FCA AI guidance: what the good practice paper means for lenders

The FCA published the paper on 19 October 2026, with an editorial amendment on 20 October. It draws on supervisory work, industry engagement, AI Live Testing, the Supercharged Sandbox and work on the Mills Review.

The FCA is clear that the examples "do not create new requirements". The tests stay where they were: PRIN and SYSC for safety and controls, the Consumer Duty and the vulnerable customer guidance for fairness, SM&CR for accountability, and DISP for complaints and redress.

The scope is wide. The paper applies to AI "developed in-house, supplied by a third party, embedded in another system or used by staff to support decision making". For a lender, that includes a scoring or document-reading feature inside a loan origination system, not only models the firm builds itself.

Several of the case studies are lending cases:

• Affordability. One firm used AI for affordability assessments while staff made the decisions. Reviewers assessed each case without seeing the AI's proposed outcome, so the firm could compare human and AI judgements and reduce automatic deference.
• Credit acceptance. One firm used an LLM tool to help consumers understand whether they might be accepted for credit, with clear explainers on what the tool could and could not do and a route to a member of staff.
• Vulnerability in spending data. One firm's AI found spending patterns that pointed to possible vulnerability. Its ethics committee decided whether to keep lending in those circumstances, then the firm refined its models.

The poor practice is just as relevant. Some firms excluded customers with vulnerability indicators from AI journeys by default. The FCA says this "could unfairly exclude those consumers" unless the firm gives them another route to support.

Many lenders treat a human underwriter or case checker as the control on AI. The paper questions that. It lists "excessive reliance on human-in-the-loop controls" as an area for improvement and says human review "may mask weaknesses in the model".

In one firm, the reviewer role "became a tick-box exercise over time". Reviewers accepted AI recommendations with less scrutiny, and unclear escalation criteria let some low-confidence outputs proceed.

The good practice is specific. One small firm recorded whether staff needed to review AI outputs, whether they did, and whether they approved, overrode or escalated. The FCA says this created an audit trail "rather than relying on an assumed control".

For underwriting and case checks, that is the test. If a regulator or the Financial Ombudsman asks how AI shaped a decision on a case, the file needs to show what the AI flagged, what the reviewer did with it and why.

The FCA does not expect senior managers to be technical specialists. It does expect them to take reasonable steps to understand the risks from AI in their area and to give effective oversight and challenge.

Good practice in the paper includes:

• Accountability assigned at the design stage, with the SMF for the business area accountable and a separate model owner for the technical build.
• Red, amber and green performance thresholds agreed between the business and model risk teams, with set actions when a tool moves into amber or red.
• Auditable records of decisions, "including rationale, challenge, and escalation".
• A central inventory of AI agents showing which are live, who owns them and what data they can reach.

The poor practice mirrors it: decisions with "limited audit trails or supporting rationale", governance designed after deployment, and senior managers who delegated AI entirely to technical teams.

Buying AI does not move the responsibility. The FCA says firms "can outsource AI services, but remain responsible for them". It criticises "overreliance on untested vendor assurances" and single-provider set-ups with no exit plan.

Good practice includes AI-specific questions in supplier assessments, contract terms that give notice of significant model changes, and tested fallback plans. Firms in scope of SYSC 15A also need to map AI dependencies into their operational resilience planning.

A lender can test itself against the paper with six questions:

1. Do we have a list of every AI use in underwriting, case checks and customer contact, including AI inside vendor systems?
2. Does each use have a named senior owner, agreed from the design stage?
3. For each case an AI touched, can we show what it flagged and whether a person reviewed, approved, overrode or escalated it?
4. Do we measure whether reviewers challenge the AI, or only whether they signed off?
5. Do we have thresholds that trigger escalation, and a record of when they fired?
6. Have we tested what our vendors told us, and do we get notice when their models change?

If you are assessing AI file-checking tools, including Curvestone's, these questions are a fair test to put to any vendor.