Why the FCA Is Regulating AI Without an AI Rulebook

The FCA's position is that you don't need a new rulebook to regulate a new technology when your existing rules already ask what the technology does to people and markets, and it is applying that position to AI in UK financial services.

Executive Summary

• The FCA says AI has been propelled to the forefront of agendas across the economy at extraordinary speed in the two years since its Discussion Paper on AI.
• Its approach rests on being technology-agnostic, principles-based and outcomes-focused, and on proportionality.
• It says many AI-related risks can be mitigated within existing legislative and regulatory frameworks.
• The complexity of AI models may require a greater focus on testing, validation and explainability, and the FCA is considering how best to address these issues.
• It supports innovation through its Regulatory Sandbox, Digital Sandbox and TechSprints, and has invested in data and digital capability.
• The Government's five principles for AI regulation sit alongside the FCA's own outcomes-based approach.

Two years from discussion paper to the top of the agenda #

The FCA opens its account of AI with a statement about pace. In the two years since it published its Discussion Paper on AI, it notes, AI has been propelled to the forefront of agendas across the economy at extraordinary speed. That is a regulator describing how quickly the ground has moved under a paper it wrote itself.

The Discussion Paper was published jointly with the Bank of England. The FCA lists it, the AI Discussion Paper (2022), among the documents the two bodies have put out. The others are the Feedback Statement (2023), the AI Public-Private Forum Final Report (2022), and the 2019 and 2022 machine learning surveys. In the Discussion Paper, the FCA explored the potential benefits and risks of using AI in financial services in the context of its statutory objectives. It has published a number of documents on its approach to AI, and that body of work is the foundation for the position it now states.

The FCA also says financial services are already at the forefront of digitisation, and that AI could significantly transform the way firms serve their customers and clients in both retail and wholesale markets. The verb matters. The FCA says "could", not "will". The transformation is a possibility it takes seriously rather than a result it claims to have observed across the sector.

Where it does claim an observed result, it's about its own work. The FCA states that AI has already transformed the speed with which it can monitor and tackle scam websites, money laundering and sanctions breaches. A regulator that says this is also a user of the technology, which shapes how credible its stance on firms' use of AI is likely to be.

The case for regulating outcomes instead of tools #

The FCA describes itself as a technology-agnostic, principles-based and outcomes-focused regulator. Each of those three words does work in how it treats AI.

Technology-agnostic is the plainest. The FCA's rules, regulations and core principles do not usually mandate or prohibit specific technologies. There's no list of approved models or banned techniques. Its regulatory approach is, in its own words, to identify and mitigate risks to its objectives, including those arising from regulated firms' reliance on different technologies. The technology is a source of risk to be assessed, not a category to be licensed.

When the FCA considers a firm's use of a given technology, it objectively assesses the risks and any adverse implications for its objectives and the regulatory outcomes it is seeking. The assessment starts from the objectives and works outward to the technology. It doesn't start from the technology and ask whether a rule exists for it.

The FCA is explicit about why it prefers this. Outcomes-based regulation, it says, can be applied more easily to technological change and market developments than detailed and prescriptive rules. It adds that, as a result, consumers are better protected from new and emerging harms. The argument is practical. A detailed rule written for one generation of technology has to be rewritten when the next arrives, whereas an outcome such as appropriate consumer protection doesn't change with the tooling.

That's a defensible position, and it's the right one for a fast-moving technology. It doesn't make the regulator's job easy, though. An outcomes-focused regulator can't tell a firm in advance which model architecture will pass. It can only tell the firm what it will be held to, and then scrutinise the result. The FCA says as much about its supervisory posture: its scrutiny includes the systems and processes firms have in place to ensure its regulatory expectations are met. For a firm deploying AI, the question the FCA puts is whether the firm can show that its systems and processes deliver the expected outcomes.

The approach also has support from the industry. Respondents to the AI Discussion Paper are generally supportive of a technology-agnostic, principles-based and outcomes-focused approach to regulating the use of AI in UK financial services. The FCA reports that support plainly. A regulator that chose this approach and then found the market hostile would be in a harder position. Here, by its own account, the consultation pointed the same way as its existing instincts.

Proportionality as a brake on over-regulation #

The FCA's objectives frame everything it says about AI, so they're worth setting out. The FCA regulates financial services firms and financial markets in the UK. Its strategic objective is to ensure relevant markets function well. It has three operational objectives: to secure an appropriate degree of protection for consumers, to protect and enhance the integrity of the UK financial system, and to promote effective competition in the interests of consumers.

