The FCA’s 19 October speech and practice review put the operation of AI controls at the centre of supervisory attention. Firms need to be able to identify who owns a deployment, explain a material decision and intervene when the system produces an unsuitable result.[1][2]
Jessica Rusu’s speech calls for significant AI failures and near misses to be captured through firms’ existing incident-reporting approach and for proportionate, consistent provider disclaimers. The review supplies illustrative practices within the existing framework; neither document creates a new universal reporting deadline or a single mandatory control design.[1][2]
Oversight needs authority and usable evidence
What meaningful oversight looks like
| Control | What effective operation needs |
|---|---|
| Ownership | A named decision-maker before deployment, with a clear route to intervene or stop the system.Source 2 |
| Human review | Expertise, source information, authority and independence to challenge or reject an output.Source 2 |
| Traceability | Usable records of prompts, outputs, versions, applied filters and escalation decisions.Source 2 |
| Customer testing | Evidence that different customer groups, including those with vulnerabilities, can understand and use the output appropriately.Source 2 |
In one documented affordability-assessment example, staff formed their own judgement without seeing the AI’s proposed outcome. The firm could then compare the two assessments and reduce automatic deference to the model. The FCA presents this as a use-case example, with the level and design of oversight proportionate to the potential consequences.[2]
An action-taking agent changes the control problem
Consider two hypothetical deployments: a system summarising public company announcements for staff, and an agent authorised to change customer-account settings. The second has an action channel. Its controls therefore have to address not only whether its answer sounds plausible, but what the agent is permitted to do, whose authority it represents and how an incorrect action can be interrupted. This comparison is analysis of the control problem, not an allegation about any named firm.
Human review needs enough time, source information and authority to reject, investigate or stop an action while intervention can still change the result. Workload and the point at which approval occurs therefore matter alongside the reviewer’s formal role.
Accountability follows the use case through supplier and model changes
The speech highlights agent identity, delegated authority and supplier concentration. They create distinct questions: which agent acted, what it was authorised to do and which external dependency enabled it. A use-case record should connect those questions to a named owner and the relevant escalation process.[1]
The practice review also describes a firm whose product depended on one model without a viable transition plan. When the model was retired, the product had to be redesigned. That example makes supplier oversight concrete: substitution and exit arrangements need consideration before a service becomes dependent on a particular model.[2]
For a broker, the immediate task is to connect the live use case with its inputs, permissions, model version, human interventions and fallback arrangements. Those records make it possible to investigate an outcome and demonstrate how control operated in practice.
Sources & further reading
- Building the future of finance in the age of AI Financial Conduct Authority · 19 Oct 2026 · Accessed 20 Oct 2026
- AI in financial services: good and poor practice Financial Conduct Authority · 19 Oct 2026 · Accessed 20 Oct 2026