The Financial Conduct Authority (FCA) published its first detailed paper on artificial intelligence in financial services on October 5, drawing on supervisory work, its AI Lab, and direct industry engagement to map both good practice and the gaps that leave firms exposed under existing rules. AI deployment across UK insurance is running well ahead of the governance structures meant to oversee it.
In February 2026, the FCA published its first Regulatory Priorities report for insurance, naming AI use in underwriting, claims, and consumer services as a formal area of supervisory focus, and separately expanding oversight of delegated authority models and outsourced claims arrangements for the first time. It has confirmed it will not write AI-specific rules, relying instead on the Consumer Duty, the Senior Managers and Certification Regime (SM&CR), and SYSC governance requirements to hold firms accountable. The October paper is, in effect, the first published account of how that framework is working in practice.
That framework extends across the distribution chain. The FCA’s oversight of delegated authority models and remuneration arrangements, running through to early 2027, covers AI use in underwriting and claims across the MGA sector. Under the Consumer Duty, firms remain responsible for outcomes delivered through any products, services, or support, including where those functions sit with an MGA.
The FCA identifies a consistent pattern in how governance failures occur. Firms design and deploy AI systems without first establishing accountability structures, then attempt to retrofit governance after key decisions have already been made. When risks emerge, the paper notes, multiple teams assume responsibility sits elsewhere and there is no clear escalation route. Human-in-the-loop controls, designed to provide meaningful oversight of AI outputs, have in some firms become a tick-box exercise, with reviewers accepting AI-generated recommendations without scrutiny.
The FCA is also critical of monitoring that focuses on technical model metrics rather than real-world consumer outcomes. Firms that only track whether a model is performing as designed may not detect harm until it has already occurred. On transparency, some firms were found to have overstated the accuracy or reliability of their AI systems, or left consumers unclear whether a decision had been made by a person or a machine.
These findings sit alongside a broader accountability problem. The FCA says senior managers in some firms delegated AI development entirely to technical teams, without adequate challenge or documented rationale. Under the SM&CR, a named senior manager remains personally accountable for business areas in which AI operates. Poor documentation of AI decisions limits a senior manager’s ability to demonstrate they took reasonable steps to manage risk, which is the statutory test under the regime’s duty of responsibility.
The paper’s good-practice examples include structured pre-deployment challenge panels, clear escalation routes tied to risk thresholds, and ethics committees deciding how AI-flagged vulnerability data should be used. These point toward what the FCA expects to see documented.
Firms that cannot produce that audit trail will find it difficult to demonstrate compliance if a Consumer Duty investigation follows. Fewer than half of businesses have adopted a formal AI risk management framework, according to Gallagher’s 2026 AI Adoption and Risk Benchmarking survey of more than 1,200 global businesses, a gap the FCA’s supervisory programme is now actively probing.
Cormac Bradley, senior actuarial director at Broadstone, said the paper underlines that accountability cannot be treated as an afterthought. “AI governance will have to distinguish between these use cases and introduce appropriate controls and risk management for each,” he said.
The FCA is also signalling what comes next. The Mills Review, published in July 2026, put an AI-enabled agentic supervisory model among seven priority recommendations for the FCA Board to consider, though the board has not yet confirmed which it will implement. The good-practice paper’s emphasis on auditable records and documented escalation decisions reads, in that context, less like guidance and more like preparation for what more intensive supervision will require.