It also has a secondary objective: to facilitate the international competitiveness of the UK economy and its growth in the medium to long term, subject to alignment with international standards. And it states that, as a financial services regulator, it has an important role in the continued success and competitiveness of the UK financial services markets.

That list matters because it shows the FCA isn't only a risk-minimising body. Two of its stated aims, effective competition and the competitiveness of the UK economy, push towards enabling firms rather than constraining them. The FCA sees beneficial innovation as a vital component of effective competition. Any AI policy it writes has to answer to both sets of objectives at once.

Proportionality is how it reconciles them. The principle of proportionality informs the FCA's thinking and approach to AI, including any potential future regulatory interventions. The phrase "potential future regulatory interventions" is worth noting. The FCA doesn't rule out further intervention, and it commits in advance to a test any such intervention would face. Under FSMA, the FCA must have regard to the principle that a burden or restriction imposed on a person or activity should be proportionate to the expected benefits.

The FCA's response also describes the kind of evidence it wants to rely on. It sets out that an evidence-based view balancing the benefits and risks of AI will ensure a proportionate and effective approach to the use of AI in financial services. The claim is hedged, as it should be: the view is expected to produce that outcome, and it hasn't yet been shown to. The FCA is describing a method, not reporting a result.

To build that evidence base, the FCA says it will prioritise understanding current deployment strategies within the firms it regulates. This will include a third edition of its machine learning survey, published jointly with the Bank of England. That survey is a forward commitment, not a finished piece of work. It tells firms where the next round of evidence is likely to come from.

Most AI risks aren't new, and that's the point #

One of the FCA's most consequential statements is also one of its shortest. Many risks related to AI are not necessarily unique to AI itself and can therefore be mitigated within existing legislative and regulatory frameworks.

This is what makes the absence of an AI rulebook coherent rather than negligent. If the risks of an AI-driven process resemble the risks of any other process that affects consumers or markets, the existing framework already has hooks for them. The FCA doesn't claim that every risk is covered. The wording is "many" and "not necessarily unique", which leaves room for risks that are specific to AI. But the default is to start with what exists.

For founders, this is both reassuring and demanding. It's reassuring because there's no separate AI compliance regime to learn alongside the existing one. It's demanding because the existing obligations apply in full, and the FCA's attention goes to the systems and processes that show they are being met. A product built on AI doesn't get a different standard. It faces the same outcomes, tested against a technology that may be harder to explain.

That difficulty is what the FCA flags next, and it's where its tone becomes more cautious.

Where the existing framework may need to bend #

The FCA is candid that applying existing rules to AI isn't frictionless. Its supervisory work and research from the Digital Regulation Cooperation Forum (DRCF) underline that the speed, scale and complexity of AI may require modified approaches to firm risk management and governance. The hedge is deliberate: "may require". The FCA is flagging a pressure on the framework, not announcing a change to it.

It goes on to say where the pressure might fall. The complexity of AI models may require a greater focus on the testing, validation and explainability of AI models. That focus comes with strong accountability principles, reinforced by corporate cultures operating with openness and transparency. Testing, validation and explainability are technical disciplines, and accountability and openness are organisational ones. The FCA pairs them, which suggests that it sees model quality and corporate governance as two halves of one problem. That reading is mine, and the FCA doesn't state it.

The FCA does not claim to have resolved this. It says: "We are considering how best to address these issues." That sentence is as much a statement of position as anything else in its response. Outcomes-based regulation can accommodate new technology, but where a model's complexity makes its behaviour hard to validate or explain, the FCA recognises the standard may need sharpening. What form that takes isn't yet stated.

The FCA also warns against treating AI as a standalone concern. AI should not be considered in isolation, it says, and a safe approach to adoption requires consideration of wider technology trends. Its work with firms suggests a growing urgency to take a more proactive approach to outsourced risks, cybersecurity and resilience. The claim is hedged, and it should be read that way. But the direction is clear: a firm's AI risk is bound up with who supplies its infrastructure, how well it's defended and how well it recovers.

Put together, this part of the FCA's thinking is the most practically useful. A firm adopting AI can't treat the model as the whole risk. The supply chain around it, the security of its data and the resilience of the service all fall within the same safe-adoption question.

