The FCA has set out what good AI looks like. Here is how we are responding.

Oct 27, 2026 · @Steve Conley

Most of us will never read a regulator's publication. Yet the one the Financial Conduct Authority released on 19 October 2026 matters to anyone who will one day ask an AI tool about their pension, their debts or a decision that keeps them awake at night.

It describes what good looks like when financial organisations use AI, and where things are going wrong. It is careful, practical and, in places, quietly searching.

We are not regulated by the FCA. We have chosen to follow it anyway. This post explains why, what the FCA said, and what we have done in response.

What the FCA published

The publication is called AI in financial services: good practice and areas for improvement. It was published on 19 October and lightly updated the following day.

It creates no new rules. Instead, it shows how existing obligations already apply to AI, including the Consumer Duty, senior management accountability and operational resilience. The FCA is clear that its examples are illustrative, not a checklist, and that each organisation must judge what is proportionate for its own use.

The examples draw on the regulator's supervisory work, its conversations with firms, charities and academics, and its AI testing programmes. They cover machine learning, generative AI and agentic AI (systems that take a series of actions towards a goal, rather than giving a single answer). They are grouped under three headings:

• Consumer Duty and vulnerability: using AI to reach good outcomes for people, including those in difficult circumstances.

• Governance and accountability: who owns an AI system, who oversees it and who can stop it.

• Operational resilience: what happens when a model changes, fails or is withdrawn.

Five things that stand out

1. Start with the person's need, not the technology. The FCA describes good firms defining the problem, the people it affects and the outcome they want before deciding whether AI is the right tool at all. It lists building first and asking questions later as an area for improvement.

2. Decide where AI should step back. Good practice means choosing, task by task, where AI may support, where it may automate, where it should abstain and where it must hand over to a person. An AI that knows when to say "this is not for me to answer" is a safer AI.

3. Test with real lives in mind. Firms are expected to test outcomes across different people, including those in vulnerable circumstances and those with lower digital or financial capability. The FCA also warns against simply excluding vulnerable people from AI journeys unless they are offered another route to the same support.

4. Be honest about limits. People should know they are using AI, what it can and cannot do, and when to seek help elsewhere. Overstating what a system can do is named as poor practice.

5. Make human oversight real. This is perhaps the most important point. The FCA warns that human review of AI can drift into a box-ticking exercise, with reviewers deferring to the machine. Effective oversight needs people with genuine knowledge, the authority to intervene and clear routes to escalate.

The question we want to add

Read as a whole, the FCA's guidance asks one central question: can the organisation control the system? That is the right question for a regulator, and every firm should be able to answer it.

But it is not the only question. At the Academy of Life Planning, we add a second: can the person understand and control what the system does for them?

We call this agency-led governance. It means a tool should not only be safe in the hands of the organisation. It should also leave the person more capable, not more dependent. They should be able to see what the tool has done, correct it, take their information with them, and walk away.

This follows directly from the principles we work by: plan life before money; advice out, agency in; and AI should support human judgement, not replace it.

Our response: the Academy OS Agent Register

We have set up the Academy OS Agent Register: one record of every app, AI agent and AI prompt we provide. The FCA itself describes firms keeping a central inventory of their AI agents, showing who owns each one and what it can access. Our register builds on that idea.

For every tool, it records:

• the need it is designed to meet, and who it is for;

• what information and systems it can access;

• where it supports, automates, abstains or escalates to a person;

• what it is never allowed to do;

• how it has been tested, including with people who may be vulnerable or less confident with money or technology;

• the named person accountable for it, and how to reach a human;

• which AI model and knowledge sources it uses, and when they changed;

• what happens if it fails, and how it would be withdrawn safely.

We have added a set of fields the FCA does not ask for. These record what each tool tells people about its limits, how they can correct or override it, how they can export and delete their information, and whether a non-AI route is available.

In the spirit of the guidance, we want to be honest about where we are. The register currently lists 21 tools. The structure is in place, but many fields are still to be completed. We are working through it tool by tool, starting with the tools that serve people in the most difficult circumstances.

Two tensions we are working through in the open

Keeping records versus keeping data with the person. The FCA describes keeping records of prompts, outputs, model versions and escalation decisions as good practice. These help firms investigate when something goes wrong. Several of our tools are deliberately designed to store nothing, or to keep information only in the person's own Google Drive.

Both aims are legitimate. For each tool, we are recording what is held by the person, what is held by us, and why. Our working principle is to keep evidence that oversight is happening, such as version and escalation logs, without holding people's personal content.

Relying on one AI provider. Most of our tools use the same underlying AI model family. The FCA gives an example of a firm that had to redesign a product when the model it depended on was retired. We are recording this dependency openly and planning fallback and exit arrangements across our tools, rather than one at a time.

What this means for you

You do not need to read regulatory guidance to use AI wisely. But you can ask any organisation, including us, a few simple questions about the AI tools it offers you:

1. What is this tool for, and what is it not for?

2. When will it stop and tell me to speak to a person, and who is that person?

3. What does it know about me, and where is that information kept?

4. Can I see, correct or delete what it has recorded?

5. If I would rather not use AI, is there another way to get the same help?

A trustworthy organisation will answer these plainly. If it cannot, that is worth knowing before you rely on it.

A shared standard worth meeting

The FCA has done something useful here. It has described, in plain terms, what responsible AI looks like when people's financial lives are at stake. Regulated or not, any organisation offering AI to the public can hold itself to that standard.

We intend to meet it, and to go one step further by keeping the person, not just the institution, in control. We will share our progress as the register develops.

If you have a question about any of our tools, or a concern about how one has treated you, please contact us at [contact details].

The Academy of Life Planning is not regulated by the Financial Conduct Authority. We follow the FCA's AI good practice publication and the principles of the Consumer Duty voluntarily.

Source: Financial Conduct Authority, AI in financial services: good practice and areas for improvement, published 19 October 2026, updated 20 October 2026.

View Academy OS Agent Register