customer communications, conduct consumer testing before deployment, not just internal review. For AI customer support channels, implement monitoring that detects where vulnerable customers are failing to receive appropriate support. Review the Mills Review recommendations, published in July 2026, and monitor for any resulting FCA consultation; firms using advisory or autonomous AI should monitor this closely.

Related reading

Further reading: ICO AI guidance