AI for UK Financial Services Firms: a Practical Guide
Most AI guidance is written for tech companies. This is written for the kind of regulated UK firm that has compliance to think about, an FCA register entry to protect, and senior managers personally accountable for what the business does with technology.
Written by Dom Leigh · Former mortgage adviser (7 years) and project manager at National Building Society · PRINCE2®-certified · Last updated June 2026 · 14-minute read
AI inside a UK financial services firm is not a generic productivity story. The FCA expects firms to evidence customer outcomes, accountability and operational resilience, and the cost of getting that wrong is the difference between a tool that saves the team time and one that ends up in a s.166. The page is organised by sector, so you can see what AI actually does in your corner of the market and what the FCA expects you to evidence.
Mortgage firms
Time recovered on fact-finds, criteria checks, document handling and case notes, without losing the adviser-led decision.
Read more →IFAs and wealth
Suitability drafting, meeting notes and provider correspondence cut down, with the adviser firmly in the file.
Read more →Accountancy practices
Bookkeeping prep, management accounts and client comms moved off the partners' desks.
Read more →Compliance and regulation
Consumer Duty, SMCR and operational resilience made operational, with the FCA's expectations made concrete.
Read more →AI is being adopted across UK financial services faster than most regulators publicly acknowledge, and slower than most technology vendors privately admit. Between the hype and the hesitation, there is a practical question that most firms in this sector actually need answered: where does AI genuinely fit in a regulated UK financial services business, and where doesn't it?
This guide answers that question from a position grounded in the sector. I spent seven years as a regulated mortgage adviser at firms including Bank of Ireland and London & Country, three years as Project Manager at Bath Building Society delivering digital transformation in a regulated environment, and now help UK SMEs implement AI in their operations.
The short answer: AI fits well in the high-volume, low-judgment parts of a financial services firm's workflow. Document handling, client communication, knowledge retrieval, pre-screening of cases, internal administration. It does not fit (yet, and possibly never) in the parts where solely-automated decisions would create significant effects on individuals. The line between these two categories is not a vague boundary. It is defined in regulation. The rest of this guide walks through the practical map.
35–39%
of UK SMEs across all sectors are actively using AI tools as of mid-2025, but adoption in regulated financial services lags this baseline materially. (Source: UK government AI Activity in UK Business report.)
What follows is a sub-vertical map. Mortgage broking, IFAs and wealth, accountancy practices, and the compliance backbone that runs through all of them. Each section ends with the deeper guides we have published for that sub-vertical.
AI for UK mortgage brokers
Mortgage broking is the sub-vertical where AI delivers the clearest near-term return for an SME firm. The day-to-day workload is document-heavy, case-prep-heavy, and lender- criteria-heavy. All three are workflows AI handles reliably when a human adviser stays in the decision loop.
The practical wins fall into three buckets. Document handling (ID, bank statements, payslips, accountant references, valuation reports) where AI extracts structured data, flags inconsistencies between documents, and surfaces missing items. Case pre-screening where AI runs data completeness checks, basic affordability flags, and document inconsistencies before the case reaches the adviser, who then receives a case already prepared. Knowledge retrieval across lender criteria and internal procedures, so advisers stop hunting through SharePoint for the policy they vaguely remember.
Typical time recovered per case sits in the 60 to 90 minute band for document and pre-screening work, plus 1 to 3 hours per adviser per week on communication drafting. None of this requires touching solely-automated decisions, which is where Article 22 UK GDPR draws a hard line for the sub-vertical.
AI for IFAs and wealth firms
For IFAs and small wealth firms, the regulatory anchor is the Consumer Duty. Suitability assessments, advice generation, and product recommendations stay with the human adviser. AI's role is in the surrounding workflow: fact-find preparation, meeting transcription and action capture, suitability report drafting (with adviser review), client communication, and internal knowledge retrieval across the firm's research and policy materials.
The line that matters here is the line between preparation and decision. AI prepares the suitability narrative from CRM data and the fact-find; the adviser reviews, edits, signs. AI drafts the client update email; the adviser approves before sending. The Consumer Duty is satisfied because the adviser remains meaningfully involved in every outcome that affects the client.
Where IFAs go wrong is letting a customer-facing chatbot stray into anything that could be construed as advice. The FCA's March 2026 perimeter report flagged this explicitly. Customer-facing AI in an IFA business stays on administrative tasks (appointment booking, document collection, status updates) unless it has been specifically designed and governed to operate inside the firm's regulatory permissions.
AI for UK accountancy practices
Accountancy practices sit slightly outside the FCA perimeter but inside ICAEW, ACCA, and AAT codes of conduct, and squarely inside UK GDPR for client data. The regulatory framing is different from broking and IFA work, but the implementation pattern is the same: AI prepares, humans decide, and the audit trail demonstrates oversight.
The strongest use cases in practice are bookkeeping categorisation review, working-paper drafting, client communication, year-end pack preparation, and Making Tax Digital workflow support. Document handling (receipts, invoices, bank feeds, tax notices) is reliably automatable. Tax advice and final accounts sign-off stay with the qualified accountant.
