Most suitability reports and reasons-why letters take between 45 minutes and two hours to draft per case. Across a ten-adviser firm, that’s a large share of each week spent on a document that follows much the same structure every time. Advice firm owners want to know two things: whether AI can give some of that time back, and whether using it will get them into trouble with the regulator.
Yes, it can, and no, it won’t if you build it carefully. Most firms get the order wrong, though. They start with the technology and work back to compliance, and it needs to go the other way round.
What Consumer Duty actually requires of a suitability report
Consumer Duty requires firms to evidence, in a form a regulator could review, that the advice was suitable for that client at that point in time. The suitability report is the main place that evidence lives.
Consumer Duty doesn’t prohibit automation. It requires the output of any process, automated or not, to be personalised, clearly reasoned and in the client’s interest. An AI-drafted report full of template language that doesn’t reflect this client’s circumstances fails that standard just as a copy-and-paste job from a word processor would.
So the compliance question is whether the document accurately represents the advice given, and whether the firm can prove it. Who typed it doesn’t come into it.
Why data quality comes before the technology
Your client data has to be clean, structured and complete before any tool can draft from it. That’s the first thing to check, ahead of choosing a tool or building a workflow.
A suitability drafting workflow is only as accurate as what you feed it. If your fact-find data lives in a CRM where fields are filled in inconsistently, where risk scores are stored without the date they were recorded, or where attitude to risk and capacity for loss are mixed together, the AI works from a distorted picture of the client. The result will sound plausible and be wrong.
That matters more under Consumer Duty than it did before, because the duty looks at outcomes as well as process. A report that looks professional but misrepresents the client’s circumstances is a Consumer Duty problem whether a person or a system wrote it.
So the first practical step is to audit the inputs. What data does a good suitability report rely on? Where does each piece come from in your current process? Is it recorded consistently, in a format a system could read reliably? This is often where firms find that drafting was never the bottleneck. The inconsistency upstream was.
What an appropriate automation setup looks like
Once the data is clean, most advice firms have two workable options, at different levels of complexity.
- Level 1. A structured prompt in an AI writing tool, used alongside a completed fact-find template. The adviser copies structured client data into the prompt, the tool drafts the report, and the adviser reviews, edits and signs it off before it’s sent. You can do this today with tools your firm probably already pays for, at no extra cost and with no integration work. The limitation is the manual copy-and-paste, and it’s only as consistent as each adviser’s discipline in using it.
- Level 2. An automated workflow that pulls completed fact-find data from your back-office system or CRM, passes it to an AI drafting tool, and returns a draft to the adviser’s case management system for review. It uses platforms such as Power Automate, Make or n8n to connect your existing systems. It’s configuration work rather than engineering, typically takes a few days to set up for a firm with a stable back office, and removes the copy-and-paste step completely. It makes economic sense for a firm doing more than a handful of cases a week.
For suitability reports, Level 2 is the right starting point. A custom build with its own pipelines and complex orchestration isn’t needed unless a firm has very unusual case types or very large volumes.
What makes AI suitability drafting compliant in practice
Four things make AI-drafted suitability reports defensible, and they matter more than which setup you choose.
Restrict the AI to your own documents
A “grounded” AI tool only writes from documents you’ve uploaded, rather than from its general training. Google’s NotebookLM, for example, reports a sub-1% hallucination rate when restricted to uploaded documents. When the AI works from your own product literature, your own risk profiles and your own client data, it’s far less likely to introduce something that was never part of the advice. That matters a great deal for suitability, where one stray sentence about a product feature that was never discussed is a material compliance problem.
The human review step is not optional
Every AI-assisted suitability report has to be reviewed, checked against the client record and formally approved by the responsible adviser before it’s sent. That’s the point where the firm takes ownership of it. A workflow that treats the AI as the final step, rather than a drafting stage, has been designed wrongly. Under Consumer Duty, the firm is accountable for the advice and for the document that records it.
The audit trail records what the AI produced and what changed
If the FCA reviewed a file, you’d need to show the process behind the final report as well as the report itself. That means logging the inputs, keeping the AI draft, and recording what the adviser changed and why. Some back-office systems do this for you. Others mean documenting the process by hand. Either way, the trail has to exist.
Data residency matters
Sending client data through a public AI service raises the question of where it’s processed and stored. For a regulated firm that’s a procurement decision as much as a technical one. Before connecting any AI tool to client data, check where the data is processed, whether it’s used for model training, and whether the vendor’s terms fit your firm’s data policies and your FCA obligations.
What to do now
If you’re considering automating suitability report drafting, work through it in this order.
- Map your current inputs. Before choosing any technology, write down what data a good suitability report relies on, where it comes from in your current process, and whether it’s consistently recorded. If it isn’t, fix that first.
- Review your AI vendor terms before connecting client data. Check processing locations, retention policies and whether client data is used to train models. Do this before any integration.
- Start at Level 1. Build and test a structured prompt on real cases. Compare the output with your existing reports, and work out what the AI gets wrong and why. Most of the time the answer points back to the quality of the inputs.
- Design the review step explicitly. Build the adviser review into the workflow as a named, documented step, and be clear about what the reviewer is checking: accuracy against the client record, proper personalisation, and consistency with the advice given.
- Log everything. The inputs, the draft, the changes, the reviewer’s name and the date. Consumer Duty’s evidence expectations apply to your process as much as to your outputs.
The FCA’s current position on AI
The FCA has moved from voluntary best practice towards active scrutiny of how regulated firms use AI. A joint statement from the FCA and Bank of England has signalled that AI governance for UK-regulated firms is a compliance matter as well as a technology one[1]. The FCA has also said it is reviewing how firms use third parties, including AI vendors, as part of its supervisory work.
That doesn’t make automation a problem. It means the bar for documenting your reasoning, your controls and your oversight has gone up. A firm that can show a well-designed workflow, a documented review process and a clean audit trail is in a much better position than one that has avoided automation altogether or adopted it without governance. The UK AI governance guide sets out the wider obligations.
Intelliflo’s research into hybrid advice models makes a relevant point: technology supports regulatory objectives when it gives clients consistent, compliant routes through decision points without overwhelming them. The same applies to suitability drafting. The adviser’s judgement stays. The mechanical work shrinks, so adviser time goes where it’s needed.
This article is for informational purposes only and does not constitute regulated financial advice or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.
Sources
[1] FCA and Bank of England, joint statement on AI governance and operational resilience, 2026. Signals movement from voluntary best practice to active supervisory expectation for AI governance in regulated firms.