On 19 October 2026 the FCA published its long-awaited “good practice and areas for improvement” guidance on AI in financial services, based on themes and developing practices observed by the FCA during industry engagement, supervisory work, and the FCA’s AI Lab initiatives.
The guidance is substantial and is the clearest indication yet of what the FCA thinks firms can do to stay on the right side of existing rules as they apply to AI. There is useful detail for private markets and alternatives firms, including on how firms demonstrate good AI governance and accountability and operational resilience. There is also detail on the Consumer Duty, specific guidance on proportionality for smaller firms, 20 brief case studies, and an “AI jargon buster”.
We have seen private markets and alternatives firms taking steps into AI implementation in their businesses, with use cases ranging from general productivity enhancement, to automated IC minute-taking and assisting in diligence. In many cases adoption is ad hoc or bottom-up. For example, an analyst discovering a new tool or use case, or a third party introducing an AI add-on to its platform. Often governance and controls have to catch up.
The key takeaway for private markets and alternatives firms from yesterday’s guidance is that the FCA expects:
- Robust governance and clear accountability throughout the AI lifecycle (from initial scoping onwards), with defined ownership, and effective oversight and controls.
- Planning for when things go wrong, including taking steps to mitigate risks from cyber threats and proactively managing third-party relationships.
The FCA stresses in the guidance that the examples it gives are illustrative and non-exhaustive, and it is for firms to consider what is appropriate and proportionate for their own AI use cases and risks. So while we have clarity on what “good” can look like, firms will have to put a good deal of thought into their own circumstances to work out what “good” looks like for them.
Below is a run-down of what the guidance actually says.
GOVERNANCE AND ACCOUNTABILITY – WHAT GOOD CAN LOOK LIKE AND WHEN FIRMS SHOULD DO MORE
Firms with good AI governance and accountability in the FCA’s examples had:
- Formal, but proportionate, risk-based governance throughout the AI lifecycle. This should be well documented and run from initial scoping to decommissioning, with structured testing before deployment.
- Senior managers who are clearly accountable for AI systems. They do not need to be technical experts, but they need to understand the firm’s AI use cases sufficiently to be able to take reasonable steps to mitigate risks, provide effective oversight and challenge, and ensure that governance is documented and remains appropriate.
- Clearly defined human oversight and escalation routes, designed around the specific use case and risks, with “human-in-the-loop” controls and thought given to when AI outputs should be challenged or overridden.
- Ongoing monitoring, which adapts to evolving risks such as model drift, involves different parts of the business where necessary, and provides sufficient MI for boards to oversee AI use.
SIGNS THAT A FIRM SHOULD DO MORE ON AI GOVERNANCE AND ACCOUNTABILITY
The FCA lists a number of areas for improvement. These will be a wake-up call to compliance officers at firms where AI has outpaced governance:
- Retrospective governance, i.e. designing and deploying AI use cases without first considering how to govern them.
- Poor documentation of decisions on AI, with limited audit trails or supporting rationale; delegating responsibility without sufficient challenge.
- Unclear responsibility for AI systems, including fragmented or overly diffused ownership, leading to ineffective and inconsistent controls.
- Informal approval processes and generic or siloed AI governance, including insufficient involvement from control functions.
- Oversight functions lacking AI-specific capability, or a lack of meaningful oversight, i.e. human review of AI outputs being a “box-ticking” exercise.
- Undefined risk appetite and thresholds, limiting firms’ ability to judge acceptable outcomes.
OPERATIONAL RESILIENCE OBSERVATIONS
The FCA notes common approaches among firms it considered to be deploying AI safely and responsibly from an operational resilience perspective, including:
- Adopting AI systems and architecture that reflect the sensitivity and security requirements of their use cases.
- Recognising dependencies on AI models and integrating them into firms’ operational resilience planning (where applicable).
- Taking steps to mitigate cyber threat risks and the risk of becoming overly dependent on a specific AI model or third party.
- Proactively managing third-party relationships to ensure firms can plan for model updates or changes in products.
Areas for improvement included:
- Failure to consider AI from an operational resilience perspective.
- Overreliance on untested vendor assurances.
- Overreliance on hard-to-replace AI providers or single platforms.
The FCA also notes the potential impact that AI, particularly frontier models, could have on cyber security more broadly and reminds firms of its previous joint statement with the Bank of England and HM Treasury and its multi-firm review on this topic.
A NOTE ON THE CONSUMER DUTY
For firms subject to the Consumer Duty, the FCA stresses that consumers should see the benefit of AI adoption and that, where firms are deploying AI-supported tools, they remain responsible for consumer outcomes.
The FCA notes good practice including:
- Defining the consumer need and target market before designing and deploying AI-supported products and services.
- Testing consumer outcomes across different consumer characteristics and scenarios.
- Using proportionate controls to manage AI bias and accuracy, and to ensure that decisions can be explained.
- Telling consumers how they have used AI, and its limits, and testing their understanding where appropriate.
- Monitoring live outcomes so firms can spot and deal with issues quickly.
SO WHAT DO FIRMS NEED TO DO?
Firms should take careful note of the guidance, consider what “good” looks like for them, and run the governance processes and keep the records to demonstrate it. For many private markets and alternatives firms, AI governance and resilience will need to catch up, and then keep up, with AI use.
HOW CAN COSEGIC HELP?
We support firms with reviews of their AI governance arrangements to help ensure compliance is keeping pace with AI change.
To discuss the FCA’s findings or how Cosegic can help, contact us below.
