FCA Intensifies Scrutiny on AI Governance in Financial Services, Emphasizing Explainability and Accountability

The Financial Conduct Authority (FCA) in the UK has released a set of observations regarding the use of artificial intelligence within financial services, providing insights into both good and poor practices. While the FCA has explicitly stated it is not introducing a new, dedicated AI rulebook or mandating a single operating model, its publication serves as a clear supervisory message to buy-side firms with UK-regulated activities. The core of the FCA's stance is that existing expectations around governance, accountability, resilience, and consumer outcomes will be applied directly to AI applications. This means firms must be able to explain the function and purpose of any AI tool, identify its ownership, and demonstrate how its associated risks are controlled. This development is significant because it moves the conversation beyond abstract AI principles into concrete, actionable governance requirements. For practitioners, it means that the onus is now firmly on them to embed explainability and accountability into their AI development and deployment lifecycles. The implications extend across the entire AI lifecycle, from initial design and pilot phases through to ongoing monitoring, intervention, change management, and eventual retirement of AI systems. The FCA's observations effectively provide a preview of the questions supervisors will ask, compelling businesses to proactively identify AI use cases, assess their impact, apply proportionate controls, and adapt to changes in AI tools or providers. This move by the FCA aligns with a broader, well-established trend in AI governance, where regulatory bodies globally are shifting from aspirational guidelines to enforceable standards. We've seen similar movements with the EU AI Act, which classifies certain AI systems as “high-risk” and imposes stringent requirements, and the NIST AI Risk Management Framework in the US, which provides a comprehensive approach to managing AI risks. The increasing focus on demonstrable compliance is also evident in new standards like EN 18286:2026, which provides a harmonized standard for quality management under the EU AI Act, granting a presumption of conformity for high-risk AI systems. This collective push emphasizes that AI governance is no longer an optional add-on but a fundamental component of responsible AI adoption, driven by rising concerns over data breaches, regulatory exposure, and the need for trust in AI systems. In practice, this means that DevOps and AI teams within financial institutions must prioritize the integration of governance into their CI/CD pipelines and operational practices. This includes implementing robust documentation for AI models, establishing clear ownership and decision rights for AI-driven processes, and developing mechanisms for continuous monitoring and auditing of AI system performance and outputs. Firms should be prepared to demonstrate cross-functional challenge and formal sign-off before AI deployment, ensuring that reviewers have the necessary information, authority, and time to pause, override, or escalate issues. Furthermore, given the increasing scrutiny, organizations should proactively review their risk frameworks to ensure they are adequate for an AI-driven world, especially concerning areas like mandate breaches, style drift in investment, valuation reliability, and the potential for increased human intervention due to AI. The expectation is that organizations will treat AI governance as an integral part of overall business risk management, establishing what has happened in the event of a malfunction and preventing further harm.