The FCA does not expect senior managers to be technical specialists. It expects them to be able to show their challenge. Directors outside financial services should read the same point as a statement about what any board will be asked after an AI-related failure.
On 19 October the FCA published examples of good and poor practice in AI in financial services. Status first: the examples are illustrative and non-exhaustive, and they create no new requirements. Substance second. Firms that did well mapped AI responsibility across senior management functions, owned the risk from the design stage, escalated against thresholds, and kept auditable records of decisions, including rationale, challenge and escalation. Firms with room to improve deployed AI before deciding how to govern it, documented decisions poorly, left ownership diffused between technology and business teams, and in some cases delegated AI development entirely to technical teams without effective challenge.
The FCA’s own description of the senior managers regime is that every holder of a senior management function has a duty of responsibility, and can be held accountable if they did not take reasonable steps to prevent or stop a breach in their area. Read beside that duty, the examples show what taking steps looked like in practice, and what the absence of a record looked like.
Three observations for a board or risk committee
First, delegation is not a step. The technical team knows the model. That is a reason to ask it questions, not a reason to hold its answers on trust. An assurance held on someone else’s word and never tested is borrowed assurance, and it fails at the moment someone asks what you did.
Second, the record is the evidence. A rationale written after an outcome is known is selected to fit it, which is why statisticians fix a hypothesis in advance and date it. The record of challenge has to be made when the challenge happens.
Third, a supplier’s assurance is not a step either. The FCA says firms remain accountable for outsourced AI services, and that firms in scope of SYSC 15A are required to include AI dependencies, externally hosted models among them, in their severe but plausible scenario planning. The FCA’s example of a firm that had to redesign a product when its model was retired is the case to put to management.
For directors of companies outside the regulated sector, section 174 of the Companies Act 2006 asks directors to exercise reasonable care, skill and diligence. The test differs from the senior managers regime, and the practical question is the same: what did you do, and can you show it?
None of this needs new technology. It needs a named owner for each AI use, a short template for the challenge, and a standing line on the agenda.
The question for the next risk committee: for the most consequential AI use in your area, can management produce the dated record of the last challenge, and who signed it?