The professional-body angle matters more than most practices realise. ICAEW and ACCA expect members to apply the same professional judgement, confidentiality, and client-care standards to AI-touched work as to anything else. The audit trail for AI use is not optional. It is the evidence that the practice is meeting its professional obligations.
Compliance and regulation
Compliance is the backbone running through all three sub-verticals above. The FCA has been explicit that it is not introducing AI-specific regulation. Its approach is outcomes-based, technology-neutral, and rests on the principle that existing frameworks (SMCR, Consumer Duty, conduct rules, operational resilience) already cover the safe use of AI. This sounds permissive but is more demanding in practice, because the accountability falls on existing senior managers under the rules they are already subject to.
In January 2026, FCA Executive Director David Geale told the Treasury Committee that individuals within financial services firms are "on the hook" for harm caused to consumers through AI. Not firms. Individuals. Under existing rules. This is the framing that should anchor every AI decision a regulated UK firm makes.
Individuals within financial services firms are on the hook for harm caused to consumers through AI.
- David Geale, FCA Executive Director, evidence to House of Commons Treasury Committee, January 2026
The hard regulatory line for SME firms is Article 22 UK GDPR. Solely-automated lending or underwriting decisions, solely-automated suitability assessments, and solely- automated KYC or AML decisions all fall the wrong side of it. AI prepares; humans decide; the audit trail demonstrates SMCR oversight.
The deeper compliance treatment for UK financial services firms (FCA expectations, SMCR allocation, Consumer Duty, Article 22, network and principal-firm policies) lives in the compliance sub-pillar: AI compliance for UK financial services firms. If you would rather have this scoped and implemented inside your firm, that is what the services page is for.
Where to start.
AI in a UK financial services firm is not a yes-or-no question. It is a where-and-how question. The AI Readiness Score pays particular attention to the readiness dimensions that matter most in regulated environments: data quality, process documentation, and governance baseline.
AI in UK financial services SMEs.
Yes, in most operational and administrative contexts. AI is well-suited to document extraction, client communication drafting, knowledge retrieval, and case preparation. It is not appropriate for solely-automated affordability or suitability decisions, which fall within Article 22 UK GDPR's restrictions and run against the Consumer Duty. Network policy may impose additional restrictions on customer-facing use.
Yes, for client communication, meeting preparation, document summarisation, and knowledge retrieval. AI should not be used for solely-automated suitability assessments or solely-automated recommendations. The adviser remains in the loop on every regulated advice action. Most UK networks permit AI for administrative and preparatory work without specific approval.
The FCA expects firms to apply existing rules (SMCR, Consumer Duty, conduct rules, operational resilience) to their use of AI. There is no separate AI rulebook. Senior managers are personally accountable for AI used in their domain. The FCA has launched the Mills Review (January 2026) into AI in retail financial services and is expected to publish practical guidance by end of 2026.
Article 22 applies only to decisions made solely by automated processing with legal or similarly significant effects on individuals. Most SME AI use (document handling, communication drafting, knowledge retrieval, administrative work) falls outside Article 22 because it involves meaningful human involvement. AI that influences a decision but where a human reviews and has discretion to alter the decision is not subject to Article 22.
The senior manager whose Statement of Responsibilities covers the relevant function, under the Senior Managers and Certification Regime. The FCA has confirmed this applies even to smaller firms classified as Core Firms or Limited Scope Firms. The FCA has also decided NOT to create a separate AI-specific Senior Management Function, meaning accountability sits with existing senior managers.
Yes. The Consumer Duty requires firms to deliver good outcomes for retail customers. Any AI use that affects a retail customer outcome (advice, suitability, pricing, service delivery) is in scope. Firms must be able to demonstrate that AI use supports rather than undermines good outcomes.
A Data Protection Impact Assessment is mandatory under UK GDPR for any processing likely to result in high risk to individuals. Most automated decision-making subject to Article 22 falls into this category. Many other AI uses don't legally require a DPIA but it is good practice to conduct one for any meaningful AI implementation in a regulated firm.
This is the open question the FCA has acknowledged and the Mills Review is examining. The practical answer for SMEs in 2026: scope AI use to cases that don't require full model explainability (document extraction, communication drafting, retrieval), keep humans in the loop on every customer-affecting decision, maintain decision logs and audit trails, and document the governance in plain English. You don't need to be able to explain the model's weights. You need to be able to demonstrate the controls around it.
AI Compliance for UK Financial Services SMEs
The 10-point compliance checklist for AI use in regulated UK firms, with governance templates and a sample AI Use Register.
What the FCA Actually Expects From Firms Using AI
The Consumer Duty, SMCR and operational resilience lens on AI, translated for SME compliance teams.
AI and the Consumer Duty
How to evidence good customer outcomes when AI is part of the journey.
The AI Process Audit methodology
How the diagnostic is delivered in a structured 5-working-day engagement.