Articles

What the FCA's AI Good Practice Examples Mean for Insurance Brokers

Last checked 25 October 2026 against the sources below

The FCA has set out what good use of AI looks like across Consumer Duty, governance and operational resilience. Having controls is not enough: firms need to show they work.

What the FCA Published

On 19 October 2026 the FCA published examples of good practice and areas for improvement in how financial services firms use AI. They draw on its work with firms, its supervisory work and its AI testing initiatives, and cover machine learning, generative AI and agentic AI.

The examples do not create new requirements, and the FCA is not writing a separate rulebook for AI. Firms still decide what is proportionate for their own use. But the examples show what the FCA expects to see, and they are what a supervisor, an auditor or a principal firm is likely to compare your AI use against.

They are grouped into 3 areas: Consumer Duty and customers in vulnerable circumstances, governance and accountability, and operational resilience.

You Remain Responsible for the Outcome

The FCA reminds firms that when they use AI-supported tools, they remain responsible for consumer outcomes. Good practice starts with a defined customer need and intended outcome, tests outcomes across different groups of customers, and monitors what actually happens once the tool is live.

One area for improvement stands out: some firms looked only at how well the model performed technically, and could not show good outcomes for customers, spot poor ones or understand why they happened. For a broker, that means the question is not “how clever is the AI” but “can we show what happened to each customer it touched”.

Vulnerable Customers

The FCA gives using AI to spot possible signs of vulnerability as an example of good practice. It also expects firms to think about how AI affects customers with characteristics of vulnerability, to keep other ways of getting help where that is right, and to use unexpected cases, such as a customer mentioning financial distress, to improve their controls and when they escalate to a person.

Governance Before Go-Live

• Accountability from the start. Good practice is for named senior managers to own the risks of AI from the design stage onwards, with responsibilities mapped across the senior management functions.
• Enough understanding to challenge. Senior managers do not need to be technical experts, but they need enough understanding to oversee and challenge. Some delegated everything to technical teams and could not challenge effectively.
• Governance added too late. Some firms built and rolled out AI tools before deciding how they would be governed.
• Weak records. Some firms kept poor records of AI decisions and had weak audit trails.
• Vague escalation. Some firms left long gaps between reviews, or set triggers for escalating to a person that were too vague.

Human Oversight That Is More Than a Tick Box

The FCA sees a person in the loop as an important safeguard, but says firms should not become over-reliant on a person stepping in to prevent poor outcomes. It looks for clearly designed human oversight and escalation points, and proportionate checks rather than relying on 1 person to review, approve, challenge and override everything.

In practice, a reviewer who clicks “approve” on every AI suggestion is not oversight. What counts is evidence that people check, disagree when the AI is wrong, and that someone tests what the AI might have missed.

Not Relying on 1 Provider

Under operational resilience, the FCA says firms should recognise their dependence on AI models, including those from third parties, and avoid over-reliance on a single model or provider. Good practice includes including AI in resilience planning, designing systems that can work with more than 1 provider, asking suppliers for notice of model changes, and testing supplier assurances rather than simply accepting them.

Questions to Ask Any AI Supplier

• Does a person at our firm decide every flag, and is every decision and correction kept with who made it and when?
• How do we find out what the AI missed, not only what it flagged?
• Where is our named senior manager for the AI recorded, and what do they see each month?
• What are the escalation points, and how quickly must a person act on an urgent case?
• Which AI model do you use, where is it run, and will you tell us before it changes?
• What happens if the AI or your service is unavailable, and is there a second route?
• Can we show our board and the FCA the outcomes for customers, not only how accurate the AI is?

How Omniron Does It

• A person decides every flag. Omniron suggests, and your team confirms or corrects. The AI never closes a complaint on its own.
• Every decision is recorded: who reviewed each flag, when, and whether they disagreed with the AI and why.
• A weekly check of what was not flagged. Each week a person checks a random sample of emails the AI did not flag, so anything it missed is found, logged and put right.
• A named AI owner, in writing. Your AI Oversight Setup records who answers for the AI, who reviews flags, who does the weekly check and who handles urgent cases and how fast, with a review date and every change kept.
• Evidence for your board: flags reviewed by a person, sample checks done and what they found, in your board report and monthly trend report.

We are also working on the points the FCA raises that we have not finished yet: an independent check where a sample is reviewed without seeing the AI's flags, a second route for the AI, and written notice to firms before any model change.

We treat FCA publications as a product brief. When the FCA sets out what good looks like, as it did here, we compare Omniron against it, write down the gaps and build them, in the open. AI tools and the FCA's expectations of them will keep developing, and a tool your firm relies on for complaints and vulnerable customers should develop with them. Each change will be recorded and explained to your firm, so your AI owner can review it. Omniron prepares the evidence. Your firm makes the decisions and stays responsible for its customers.