AI in UK financial services: firms must adapt to age of regulatory observability

In her speech on Monday, FCA chief data, information and intelligence officer Jessica Rusu revealed that 86% of financial services firms now use AI. She described the FCA’s response to the Mills review – which examined, and gave recommendations regarding, how AI might impact on retail financial services – as focused on “testing, assurance, monitoring and surveillance,” rather than simply further consultation.

Alongside the speech, the FCA published a paper detailing good practice and areas for improvement identified in firms’ use of AI. It emphasises consumer outcomes, governance and accountability, human oversight, operational resilience and third-party risk, while confirming that existing regulatory frameworks apply to firms’ use of AI. Those frameworks include the Principles for Businesses, consumer duty, SYSC, SM&CR, operational resilience requirements and DISP.

For private banks, wealth managers and financial advisers, the practical challenge goes beyond having appropriate AI governance arrangements. It is whether they can see, understand and evidence how their technology, data, products, people and decisions combine to produce regulatory and customer outcomes.

Put more practically, if a CEO asked tomorrow: ‘show me every material point at which AI influences our customers, products or decisions; what information it uses; who is accountable for it; and how we know the resulting customer outcomes are appropriate,’ could the organisation answer? For many firms, answering each element of that question may prove considerably harder than producing an AI policy or inventory.

We use “regulatory observability” to describe this ability to see, understand and evidence how technology influences decisions and customer outcomes. It is a practical lens through which firms can connect AI governance with their existing regulatory responsibilities.

Start with the business, not the technology

The starting point for a wealth business should be the customer lifecycle: everything from acquiring and onboarding a customer, to risk profiling, provision of advice, selection of products, execution of investments, portfolio management, and review, as well as complaints handling and communications.

AI and advanced analytics can potentially influence decisions at multiple points in that journey. The obvious applications are customer-facing applications, such as chatbots or digital investment tools, but technology operating behind the scenes can also influence customer segmentation, adviser workflows, risk analysis, product selection, communications, servicing and the prioritisation of customer interventions.

The FCA’s latest guidance expressly covers AI used both in consumer- or client-facing products and services as well as internally to improve how firms operate.

For senior management, therefore, a simple inventory detailing where AI is used should only be a stepping stone to answering whether the firm can actually trace where AI influences a decision, intervention or customer journey.

That implies something closer to an AI decision map, where technology, data, the model used, its output, decisions taken, the person or system acting upon it, and the impact, can all be connected. It also starts to connect technology governance to the firm’s wider regulatory control environment.

From governance to regulatory observability

We think firms can consider this through some connected capabilities:

Know

First, understand the technology estate. Which systems involve AI? What are the use cases? Which models are proprietary and which are supplied by third parties? What information do they process? What decisions are they intended to support?

This might sound straightforward. It may become less so as AI functionality is increasingly embedded within technology platforms and services already used across a business.

Trace

The next step is understanding what AI actually influences. Is an output merely informative? Does it influence a human decision? Does it determine how a customer is segmented? Does it alter which communication, service or product a customer sees? Does it initiate an action?

Tracing the consequences of AI matters as much as identifying the technology itself.

Attribute

Then comes accountability. Who owns the use case? Who approves it? Who owns the customer outcome affected by it? Who monitors it? Who can suspend it when something goes wrong?

This is already familiar territory under the FCA’s accountability framework. Its latest guidance highlights SM&CR and the accountability of senior management, while Rusu’s speech calls for clear accountability, risk-based controls, human oversight and escalation triggers.

However, increasingly autonomous AI introduces another dimension. It requires firms to ask: what has the machine been authorised to do? The distinction between an accountability architecture and an authority architecture could become increasingly important.

Observe

Firms then need to understand what happens after a decision or intervention. This is where AI governance intersects particularly strongly with the FCA’s consumer duty.

