AI you can explain to the regulator.
Governance for the AI your firm already uses: an inventory, materiality ratings, monitoring after deployment as well as before, oversight of third-party AI, and the Consumer Duty and SM&CR evidence the FCA will ask for.
What the 2026 survey found
- 86% of respondents to the Bank of England and FCA's 2026 survey use AI, and 80% have AI agents deployed 54
- 94% have firmwide AI policies, but ongoing monitoring, leakage testing and periodic review are each reported by only around half 54
- Third-party systems are 53% of high-materiality AI; for those, 81% of respondents rely on vendor assurance and contracts 54
- Applying model risk management to vendor models was the most-cited governance challenge, selected by 54% 54
- 73% of small firms use AI, so this is not only a question for large firms 54
The rules that already apply
The FCA's good and poor practice on AI, published on 19 October 2026, says it does not create new requirements 48. The existing rules carry the weight: outcomes monitoring that can identify whether any group of customers is doing worse (PRIN 2A.9.10R), communications that customers understand (PRIN 2A.5.10R), robust governance with clear lines of responsibility (SYSC 4.1.1R), operational resilience (SYSC 15A), and a senior manager taking reasonable steps to ensure the business is controlled effectively (COCON 2.2.1R). Data protection law applies alongside them.
What we deliver
- An AI inventory, including the AI inside third-party software, with a materiality rating for each system
- Policy, governance forum terms of reference and an approval route proportionate to your size
- Monitoring after deployment: outcomes by customer group, accuracy and drift, leakage and prompt-injection testing, periodic recertification
- Third-party AI due diligence, contract terms that give you the information to explain an outcome, and exit plans
- Controls for AI agents: where a person approves, what an agent may never do, and the log of what it did
- SM&CR mapping: which senior manager owns each material system, and their reasonable-steps record
- The AI section of your Consumer Duty board report, and training for the people who use the tools
We build with AI too
Our Handbook assistant cites only references that exist and checks that each quote appears in the provision it cites. Guardian never says a rule was broken: it records a potential control failure for a person to review. We apply to our own software the controls we recommend to yours. See the Handbook assistant.
Our voice agents work the same way: the AI holds the conversation, but every answer it records and every promise it makes is checked on our server first. See the voice agents.
Software that fits
Questions
Short answers, with the provision each one rests on.
Are there new FCA rules for AI?
No. The FCA's good and poor practice on AI in financial services, published on 19 October 2026, states that it does not create new requirements. The Consumer Duty, SM&CR, systems and controls and operational resilience rules apply to AI as to any other way of running the business.
What did the Bank of England and FCA's 2026 AI survey find?
Among 196 respondents, 86% use AI and 80% have AI agents deployed. Controls before deployment are near-universal, but ongoing monitoring, leakage testing and periodic review are each reported by only around half. Third-party systems account for 53% of high-materiality AI.
Who is accountable for AI in an SM&CR firm?
The senior manager responsible for the part of the business where the AI is used. The senior manager conduct rule in COCON 2.2.1R requires them to take reasonable steps to ensure that business is controlled effectively, and that includes the AI it relies on.
Talk to someone who has done your job.
A 30-minute call, no deck. Bring the problem; we will tell you what we would do.