How does the FCA view AI agents?

With the rules it already has. The FCA does not run a separate rulebook for AI. It regulates firms and outcomes, so an AI agent is judged like any other way of doing regulated work: does it deliver good outcomes for customers, is a named senior manager accountable for it, and is the firm resilient if it fails?

What is the FCA's approach, in substance?

The UK takes a principles-based, regulator-led approach to AI rather than a single AI law. For the FCA, that means three existing regimes do most of the work for agents:

• The Consumer Duty, which requires firms to deliver good outcomes for retail customers, whether a person or an agent does the work. A primer is in what the FCA Consumer Duty is.
• The Senior Managers and Certification Regime, which makes named individuals accountable for areas of the business, including those where agents act.
• Systems, controls and operational resilience expectations, which require firms to manage the risks of the technology they rely on and the third parties behind it.

Data protection sits with the ICO under UK GDPR and the Data Protection Act 2018. For banks, the PRA adds model risk expectations under SS1/23. How the FCA and data protection rules combine is set out in UK GDPR and FCA rules together for AI agents.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

What does that mean when the system is an agent that acts?

The FCA cares less about the technology than about what it does to customers and markets. Three consequences follow for agents.

Technology does not dilute accountability. "The agent decided" is not an answer. A senior manager is accountable, and must be able to show they took reasonable steps to make the agent's work safe.

Outcomes are measured, not assumed. Under the Consumer Duty, firms must monitor whether customers get good outcomes, and act on differences between groups. An agent that handles thousands of interactions gives a firm more data to do this, and fewer excuses for not doing it.

Scale changes the risk. One adviser's mistake affects their customers. An agent's mistake can affect every customer it touches the same day. The FCA will expect controls that catch systematic errors early. The fuller list of expectations is in FCA expectations for AI agents in regulated firms.

Concrete examples: what may the agent do, and what stays with a person?

An illustrative example

Take a UK consumer credit firm that deploys an agent to handle arrears conversations. The agent can explain balances, set up payment plans within policy, and send standard letters. Its senior manager for collections is named in the firm's responsibilities map as accountable for the agent's work.

Before launch, the firm tests the agent on past arrears conversations, including customers who mentioned illness or job loss. It finds the agent offers plans quickly but does not always recognise vulnerability. The firm adds hand-over triggers and re-tests. After launch, it tracks outcomes for agent-handled and staff-handled cases side by side, and the senior manager reviews them monthly. When outcomes for agent-handled vulnerable customers lag, the firm narrows the agent's scope rather than waiting. That record is what the FCA would want to see.

Which controls answer the FCA's questions?

• A named senior manager for each agent's area, with the agent listed in their responsibilities.
• Outcome monitoring by channel and customer group, reported to that manager.
• Hand-over rules for vulnerability, complaints and anything outside policy.
• Testing on the firm's own cases before use and after change.
• A full decision record so any interaction can be reconstructed.
• Independent review by internal audit; see why internal audit needs its own view of agent decisions.

The specific question of whether the FCA Consumer Duty applies to AI agents is answered separately. The full map is in AI agent regulation, mapped to controls.