Partial Understanding: artificial intelligence in insurance, wealth management and financial services

Artificial intelligence in financial services has reached three quarters of regulated firms, and almost half of them told their own supervisors they understand it only partially.

Nothing in this article constitutes legal, regulatory or financial advice. It is offered to support discussion and further review with qualified advisers.

Who is accountable for artificial intelligence in financial services?

No rule allocates it, so each firm names a senior manager itself. The Financial Conduct Authority has ruled out new AI rules and relies on existing frameworks including the Consumer Duty and the Senior Managers and Certification Regime, though it has created no senior management function and no prescribed responsibility for artificial intelligence. On my reading, which the regulator does not state, the allocation is internal work.

• Surveying 118 regulated firms in November 2024, the Bank of England and the FCA found 75 per cent already using artificial intelligence and a further 10 per cent planning to adopt within three years.
• Asked how well they understood what they had deployed, 46 per cent of those firms reported partial understanding against 34 per cent claiming complete understanding.
• An FCA blog of 8 June 2026 stated that the regulator will not introduce new regulations for AI and will rely on existing frameworks including the Consumer Duty and the Senior Managers and Certification Regime.
• The Treasury Committee reported on 20 January 2026 that the wait-and-see approach of the three authorities is “exposing consumers and the financial system to potentially serious harm”.
• HM Treasury designated four critical third parties from 13 July 2026, all of them cloud and infrastructure providers, and no model provider has been designated.

What are the FCA expectations on AI, and who disagrees with them?

The FCA’s approach page of 13 February 2026 gives the reasoning for making no new rules, which is that with a fast-moving technology this best supports UK growth and competitiveness. The Consumer Duty consultation now running, CP26/23 of 29 June 2026, carries no AI-specific provisions, so the link between artificial intelligence and the Duty sits in commentary and not in the rules. Parliament objects. The Treasury Committee asked on 20 January 2026 for comprehensive guidance by the end of 2026 on senior manager accountability. The FCA only partially accepted on 16 April 2026, declining that guidance and citing its principles-based and outcomes-focused approach along with what it described as widespread industry support for the existing framework.

The regime works by allocation, since responsibilities go to named people holding a statement of responsibilities, and a supervisor can then hold a person to account. No senior management function for artificial intelligence exists, and no prescribed responsibility for it exists. The FCA’s page goes as far as saying that its rules emphasise accountability for senior managers and are relevant to the safe use of AI, a claim about relevance that leaves the allocation to firms. I would put it more strongly than either the regulator or the Committee does. An unallocated responsibility produces an argument after the event about which senior manager should have owned the thing, probably resolved against whoever held the operational function that failed.

Where do the Consumer Duty and AI actually meet?

They meet at the evidence. The Duty asks firms to design products that meet their target customers’ needs, provide fair value, and communicate and support accordingly. Nothing in that formulation mentions technology, which is why the FCA regards it as adequate. The difficulty is evidential. General insurance pricing is the one place with a full cycle of evidence, running from PS21/5 of May 2021, which found six million policyholders paying high prices in 2018 and £1.2bn of savings forgone, through the remedy of 1 January 2022 to the evaluation EP25/2 of July 2025. Covering 16 home insurers and 13 motor insurers from the first quarter of 2019 to the first quarter of 2024, it found the home gap between existing and new customers almost halved, from £95.38 to £49.17, with no statistically significant movement in home prices at all. Motor prices fell by a statistically significant £6.63 per policy, giving a central ten-year monetised saving of £1.6bn against a range from £163m to £3.0bn. Data limitations left the FCA unable to specify which groups benefited more and which less.

When does a human review count as meaningful human involvement?

Nobody can say yet, and that is an operational fact with consequences. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D on 5 February 2026, and Article 22A provides that a decision is based solely on automated processing where there is no meaningful human involvement in taking it. The Act supplies no definition. Article 22D leaves that to regulations the Secretary of State has yet to make, and the Information Commissioner’s Office consulted on draft guidance in 2026 without publishing it. My own prediction, which no published guidance supports, is that the definition will turn on whether the reviewer had the information to judge, the authority to differ and the time to do either. Override rates and review durations get logged as they happen or not at all.

Why does AI in insurance underwriting sit near the bottom of a credible portfolio?

Underwriting carries strong commercial appetite and weak demonstrable value. Pricing accuracy compounds across a portfolio, so the appetite is understandable, while the feedback loop is long, because a decision made today is validated by claims experience over a year or more. The fairness exposure is high. Two United States mortgage studies are the strongest causal work available, and the counterfactual simulation among them attributed the increase in disparity primarily to greater model flexibility, a mechanism that survives removing protected variables and obvious proxies. Both are pre-LLM mortgage studies, and neither transfers automatically to UK insurance or advice. For life and health cover, point 5(c) of Annex III to the EU AI Act treats risk assessment and pricing of natural persons as high risk, with conformity assessment obligations from 2 December 2027 where output is used in the Union.

