AI in action · Investor protection

A Chatbot That Hears 'Food Bank' and Calls a Human: The FCA's Examples of Good and Poor AI Practice in Financial Services

The Financial Conduct Authority published on October 19, 2026 a page of good and poor practice drawn from its supervisory work, AI Live Testing and the Supercharged Sandbox. Good practice includes chatbots that detect vulnerability indicators and route customers to people, an independent ethics panel that challenges AI projects before launch, named senior managers accountable for each AI system, and stress tests before deployment. Poor practice: tools built without a customer need, governance added after launch, and exaggerating what a tool can do.

Oct 20, 2026

Regulators usually describe artificial intelligence in the abstract. On October 19, 2026 the UK Financial Conduct Authority published something more useful: a page of concrete examples of what it has seen firms do well and badly, drawn from "industry engagement, supervisory work and AI lab initiatives, including AI Live Testing and the Supercharged Sandbox". The examples are grouped under three headings, the Consumer Duty and customers in vulnerable circumstances, governance and accountability, and operational resilience, and the FCA is explicit that they "do not create new requirements, prescribe a single model or replace firms' responsibility".

The consumer examples are about knowing when to stop using the machine. The FCA cites AI tools that spot indicators of vulnerability, such as key words, spending patterns or signs that a customer is struggling with a digital journey, and a chatbot that uses a continuously updated list of such indicators to refer customers to human advisers; in her speech the same day, chief data officer Jessica Rusu gave the example of a customer mentioning a food bank, an unexpected scenario a firm had used to refine its prompts and escalation rules. Good practice also includes letting customers choose AI or non-AI support for routine tasks and switch channels without repeating themselves. The poor practice list is short and pointed: AI applications without a well-defined customer need, excluding vulnerable consumers by default, exaggerating a tool's capabilities, and launching automated journeys without sufficient testing.

The governance examples all come back to a named person. The FCA describes firms that map ownership of AI risks to specific senior managers under the Senior Managers and Certification Regime from the design stage, document that oversight so it can be audited, set clear threshold-based triggers for escalation to a human, and train those managers specifically on AI; one firm runs an independent ethics panel that challenges every AI project before it goes live on ownership, bias and controls. Poor practice is governance added only after implementation and monitoring that is not updated as the system changes, a point that matters more for models that learn in production than for the rule-based systems the regime was written for.

The resilience section is the one trading firms should read. Good practice includes a considered choice between company-owned infrastructure and third-party GPU cloud hosting, suppliers with backup servers in different locations, piloting lower-risk use cases before higher-risk ones, stress-testing before deployment, and mapping AI model dependencies into resilience planning, which the FCA notes is already a requirement for firms in scope of its operational resilience rules. Rusu added supplier concentration around a single AI model to the list of things to assess, along with cyber insurance.

What makes the page useful is that it describes practices rather than principles, and that every good example has a poor twin. A broker offering an AI assistant to retail clients can test itself against it in an afternoon: who is the senior manager accountable, what happens when the customer says something the model was not built for, what is the fallback when the GPU provider goes down. The FCA has said it will not write new AI rules. This page is what it will supervise against instead.

Sources: Financial Conduct Authority — AI in financial services: good practice and areas for improvement (Oct 19, 2026); Norton Rose Fulbright, Regulation Tomorrow — FCA Good and Poor Practice: AI in financial services (Oct 19, 2026); FCA press release via EuropaWire — FCA sets out plans for safer AI adoption and agentic finance oversight (Oct 19, 2026)