The FCA has no separate rulebook for AI agents. It expects firms to meet the rules they already follow, whatever does the work. For an agent, that means the Consumer Duty's good outcomes for retail customers, a named senior manager accountable under the Senior Managers and Certification Regime, adequate systems and controls, and fair treatment of vulnerable customers.
What does the FCA require, in plain words?
The FCA regulates the conduct of financial firms in the UK. Its approach to AI is technology-neutral: the obligations attach to the firm and its activities, not to the tools it uses. The UK more widely takes a principles-based, regulator-led approach to AI rather than passing a single AI law.
For agents, the most relevant parts of the FCA's rules are:
- The Consumer Duty. Firms must act to deliver good outcomes for retail customers, across products and services, price and value, consumer understanding and consumer support. Our explainer on what the FCA Consumer Duty is gives the structure.
- Senior Managers and Certification Regime. Named individuals are accountable for areas of the business, and must take reasonable steps to prevent breaches in their areas.
- Systems and controls. Firms must have governance, risk management and controls adequate for their business, including for outsourced and technology-dependent activities.
- Operational resilience. Firms must be able to keep important business services within tolerable levels of disruption.
- Complaints handling and financial promotions rules, which apply to what an agent says and how it handles dissatisfaction.
Dual-regulated firms also answer to the PRA; see PRA expectations for AI agents in UK banks.
Which firms does this apply to?
Every FCA-authorised firm: banks, building societies, lenders, insurers, payment and e-money firms, investment firms, brokers, and consumer credit firms. The Consumer Duty applies where firms deal with retail customers, including through the distribution chain. SM&CR applies across solo-regulated and dual-regulated firms, scaled to their size.
Outsourcing an agent to a vendor does not move the obligation. The firm remains responsible for the activity, and the senior manager remains accountable.
What does this mean when the system is an agent that acts?
Four expectations sharpen when the work is done by an agent rather than a person or a static model.
Outcomes, not outputs. The Consumer Duty judges what happens to customers. An agent that answers accurately but makes complaints hard to log, cancellation hard to find, or explanations hard to follow can produce poor outcomes. The question whether the Consumer Duty applies to AI agents is settled: it applies to the activity, so it applies to the agent.
A person accountable by name. Under SM&CR, someone must answer for each agent. When something goes wrong, that person must show they took reasonable steps. For an agent, reasonable steps include knowing what it can do, setting its limits, ensuring oversight and reviewing its outcomes.
Controls that act at the right moment. Systems and controls must be adequate for the risk. An agent that can move money, change account terms or close accounts needs controls before those actions, not a review afterwards.
Vulnerable customers. The FCA expects firms to identify and respond to customers in vulnerable circumstances. An agent must recognise signs of vulnerability and hand over, and must not use persuasion that exploits it.
The FCA's broader stance is summarised in how the FCA views AI agents.
How do you meet FCA expectations for an agent?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Consumer Duty: good outcomes | Outcome monitoring per agent: complaints, reversals, drop-offs, time to resolution, by customer group | Monthly outcome reports with actions |
| Consumer Duty: consumer understanding | Agent communications tested for clarity; disclosure that the customer is dealing with AI | Test results; disclosure captures |
| Consumer Duty: consumer support | Easy route to a person; agent hands over on complaint or request | Escalation records and waiting times |
| SM&CR: accountability | Senior manager named per agent in responsibilities map | Responsibilities map; attestation |
| SM&CR: reasonable steps | Owner reviews capabilities, limits and outcomes on a set cycle | Review records signed by the senior manager |
| Systems and controls | Limits on each capability; hold before irreversible actions | Bound settings; approval records |
| Vulnerable customers | Vulnerability signals stop the agent and route to trained staff | Routing records; staff training |
| Complaints | Agent recognises complaints and logs them; never resolves them outside the procedure | Complaint logs linked to agent records |
| Operational resilience | Agents mapped to important business services; fallback to people tested | Service mapping; drill records |
Many firms frame this work with a recognised framework even though the FCA does not require one; our piece on why regulated firms use the NIST AI RMF for agents explains the logic.
What will the FCA ask?
- Who is the senior manager responsible for this agent, and what have they done?
- How do you know the agent delivers good outcomes for retail customers, including vulnerable ones?
- What can the agent do without a person, and why is that appropriate?
- Show us a complaint the agent handled, end to end.
- What happens if the agent fails? Which important business services depend on it?
- How do you oversee the vendor?
What do FCA rules not cover?
They do not classify AI systems by risk tier, as the EU AI Act does. They do not govern personal data, which is the ICO's remit under UK GDPR and the Data Protection Act 2018. They do not set prudential model risk standards, which for banks come from the PRA. And they do not tell you which actions an agent may take; they require you to decide, justify and evidence it. For how these fit with other regimes, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, authority is granted per agent, per customer, proven on the firm's own cases through Attest, and it expires. That gives a senior manager something concrete to point to as reasonable steps: each agent's certificate, its depth, and a filed record of every verdict, including the actions held for a named person.
Questions people ask
Does the FCA approve AI agents before use?
No. The FCA does not approve tools. Firms decide whether an agent is appropriate and must be able to show the FCA how they reached that view and how they control it.
Can an agent give regulated advice?
The rules on advice apply to the activity, whoever performs it. An agent that makes personal recommendations is giving advice, with all that follows. Most firms keep agents on the guidance side of that line.
What if a vendor's agent breaches a rule?
The firm is responsible for its regulated activities, including outsourced ones. The senior manager must show they oversaw the vendor appropriately.