Financial crime investigation sits at the top of the same portfolio, since the work is document-heavy, the output is a narrative supported by evidence, and historical cases with known outcomes give an evaluation set nobody has to build. Wealth management automation occupies the middle ground. The FCA’s survey of roughly 400 wealth firms, published on 18 August 2026 with data as at 31 December 2024, found 13 per cent using AI tools, rising to 45 per cent once firms considering them in the following 12 months were included.

Which firms does model risk management actually cover?

The Prudential Regulation Authority’s supervisory statement SS1/23 is the closest thing UK financial services has to a model risk rulebook, and it applies to UK-incorporated banks, building societies and PRA-designated investment firms holding internal model approval. Insurers fall outside it, and a wealth manager is nowhere near it. Within scope it covers all models used to inform business decisions, including vendor models, and expressly captures machine learning. The Bank of England’s roundtable summary of 16 February 2026 records firms saying that validating how inputs mapped to outputs was not tenable or fully effective for increasingly complex AI models, and that the emphasis needed to shift towards outcome-focused monitoring and guardrails. Concentration is deepening at the model layer, yet the July 2026 designations reached the 73 per cent the 2024 survey found in cloud provision and left the 44 per cent in models outside.

Who pays for the verification?

What decides whether a deployment pays is the time somebody spends checking the output, and that cost is a design property. In the deployments I have worked on the licence is rarely more than a quarter of the first-year cost, with the balance going to integration, permissions, evaluation, monitoring and second-line review. That is a practitioner observation from a handful of engagements. The time-saved side is weaker still, because 16 experienced developers in a randomised trial were slowed by 19 per cent and still believed they had been 20 per cent faster, yet self-reported time saving remains the standard measure in this sector’s pilots. A source link on an output converts verification from re-performance into spot-checking, and a system that abstains when retrieval returns nothing relevant turns a plausible wrong answer into a visible gap. Both claims are structural arguments resting on practitioner experience, and I could locate no published measurement of either.

Everything here turns on one gap the FCA’s strategy cannot close by itself. That strategy depends on the Senior Managers and Certification Regime doing work that only allocation can make it do, while no seat for artificial intelligence has been created inside that regime. A firm that names the accountable person now, and writes into a statement of responsibilities what that person answers for, will find every later rule cheap to meet.

Underneath the allocation sit a discovery problem and a measurement problem. A third of live use cases were somebody else’s implementation on the 2024 count, more arrived as features switched on inside licensed software, and nobody can validate a model they have not found, so the licence estate and a walk round the floor beat a questionnaire. Cohort measurement has to be designed in on day one, because who benefited has no retrospective answer.

Two developments would change the position taken here. Published FCA expectations on AI covering senior manager accountability would turn anticipation into compliance, and a fresh edition of the joint survey would show whether comprehension has improved against the 46 per cent who reported partial understanding. Until they arrive, the firms treating Consumer Duty and AI as a data question and keeping model risk management proportionate to consequence will be the ones able to show their working.

Frequently asked questions

What did the Bank of England and FCA survey find about how well firms understand their AI?

Surveying 118 regulated firms across six sectors in November 2024, the two authorities found 75 per cent already using AI and 10 per cent planning to adopt. Asked about their understanding of what they had deployed, 46 per cent reported partial understanding and 34 per cent complete understanding.

Has the Financial Conduct Authority introduced specific rules for artificial intelligence?

It has ruled that out in terms. A blog of 8 June 2026 stated that the FCA will not introduce new regulations for AI and will rely on existing frameworks including the Consumer Duty and the Senior Managers and Certification Regime. The Consumer Duty consultation CP26/23 of 29 June 2026 carries no AI-specific provisions.

What does meaningful human involvement mean under the Data (Use and Access) Act 2025?

The phrase decides whether a decision counts as solely automated under Article 22A of the UK GDPR, as substituted on 5 February 2026, and no authoritative meaning exists for it. Article 22D leaves the definition to regulations the Secretary of State has yet to make, and the Information Commissioner consulted on draft guidance in 2026 without publishing it.

Does the PRA’s model risk management statement apply to insurers?

No. SS1/23 applies to UK-incorporated banks, building societies and PRA-designated investment firms holding internal model approval for regulatory capital, so insurers sit outside its scope, as do banks without those permissions. Within scope it covers all models used to inform business decisions, includes vendor models, and captures machine learning.

Has any AI model provider been designated a critical third party?

None has. HM Treasury designated four critical third parties from 13 July 2026, all of them cloud and infrastructure providers. The 2024 joint survey found the top three providers accounting for 73 per cent of named cloud provision and 44 per cent of models, so the regime reaches the first figure and not the second.