FCA Launches Consultation on AI Model Risk Management for Financial Services Firms

What happened

The Financial Conduct Authority (FCA) published a discussion paper this week outlining proposed expectations for how regulated financial services firms should manage risks arising from the use of artificial intelligence and machine learning models. The paper, DP26/2, builds on the regulator's earlier AI Update from March 2025 and responds to the rapid acceleration of AI adoption across banking, insurance, asset management, and payments.

The consultation sets out the FCA's thinking across five key areas: model governance and accountability, data quality and bias management, transparency and explainability requirements, third-party model risk (including the use of foundation models from providers like OpenAI and Anthropic), and ongoing monitoring and validation. Notably, the FCA has signalled that it expects firms to maintain meaningful human oversight of AI-driven decisions that affect consumers, particularly in areas such as credit scoring, claims handling, and investment advice.

The regulator explicitly acknowledged the challenges posed by large language models and generative AI, noting that traditional model validation techniques may be insufficient for opaque foundation models. The FCA is asking firms and industry stakeholders to respond by 11 July 2026, with a view to publishing final guidance by the end of the year.

The move places the FCA among the most proactive financial regulators globally on AI governance, alongside the EU's AI Act framework and the US Federal Reserve's evolving model risk guidance. It aligns with the UK government's broader sector-led approach to AI regulation, which tasks individual regulators with developing rules appropriate to their domains rather than imposing a single cross-economy AI law.

What this means for your business

For UK financial services firms and the professional services firms that advise them, this consultation marks a significant step toward concrete regulatory expectations on AI. Compliance, risk, and technology teams should begin reviewing the discussion paper now, particularly the sections on third-party model risk — many firms are already deeply embedded with Microsoft Copilot, OpenAI APIs, or Anthropic's Claude, and the FCA is clearly signalling that outsourcing AI capability does not outsource accountability.

Law firms, consultancies, and accountancy practices serving financial services clients should anticipate a wave of demand for AI governance frameworks, gap analyses, and model risk assessments over the coming months. Firms that have already built expertise in AI assurance — mapping data lineage, testing for bias, and documenting model decisions — will be well positioned. The FCA's emphasis on explainability also has implications for any firm deploying AI in client-facing advice or decision-making contexts.

Practically, the July 2026 response deadline gives firms a narrow window to shape the final guidance. Trade bodies such as UK Finance and the Investment Association are expected to coordinate industry responses, but individual firms — particularly those with novel AI use cases — should consider submitting their own views. The direction of travel is clear: AI adoption in UK financial services will increasingly require demonstrable governance, and the firms that treat this as an opportunity rather than a burden will gain competitive advantage.