There's no FCA rulebook for AI. The rules you already follow cover it

"We do not plan to introduce extra regulations for AI. Instead, we'll rely on existing frameworks, which mitigate many of the risks associated with AI." That's the FCA's position, in its own words, on its page setting out its approach to AI (FCA, AI and the FCA: our approach, last updated 13 February 2026).

That doesn't mean AI use goes unregulated. The FCA describes its approach as "principles-based and focused on outcomes", and it points firms to the frameworks they already have. Its 2024 AI Update sets out how existing rules apply to AI, and the approach page gives two examples: the Consumer Duty, and the rules on accountability and governance, including the Senior Managers and Certification Regime.

For a directly authorised firm with a handful of advisers, the practical question is what that means for the AI tools already arriving in the office.

Where AI is turning up in advice firms

In most advice firms, AI arrives as a feature of software the firm already uses, or as a tool someone starts using on their own: a note-taker that joins client meetings and writes up the notes, a back-office platform that offers to draft review letters, a paraplanner using a chatbot to summarise product literature.

Each of these touches something the FCA already cares about. Meeting notes feed into suitability, review letters are client communications, and a product summary can be wrong or out of date.

How do the FCA's existing rules apply to AI?

Through the Consumer Duty and the senior managers regime. Client communications produced with AI must still meet customers' information needs and be accurate, and a named senior manager should own how the firm uses AI. UK GDPR adds a written processor contract, clarity on where data is stored and, in some cases, a data protection impact assessment.

Under the Consumer Duty, the FCA's approach page says firms must design products and services that meet their target customers' needs and provide fair value, communicate in a way that meets customers' information needs, and provide support that meets those needs. An AI-drafted review letter that reads well but gets a charge or an allowance wrong falls short of that, however it was produced.

On accountability, the page says the FCA's rules "emphasise accountability for senior managers and are relevant to the safe use of AI". In practice, someone senior should own how the firm uses AI, in the same way someone owns compliance or operations. If you were asked who approved your meeting note-taker, there should be a name and a record.

Data protection sits alongside both. Before client information goes into an AI tool, UK GDPR expects a written contract with the provider as a processor, clarity on where the data is stored, and in some cases a data protection impact assessment. It's also worth knowing whether the provider uses your data to train its models.

What does an advice firm need in place for AI?

Five things: a named senior manager responsible for AI under SM&CR, an approved tools register, a short AI policy that keeps suitability, charges and recommendations under an adviser's sign-off, a line in your client agreement with a conversation before any AI note-taker joins a meeting, and a light log of AI use on client work.

1. 01A named senior manager responsible for AI, recorded as part of your SM&CR arrangements.
2. 02An approved tools register. Every AI tool and feature the firm uses, what it's approved for, and whether it's approved for client data after checking the provider's terms.
3. 03A short AI policy. Approved tools only, no client data in anything unapproved, and nothing that relates to suitability, charges or recommendations goes to a client without an adviser's review and sign-off.
4. 04A clear line in your client agreement explaining how you use AI, and a conversation with clients before an AI note-taker joins a meeting.
5. 05A light log of AI use on client work, so your file shows who checked what.

What should an advice firm do about AI this month?

List every AI feature switched on across your back office, planning and meeting tools, decide which senior manager owns AI and write it down, check your note-taker's data terms, and add a sentence to your client agreement, asking clients before you record a meeting.

• List every AI feature switched on in your back office, planning and meeting tools, including any your suppliers have added recently.
• Decide which senior manager owns AI, and write it down.
• Check your note-taker's data terms: where recordings go, how long they're kept, and whether they're used for training.
• Add a sentence to your client agreement, and start asking clients before recording.

My AI governance kit for financial advice firms has the policy, register, client wording and a supplier checklist, mapped to the FCA's approach. If you'd rather I set it up with your team, that's the team AI rollout.

Sources

1. 01FCA, AI and the FCA: our approach, first published 8 September 2025, last updated 13 February 2026. fca.org.uk/firms/innovation/ai-approach
2. 02FCA, AI Update, 2024. fca.org.uk/publication/corporate/ai-update.pdf
3. 03ICO, guidance on AI and data protection. ico.org.uk

This article is general information, not financial, legal or regulatory advice. Check the FCA's current guidance and speak to your compliance adviser about your firm.