When a regulated firm uses AI in a customer-facing or material process, a senior manager is accountable for the risk. The FCA’s examples of good and poor practice, published on 19 October 2026, describe what it saw firms do well and badly. They are illustrative and create no new requirements. The central point is practical. The FCA says it does not expect senior managers to be technical specialists. It expects them to take reasonable steps to understand the risks in their area and to provide effective challenge, and the firms it describes as doing well could show records of rationale, challenge and escalation.
Why it matters
Reasonable steps are shown by what was done and when. Where decisions on AI tools are poorly documented, with limited audit trails or supporting rationale, a senior manager has little to show. Where responsibility is unclear, fragmented or overly diffused, nobody can say who should have challenged.
What a challenge record contains
Five fields, each completable in a short meeting.
Figure — the five-field challenge record
The fourth field is the one most often missing. An assurance held on someone else’s word and never tested is what this practice calls borrowed assurance. The technical team can supply it. A supplier can supply it. Neither can supply the date on which the firm tested it.
Where a supplier is involved
The FCA lists untested vendor assurances and says firms remain accountable for outsourced AI services. In one case it describes, a firm built a product around a particular model without a viable alternative and had to redesign it when the model was retired. The record should show the fallback, and who decides when a model changes.
What it does not do
It does not make the AI safe, and it does not replace the firm’s judgement of what is proportionate. It creates the one thing a technical team or supplier cannot provide: a dated account of what the accountable person asked and decided.
Where it sits in the four pillars
Executive Governance: a named senior manager who can explain a decision. Human Observability: a record a person can read, with a date on it.
If it cannot explain itself to a board, it should not be trusted by one.
Which of the five fields is missing today for your most consequential AI use?
A Governance Classification Briefing locates a firm’s current position and identifies where the record of challenge is missing before someone else asks for it.
Book a Consultation