In brief The UK has no AI-specific rulebook for financial firms and the FCA has said it does not plan one — existing frameworks apply, and the timeline that matters is the drumbeat of positions, statements and statutory changes elaborating that stance: the FCA's April 2024 AI Update, the critical third parties regime, the AI Lab and live testing, the Data (Use and Access) Act's automated-decision regime from February 2026, and the ICO guidance now in preparation.
Expected · H2 2026 ICO statutory code of practice on AI and automated decision-making
In preparation following the spring 2026 consultation; expected to firm up the Articles 22A–22D safeguards in practice.
Expected · 2026–27 Possible firmer FCA guidance on Consumer Duty and SM&CR applied to AI
Commentary around the FCA's long-term review suggests guidance may follow. Firms with proportionate governance already in place should find it confirms what they are doing.
May 2026 FCA, Bank of England and HM Treasury publish a joint statement on AI NEW
A coordinated signal of the UK's supervisory posture on AI in financial services — engagement and monitoring within existing frameworks.
Spring 2026 ICO consults on automated decision-making and profiling guidance NEW
The consultation on updated guidance under the reformed regime; a statutory code of practice on AI and ADM is in preparation behind it.
Feb 2026 DUAA automated-decision regime takes effect NEW
Articles 22A–22D replace the old Article 22 of UK GDPR — more permissive on solely automated decisions, with the safeguards now the compliance surface.
Feb 2026 FCA updates 'AI and the FCA: our approach' — still no bespoke rules
The FCA maintains its position: no extra regulations for AI; existing frameworks apply, with individual accountability under SM&CR unchanged.
Jan 2026 FCA reportedly launches a long-term review of AI in retail financial services
A review into how AI could reshape retail financial services. No new rulebook signalled.
Jan 2026 Supercharged Sandbox first cohort showcased; AI Live Testing continues
The AI Lab's first Supercharged Sandbox cohort is showcased and a second opens; AI Live Testing moves into its second cohort.
Nov 2024 PS16/24: critical third parties to the UK financial sector
The Bank of England and PRA finalise the regime allowing major technology providers to be designated for direct regulatory oversight — the concentration-risk backdrop to every firm's AI vendor list.
Apr 2024 FCA AI Update: the founding position
AI is a technology, not a regulated activity: the FCA will not write an AI rulebook, and existing obligations apply from the moment a firm uses AI. Everything above is elaboration.
The most useful thing to understand about UK AI regulation for financial firms is that there is no AI rulebook coming — and that this is not the same as there being no rules. The FCA’s position, set in April 2024 and maintained since, is that existing frameworks apply: Consumer Duty, SM&CR, SYSC, record-keeping. What changes over time is the elaboration — statements, statutory reform, supervisory programmes and guidance that sharpen how those existing obligations bite on AI.
That is what this page tracks. Newest first, updated when events land rather than on a schedule, with the entries kept deliberately short. For what the position means for your firm in practice — the controls mapped to each regulatory hook — see the UK AI governance guide; for the wider picture across jurisdictions, the cross-border map.
How to read the direction of travel
Three threads run through the timeline. First, the FCA’s consistency: every update since April 2024 has restated the same position rather than revised it — firms waiting for a compliance date are waiting for something that is not coming [1][2]. Second, the law that did change is data law: the DUAA’s automated-decision regime is the one genuine statutory shift, and its safeguards — decision logic, human intervention, the right to contest — are now the compliance surface for anything approaching automated decisions. Third, supervision is getting closer to the technology: the AI Lab, live testing and the critical third parties regime all put the regulator nearer to how AI is actually run [3][4][5].
This page is for informational purposes only and does not constitute regulated financial advice, legal advice, or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.
Sources
[1] Financial Conduct Authority, ‘AI Update’, 22 April 2024. Available at: https://www.fca.org.uk/publication/corporate/ai-update.pdf
[2] Financial Conduct Authority, ‘AI and the FCA: our approach’, updated 13 February 2026. Available at: https://www.fca.org.uk/firms/innovation/ai-approach
[3] Financial Conduct Authority, ‘AI Lab’. Available at: https://www.fca.org.uk/firms/innovation/ai-lab
[4] Financial Conduct Authority, ‘Supercharged Sandbox’. Available at: https://www.fca.org.uk/firms/innovation/supercharged-sandbox
[5] Bank of England / PRA, ‘PS16/24 — Operational resilience: Critical third parties to the UK financial sector’, November 2024. Available at: https://www.bankofengland.co.uk/prudential-regulation/publication/2024/november/operational-resilience-critical-third-parties-to-the-uk-financial-sector-policy-statement
