Safe AI adoption in an FCA-regulated firm is mostly governance and plumbing: know where client data goes, pick approved tools under a data-processing agreement, write a short policy, put a person between the AI and the client, keep an audit trail, and measure a small pilot before you scale. None of it needs a new department.
The FCA has not written a separate AI rulebook, and it has said it does not intend to. Existing obligations apply: Consumer Duty, senior manager accountability under SM&CR, record keeping, and UK GDPR as enforced by the ICO. That is good news, because it means the question is not “are we allowed?” but “can we show we did it properly?” Here is the ten-step checklist I use with advice firms, wealth managers and fintechs.
1. Find the AI you already have
Almost every firm has shadow AI: staff using consumer chatbots, browser extensions and note-takers with client information in them. Before anything else, ask, without blame, what people are using and for what. The answers tell you where the demand is and where the exposure is.
2. Map where client data goes
Draw the flow of client data through your systems and your people, including the spreadsheets and the inboxes. You cannot decide what AI may touch until you know what exists and where. This map becomes part of your data-protection record anyway.
3. Choose approved business tools, under a data-processing agreement
Business tiers of the major AI tools do not train on your data and will sign a data-processing agreement; consumer tiers generally will not. Pick a small approved set, in UK or EU regions where that matters, and switch the consumer accounts off.
4. Write a short AI policy
Two pages, not twenty. Which tools are approved, what data may go into them, what must never go in, who approves AI output before it reaches a client, and how incidents are reported. Agree it with your compliance officer and name the senior manager who owns it.
5. Put a person between the AI and the client
This is the single most important control. AI drafts the suitability report, the review letter or the reply; an adviser or paraplanner reads it, corrects it and signs it. The firm keeps responsibility for the advice, which is exactly what the rules expect. Why this does not slow you down.
6. Keep an audit trail
For each AI output that reached a client: what was asked, which model answered, what came back, who approved it and when. If a complaint arrives in two years, you want to answer it in an afternoon.
7. Redact what the task does not need
A model drafting a suitability report rarely needs the client's National Insurance number or date of birth. Strip personal data that the task does not use before the model sees it. It reduces your exposure and usually improves the output.
8. Tie it to Consumer Duty evidence
If AI checks files against your own criteria, record the criteria, the result and the follow-up. That is Consumer Duty evidence you probably wish you had already. Make the AI produce it as a by-product of the work.
9. Pilot one workflow and measure it
Pick one process, measure the hours and error rate before, run the pilot on live cases with human sign-off, and measure again on an agreed date. Grow it only if the numbers say so. A pilot without a baseline is a hobby.
10. Train the people
Most AI mistakes are human: the wrong tool, the wrong data, an output trusted without reading it. Half a day of hands-on training, with your own templates and your own policy, prevents most of them. I spent ten years in teaching and teacher training, and still run these sessions myself.
What this looks like in an advice firm
In a typical Intelliflo Office firm, the first pilot is usually review-pack or suitability drafting: the assistant assembles the draft from the file notes, the fact find and your template, flags anything missing against your checklist, and leaves it for the adviser to finish and sign. The aim is to cut the hours per report sharply, with the checklist evidence produced automatically, and nothing reaches the client that a regulated person has not read.
Where firms go wrong
- Banning AI. It does not stop the usage; it just stops you seeing it.
- Starting with the biggest process. Start with one that is painful, frequent and low risk.
- Trusting a vendor's compliance page instead of your own controls. The vendor is not the one the FCA will write to.
- No decision date. Pilots that never end never deliver.
My AI-readiness discovery covers steps one to four in two to four days, and the safe AI rollout does the rest. If you would rather talk it through first, book a call and bring your compliance officer.