Somewhere in your firm today, an AI feature drafted a paragraph, summarised a document or flagged a transaction, and nobody checked whether it was right. That isn’t a prediction. For most advice firms it’s already the case.

So the question isn’t whether AI is in your firm. It’s whether you’re using it on purpose, with someone checking the output, or whether it’s quietly piling up inside tools and workflows while nobody has decided who answers for it.

What AI does inside advice firms today

Most of the AI an advice firm uses isn’t a chatbot. It’s built into platforms you already pay for: the back-office system, the CRM, the document management tools.

What’s already running in firms like yours falls into four groups:

  • Drafting and summarising. Suitability letters, meeting notes and client reports. Intelliflo has reported a 97% time saving on certain drafting tasks for firms using its integrated workflow tools (Intelliflo’s own figure).
  • Client onboarding and KYC. University of Edinburgh research on regulated financial services found digital onboarding with AI-assisted document checks cut KYC processing time by around 34%.
  • Compliance monitoring. Pattern-matching across client communications and transaction data to flag possible issues before a person reviews them.
  • Research and analysis. Summarising fund factsheets, condensing long regulatory documents, or pulling comparable data across a portfolio.

All of this is available now, and much of it is inside tools you already licence.

The governance gap most firms haven’t closed

Having the features switched on doesn’t mean they’re being used safely. There’s a wide gap between “we have an AI feature turned on” and “we have a framework that covers what it produces”, and the regulators are narrowing the room for it.

A hallucination, where a model produces a confident but wrong answer, used to be a quality problem. In a regulated firm it’s a liability problem. An AI-drafted suitability letter with a wrong figure or a misdescribed product feature is a professional failure, and the accountability sits with the firm[1].

The FCA has confirmed it will apply its existing rules to AI rather than write AI-specific legislation[2]. Your obligations under the Consumer Duty, SM&CR and the suitability rules all apply to AI-assisted output. “The system produced it” isn’t a defence.

The accountability for an AI-assisted output sits with the firm that used it, not the vendor that built it.

In a joint statement with HM Treasury, the FCA and the Bank of England have also signalled that AI governance for UK-regulated firms is moving from voluntary good practice towards a clearer regulatory expectation[3]. Leaving it for later just builds up the work you’ll have to do.

What the FCA expects in practice

The FCA isn’t telling firms to avoid AI. It’s telling them the usual rules apply when they use it, which is a narrower message than some vendors suggest. Three practical consequences follow.

Human sign-off on regulated output

Anything AI-generated that feeds a client recommendation, a suitability assessment or a regulated communication needs a person to review it and take responsibility before it reaches the client. The AI can draft. A qualified person approves.

Knowing which AI you use

“We use our back-office system” isn’t enough of an answer if that system has AI features built in. You need to know which features are switched on, what data they process and who checks them.

Vendor contracts

DORA, the EU’s Digital Operational Resilience Act, requires financial entities to describe every function and ICT service clearly and completely in their third-party provider contracts[4]. If AI tools are built into your tech stack, the contract with that vendor is a risk document, not just a billing arrangement.

Three levels of AI use

The right response depends on which of three levels your firm is at, and most firms sit lower than they think.

Level 1 (education). You’re using AI features already inside your tools, or starting to look at what’s available. The fix is mostly awareness and basic governance: knowing what’s switched on, a simple review step for AI output, and a team that knows the rules. It costs almost nothing and you can start this week.

Level 2 (integration). You want two or more tools to share data or trigger each other: the CRM passing details to the back office, or a document review that flags items for a paraplanner instead of someone chasing them by hand. This is configuration work in platforms like n8n, Make or Power Automate, typically a few days to a few weeks, and a few hundred to a few thousand pounds.

Level 3 (custom build). You have a specific, complicated problem no off-the-shelf tool solves, and the business case justifies real engineering: a custom AI agent that works across several systems, keeps context between sessions and carries out multi-step tasks. That’s four to twelve weeks of development, properly scoped, and only worth starting once Levels 1 and 2 are used up.

Most firms that think they need Level 3 need Level 1. The discipline is being honest about which one you’re at.

Four things to do now

Start with these four, in this order:

  • Map the AI you already use. It doesn’t need to be a formal project. Go through your tools and subscriptions (back office, CRM, communications, document management) and note which have AI features, and which of those are switched on.
  • Set a review step for AI output. Before anything AI-generated reaches a client, a qualified person checks it. It doesn’t have to be long, but it has to be consistent and recorded. If a paraplanner reviewed an AI-drafted suitability letter, that review goes on file.
  • Check your vendor contracts. Do your agreements with AI-enabled vendors say what data is processed, how it’s stored, and what happens if the service goes down or the vendor changes its terms? Vendors are a real risk here: some of the tools firms have built workflows around may change direction, raise prices or close.
  • Name one person responsible. Someone has to own AI governance. It doesn’t need to be a full-time role, but it does need a name. Under SM&CR, accountability for operational risk, technology risk included, has to sit with an identified individual.

For the fuller version, the UK AI governance guide maps each control to the rule it answers.

AI won’t replace a good adviser

The judgement, the relationship and the ability to keep a client steady when markets move aren’t things a model can do. What AI can do is take time off the tasks around that work: drafting, summarising, cross-referencing and flagging. With proper oversight, that gives your team more time for the work only people can do.

The firms that get the most out of AI won’t be the ones that move fastest. They’ll be the ones that know what they’re using, why, and who is responsible for the output.

This article is for information only. It isn’t regulated financial advice, legal advice or a compliance opinion. Data protection and DORA obligations depend on your circumstances and jurisdiction, so consult a qualified compliance professional, solicitor or data protection adviser for advice specific to your firm.

Sources

[1] FCA, ‘AI in financial services, our approach’, Financial Conduct Authority, 9 June 2026. Available at: https://www.fca.org.uk/news/blogs/ai-financial-services-approach

[2] FCA, ‘AI in financial services, our approach’, Financial Conduct Authority, 9 June 2026. Available at: https://www.fca.org.uk/news/blogs/ai-financial-services-approach

[3] FCA, Bank of England and HM Treasury, ‘FCA, PRA and Bank of England joint statement on frontier AI and cyber resilience’, Financial Conduct Authority, 22 May 2026. Available at: https://www.fca.org.uk/news/statements/fca-boe-treasury-joint-statement-frontier-AI-models-cyber-resilience

[4] EIOPA, ‘Joint final report on draft RTS on subcontracting of ICT services supporting critical or important functions’, European Insurance and Occupational Pensions Authority, 26 May 2026. Available at: https://www.eiopa.europa.eu/publications/joint-final-report-draft-rts-subcontracting-ict-services-supporting-critical-or-important-functions_en