Wealth businesses already possess potentially valuable information about customers: their needs and objectives, risk profiles, product holdings, investment activity, fees and charges, communications, adviser interactions, complaints, service experiences and, where relevant, circumstances of vulnerability. The regulatory question is whether these exist simply as separate pools of data and management information, or whether they provide a coherent view of the outcomes customers experience.

The FCA made that distinction particularly clear in its July 2026 review of outcomes monitoring. Collecting data, listing metrics or reporting management information (MI) does not, by itself, demonstrate good outcomes. Firms should be able to explain what the information tells them, how it identifies risks or issues, what action they take and whether that action improved outcomes.

Under PRIN 2A.9, firms must regularly monitor the outcomes retail customers receive from the products they manufacture or distribute, their communications and customer support. The appropriate nature and frequency of monitoring depends on matters including the firm’s role in the distribution chain, the product and target market.

The challenge is therefore not simply collecting more data. It is creating sufficient connectivity between the data to understand what is happening.

A good outcome may be a trajectory, not an event

The concept of a customer outcome cannot always be reduced to a single point in time.

Consider investment advice. A recommendation might be suitable for a customer’s circumstances and objectives when made, properly explained and appropriately implemented, yet subsequently fall significantly in value. Conversely, an investment generating a strong financial return does not, by that fact alone, demonstrate that the underlying advice, distribution, value or customer understanding was appropriate.

Investment performance and regulatory outcome are not synonymous. It may therefore be helpful for firms to distinguish between at least three lenses:

• transaction outcome: what happened at the immediate decision point?
• journey outcome: what was the customer’s experience of the process and product?
• long-term outcome: over time, is the product or service continuing to function appropriately given the customer’s needs, objectives and circumstances?

The FCA’s consumer duty framework already makes monitoring by firms integral to determining whether customers are receiving good outcomes. Its July review also emphasises monitoring across key stages of the customer journey. AI introduces the possibility of doing this differently.

From periodic monitoring to continuous outcomes sensing?

Much existing governance inevitably operates to a periodic rhythm. Data is captured, MI is produced, committees consider it and interventions follow. But what happens as technology enables firms to identify changes, anomalies and potential risks more dynamically?

There is an important distinction here. The FCA has not imposed a general requirement for “continuous outcomes sensing”. The existing requirement is to monitor regularly and proportionately. As AI capabilities develop, firms should consider where more dynamic monitoring could improve their ability to identify deteriorating customer outcomes and intervene, taking account of the risks, the use case and the proportionality of the approach.

That could involve not just watching for signals, changes and patterns after a customer has started using a product, but intervening based on potential outcome risk and then measuring the effect of doing so. Seen this way, AI can potentially form part of the mechanism through which firms identify and manage risks to customer outcomes.

What information actually matters?

Firms do not necessarily need ever-increasing quantities of data. What they need is a sufficiently coherent dataset to assess outcomes reliably.

For a wealth business, that could mean establishing the appropriate relationship between customer characteristics and objectives, vulnerabilities, risk profile, product holdings, costs, advice or other interventions, service experience and relevant outcome indicators.

The optimal dataset will differ between a private bank, discretionary investment manager, financial adviser, platform and vertically integrated wealth business.

The objective should be decision-useful data, and not just volumes of data for data’s sake.

Product governance in an age of personalisation

Traditional product governance tends to have a recognisable lifecycle: design a proposition, identify a target market, approve it, distribute it, monitor it and periodically review it. AI can make the customer experience much more dynamic. Systems may increasingly personalise communications, service journeys, recommendations, interventions or the presentation of products and solutions. That raises an important regulatory question: at what point does AI-driven personalisation stop merely distributing a product differently and start materially changing the proposition experienced by the customer?

There is no suggestion that every instance of AI personalisation amounts to a new or changed product. Rather, firms need to understand where the cumulative effect of technology sits within their existing product governance and consumer duty arrangements. The same issue arises in distribution.

AI as an invisible layer of distribution

For heads of distribution, perhaps the most important AI system will not be an AI adviser. Imagine two customers with apparently similar characteristics. Technology may influence which customer receives an adviser call, investment communication, digital prompt, product opportunity or service intervention. The system itself may not be providing regulated advice. Yet it can influence the environment in which the customer’s decision ultimately occurs.