Backing innovation while watching the macro picture #

None of this reads as a regulator trying to slow adoption. The FCA states that it wants to promote the safe and responsible use of AI in UK financial markets. The qualifiers "safe" and "responsible" are doing the work, but the verb is "promote".

It backs that with concrete channels. The FCA actively supports beneficial innovation through the Regulatory Sandbox, Digital Sandbox, TechSprints and other innovation advisory services. It supports the Government's commitment to fund a pilot of an AI & Digital Hub delivered by DRCF member regulators. And it's investing in its own capability: its data and digital investment includes a new digital hub in Leeds and the recruitment of over 75 data scientists.

These details are checkable, and that matters. A regulator that talks about being technology-agnostic but has no in-house data capability would struggle to assess what firms tell it. Recruiting over 75 data scientists is a signal that the FCA intends to assess AI directly, not rely only on firms' own accounts.

The FCA's reach also extends beyond UK borders. It's taking a leading role at the International Organization of Securities Commissions and chairing the Global Financial Innovation Network. Given that its secondary objective is subject to alignment with international standards, that international work is consistent with its stated aims.

On the horizon, the FCA commits to two kinds of watching. It will continue to closely monitor the adoption of AI across UK financial markets, and it will continue to monitor the potential macro effects that AI can have on financial markets. Both are framed as ongoing commitments, not findings. The second is the more interesting: it moves from individual firms and their customers to the markets themselves. The FCA doesn't say what macro effects it expects, and it would be wrong to infer any.

Where the Government's principles fit #

The FCA's update follows the Government's publication of its pro-innovation strategy in February of this year, and it sits alongside a broader political message: the Prime Minister has set out that the future of AI is safe AI.

The Government identified five key principles for AI regulation in the UK: safety, security and the first principle's wider requirement; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. They are defined and explained in the Government's White Paper, AI Regulation: A Pro-innovation Approach. The first principle states that AI systems should function in a secure and safe way throughout the AI life cycle.

Read next to the FCA's own statements, the overlap is easy to see. The FCA's point about testing, validation and explainability maps onto the transparency and explainability principle. Its emphasis on accountability principles and open corporate cultures maps onto accountability and governance. Its concern for consumers facing new and emerging harms is close to the territory of fairness and contestability. I'm drawing these parallels myself. The FCA's response doesn't set out a formal mapping between the two lists, and a firm shouldn't treat my reading as official guidance.

What the FCA does say is that its outcomes-based approach is what lets it apply these themes without prescribing technology. The Government supplies cross-economy principles; the FCA applies its existing objectives within financial services. For a firm, that means compliance questions come from the FCA's objectives and rules, with the Government's principles as the wider frame.

What the open questions mean for firms #

The sharpest takeaway from the FCA's response is the gap between its confidence and its caution. It's confident that existing frameworks cover many AI risks, that proportionality should guide any intervention, and that outcomes-based regulation protects consumers from new harms. It's cautious, and says so in hedged language, about whether the speed, scale and complexity of AI will require modified approaches to risk management and governance. It also says it's still considering how best to address those issues.

A firm can use that structure. Everything the FCA states plainly is something to act on now: meet the existing outcomes, and be ready to show the systems and processes that deliver them. Everything the FCA hedges is a question to watch. It's reasonable to prepare for a greater focus on testing, validation and explainability, since the FCA has named them, but it wouldn't be reasonable to assume a particular rule will follow. The FCA hasn't said one will.

The upcoming third edition of the machine learning survey, run jointly with the Bank of England, is the nearest concrete source of new evidence. The FCA says it will prioritise understanding current deployment strategies within the firms it regulates, so firms should expect to be asked how they deploy AI. Those answers will feed the evidence-based view that, in the FCA's framing, should keep the approach proportionate and effective.

The open question is how the FCA will resolve the tension it has identified. If complexity demands more rigorous testing, validation and explainability, but the FCA's rules don't usually mandate specific technologies, the answer must come through outcomes, supervision or guidance rather than technology bans. Which of those it chooses, and whether it needs to change anything at all, is what its further consideration and the next survey are likely to reveal.

Questions? Answers.

References #

• Financial Conduct Authority, (2024). AI Update ⧉. Financial Conduct Authority.
• Bank of England and Financial Conduct Authority, (2022). DP5/22 - Artificial Intelligence and Machine Learning ⧉. Bank of England.
• UK Department for Science, Innovation and Technology, (2023). A pro-innovation approach to AI regulation ⧉. GOV.UK.

Last reviewed 2026-11-01.