AI GOVERNANCE
Move With Confidence
The FCA won’t write a separate AI rulebook. Your AI is judged against the rules you already follow. We help regulated firms get the balance right — enough governance to be safe, not so much it stops you using AI well.
GOVERNANCE THAT MATCHES THE WAY YOU ACTUALLY USE AI
NO NEW AI RULES.
That’s exactly why this is harder
Most firms’ use of AI has quietly run ahead of their governance. A tool here, a pilot there, and plenty that was never signed off at all. Because the FCA regulates AI through its existing frameworks, the gap doesn’t show up as a missed deadline — it shows up in a Consumer Duty outcome, an SM&CR accountability question, or a control that was never really there.
Our job is to close that gap before it’s tested — proportionately, and in language your board and your regulator both understand.
The FCA will judge your AI through:
-
The Consumer Duty — fair outcomes, however they’re produced
-
The SM&CR — a named senior manager, accountable
-
SYSC — systems, controls and governance
-
Operational resilience & third parties
AI Governance Reviews — and the work around them.
Start with a review to see where you stand, then strengthen what matters. Every engagement is scoped to your firm’s size, maturity and the way it uses AI.
AI governance review
Our flagship assurance review. We take an independent look at how your firm is using AI and ask the question the FCA will: is that use matched by an appropriate level of governance? You get a clear, evidenced view of where you stand, what’s working, and what to strengthen — written for your board, and ready to show a regulator.
Shadow AI & data review
“Shadow AI” is the AI your people are already using that no one signed off — the chatbot drafting client emails, the tool summarising meetings. We help you find it, see where it touches client or personal data, and bring it into the light with proportionate controls, before it becomes a problem.
Governance framework & accountability
The practical scaffolding: an AI policy people will actually follow, risk tiering so effort matches impact, clear senior-manager ownership under the SM&CR, and the records to show your decisions. We build on the governance you already have rather than bolting on something separate.
FCA & regulatory readiness
A focused gap assessment against the FCA’s expectations — its October 2026 good and poor practice guidance, the Consumer Duty and the SM&CR — plus the EU AI Act where it reaches your firm. You get a prioritised, fundable plan rather than a list of everything that could ever be wrong.
Third-party & supplier AI assurance
You can outsource the tool, but not the responsibility. We assess the AI inside the services you buy — what it does, what it can access, and whether the vendor’s assurances hold up — so a supplier’s model doesn’t become your blind spot.
Training & board upskilling
Governance only works if people understand it. We run practical sessions — from board and senior-manager briefings to teams working with AI day to day — including masterclasses on the themes firms are grappling with now, shadow AI among them.