The Regulators’ Approach: Existing Rules Apply

The FCA and the Bank of England have taken the position that their existing rules are broadly capable of dealing with the risks AI creates, rather than introducing a separate AI rulebook. That means the frameworks firms already work under apply to AI in the same way they apply to any other technology or process:

• the Senior Managers and Certification Regime, which requires clear individual accountability for each part of the business
• the Consumer Duty, which requires firms to deliver good outcomes for retail customers, however those outcomes are produced
• the systems and controls requirements in SYSC, including those on outsourcing and operational resilience
• data protection law, overseen by the Information Commissioner’s Office, which governs how personal data is used in AI systems.

The practical effect is that AI is treated as part of the business. If an AI system makes poor credit decisions, the question is the same as for any poor credit decision: who was responsible for the process, and did they take reasonable steps to make sure it worked properly?

Mapping AI Accountability to Senior Manager Roles

There’s no Senior Manager Function or Prescribed Responsibility specifically for AI. Accountability follows the business activity and the technology that supports it. In practice, that usually means several Senior Managers share responsibility.

The Business Owner

The Senior Manager responsible for the business area where AI is used is accountable for the outcomes it produces. If a lender uses AI in affordability assessments, the Senior Manager responsible for lending owns the decisions. If an advice firm uses AI to draft suitability reports, whoever is responsible for advice owns the quality of those reports.

Operations and Technology

At firms with an SMF24 Chief Operations function, responsibility for technology, outsourcing and operational resilience typically covers the AI systems themselves: how they’re procured, built, tested, monitored and kept running. At Core firms without SMF24, this often sits with an executive director holding SMF3 or with the chief executive.

Risk and Compliance

The Chief Risk function where it exists, and the compliance oversight function, provide challenge: whether the firm understands the risks of its AI use, whether controls are adequate and whether customer outcomes are being monitored. Where AI is used in financial crime detection, the MLRO’s responsibilities are directly involved.

The Board

The board sets the firm’s appetite for AI risk and oversees the senior team’s management of it. At firms with a Chair and committee chairs holding Senior Manager Functions, those individuals are expected to make sure the board’s oversight is effective.

Where the Risks Sit

Customer Outcomes

The Consumer Duty applies regardless of whether decisions are made by people or systems. Firms need to show that AI-driven processes don’t produce poor outcomes for particular groups of customers, including vulnerable customers, and that customers can get help from a person where they need it.

Explainability

Senior Managers need to be able to explain, at a level the regulator would accept, how AI systems in their area reach their outputs, what could go wrong and how the firm would know. A system nobody in the senior team understands is difficult to defend as a “reasonable step”.

Third-Party Dependence

Most firms use AI supplied by third parties, often through large technology providers. That brings outsourcing and operational resilience obligations, and it can concentrate risk in a small number of suppliers. The firm remains responsible for the outcomes, whoever provides the technology.

Data

AI systems rely on data, much of it personal. Data quality, data protection and information security all need senior ownership.

Model Risk

Firms using AI in pricing, credit, capital or risk models need robust model risk management: validation, monitoring for drift and clear ownership of each model. The PRA has set out model risk management principles for banks, and they offer a useful reference for other firms too.

Staff Use of General-Purpose AI Tools

Much of the AI in regulated firms isn’t a formal system at all. Staff use general-purpose AI assistants to draft emails, summarise documents and research questions, often without the firm having a clear policy. That creates risks around confidentiality, data protection, accuracy and record keeping, and it can affect customer communications directly.

Senior Managers should make sure their areas have clear rules on what tools staff can use, what information can be entered into them, and how outputs are checked before they reach customers or feed into decisions. For firms subject to record-keeping requirements, it’s also worth considering how AI-assisted communications are captured. Informal use is often where firms have the least visibility and the most unmanaged risk.

What Boards and Senior Teams Should Do Now

• Build an inventory. List where AI is used across the firm, including tools staff use informally, and identify the Senior Manager accountable for each use.
• Update Statements of Responsibilities. Make sure responsibility for AI in each area is clear, and reflect material uses in Statements of Responsibilities and the Responsibilities Map where the firm has one.
• Agree a risk appetite. Decide where the firm is and isn’t comfortable using AI, particularly in customer-facing decisions.
• Test customer outcomes. Monitor AI-driven processes for poor or unequal outcomes, and act on what you find.
• Strengthen board knowledge. Make sure the board has enough understanding of AI to challenge the senior team effectively.

A governance and SMF structure review can help firms check whether AI accountability is clearly allocated across their Senior Managers.

What This Means for Hiring

Technology Literacy in Senior Roles

AI is raising the bar for technology understanding across the senior team. Chief operations officers and chief technology officers with experience of deploying AI safely in regulated environments are in growing demand. So are risk and compliance leaders who can challenge AI use credibly, without either blocking innovation or waving it through.

Board Expertise

Many boards lack members with deep technology experience. Adding an independent non-executive with a background in technology, data or AI governance can make a significant difference to the quality of oversight. Our sister practice NED Capital specialises in non-executive appointments, including technology and digital expertise for regulated boards.

Candidates Should Ask About AI

For candidates considering Senior Manager roles, a firm’s use of AI is now a legitimate due diligence question. Where AI is used in your area, understand how it works, how it’s governed and what you’d be accountable for before you accept. Our article on preparing for a Senior Manager role covers the other questions worth asking.

The Bottom Line

AI doesn’t need a new accountability framework, because the Senior Managers regime already provides one. The challenge for firms is applying it clearly: knowing where AI is used, who owns each use, and how the board oversees it. Firms that do this now, and make sure their senior team and board have the knowledge to manage AI well, will be ready for whatever the regulators do next.