This creates a broader governance question: where technology determines who sees what, when and why, should firms consider it as part of their distribution control environment even where the technology itself is not performing a regulated activity?

The answer will depend on what the technology actually does and the applicable regulatory framework, but AI governance cannot sit exclusively with technology or data teams.

Consumer duty requirements concerning consumer understanding, for example, apply to communications throughout firms’ interactions with retail customers, including before, during and after the sale of a product and across communication channels. Understanding the regulatory implications of AI therefore requires firms to understand the underlying business activity it influences.

Agentic AI changes the question from intelligence to authority

The Mills review identified the transition towards autonomous models and the foundations for agentic finance among the issues the FCA should address. It also recommended that the FCA build and adopt an AI-enabled agentic supervisory model.

Jessica Rusu’s speech describes agents capable of searching across products, managing payments and investments and transacting with other agents. The FCA intends to work with industry, regulators and frontier labs on developing a framework covering agent identity, delegated authority, accountability and execution. It also says agentic systems require “continuous, conditional assurance”.

As AI evolves from technology that simply observes, analyses and suggests, to technology that can observe, make decisions within authorised parameters, initiate and execute actions, governance becomes partly a question of delegated authority: who, or what, is the agent acting for? What has it been authorised to do? What information can it use? Within what limits? When must it stop, refer or escalate? Who remains accountable? Those are not simply questions for technologists. They engage legal and regulatory concepts of mandate, authority, accountability, control and evidence.

What can the regulator see?

AI is changing regulatory supervision too.

The FCA says it is developing its future as an “agentic regulator”. It describes AI gathering evidence, surfacing intelligence from disparate sources and flagging early-warning signals. It is building AI tools for oversight of the 60,000 AML firms due to come within its remit in 2028 and agentic tools to support supervision of approximately 9,000 smaller wholesale markets transaction-reporting firms. It is also working on machine-readable data-collection APIs, building on its Handbook API.

Care is needed here. This does not mean that the FCA has said it is currently operating continuous AI surveillance of customer outcomes across private banks, wealth managers and advisers. But it allows boards to ask a legitimate strategic question about the direction of supervision.

Historically, regulatory supervision has often involved a recognisable sequence of firm information being submitted for supervisory analysis, prompting regulator questions and a subsequent need for response.

More sophisticated regulatory analytics make another model conceivable: regulators could analyse or aggregate data to identify patterns or anomalies, develop their own supervisory hypothesis based on this, and make a much more targeted enquiry of firms’ activities.

Imagine a future supervisory conversation. The FCA identifies that customers within a particular cohort appear to experience different outcomes to comparable customers and asks the firm to explain why. The least comfortable response may not be that the firm disagrees with the regulator’s analysis. It may be: “we hadn’t looked at our data that way”. That encapsulates the regulatory observability problem.

For firms, the strategic ambition should no longer be confined to being able to produce information requested by the FCA – it should increasingly be to interrogate their own business, customer journeys and outcomes at least as intelligently as an increasingly data-enabled regulator might.

That is as much a management question as it is a regulatory one.

For the CEO, the question may be: do we understand where AI is changing the economics, risk profile and customer outcomes of our business?

For the COO: can we trace AI through the processes, information, systems, decisions, suppliers and controls underpinning customer outcomes?

For the head of distribution: how does technology influence which customers receive which propositions, communications and interventions, and what outcomes result?

For compliance and risk: can the firm reconstruct why a material AI-influenced decision occurred and demonstrate that the surrounding governance, controls and outcome were appropriate?

The practical task is to connect these perspectives: know where AI operates, trace what it influences, establish accountability and authority, observe and measure outcomes, intervene where necessary, and retain evidence of the chain. Regulatory observability is not another policy document. It is the ability to explain how the business works – and whether its use of AI is producing appropriate customer outcomes.