Creating opportunities with AI while managing consumer risk

FROM COMPLIANCE TOOL TO CUSTOMER-FACING TECHNOLOGY

When financial institutions first adopted artificial intelligence, its primary role was often linked to compliance and risk management. AI helped firms monitor regulatory obligations more efficiently, for example by analysing sales calls and identifying potential compliance breaches that might otherwise have gone unnoticed.

Since the launch of ChatGPT in late 2022, however, the role of AI has evolved significantly. Consumers are increasingly using AI not only as a back-office tool but also as a source of financial information, education and guidance. Today, AI is being used across highly specialised sectors, including financial services, law and healthcare, to help individuals access and understand complex information.

According to the OECD's 2026 report Artificial Intelligence and Personal Finance, more than half of adults in the United Kingdom reported using AI to help manage their finances during the previous 12 months. While ChatGPT remained the most commonly used platform, AI tools provided directly by financial services providers already accounted for 32% of usage. This is a notable development for financial institutions, as it suggests that AI is increasingly becoming a customer-facing channel rather than merely an internal compliance tool.

OPPORTUNITIES AND RISKS

The OECD found that consumers are using AI across a range of financial activities, including saving and investing, budgeting and money management, retirement planning and insurance. AI can assist consumers in comparing products, understanding complex financial information and making more informed financial decisions, creating new opportunities for customer engagement and service delivery. At the same time, the OECD highlights a number of risks associated with AI-powered financial services, including a lack of explainability, hallucinations and inaccurate information, biased recommendations, and increased exposure to scams and fraud. These risks may initially appear to be consumer issues, but they can quickly become regulatory risks for financial institutions. Where customers experience harm as a result of AI-enabled services, firms may find it difficult to distance themselves from responsibility simply because the output was generated by technology rather than a human adviser.

THE FCA'S APPROACH TO AI

The FCA's response to these developments has been to maintain a principles-based and outcomes-focused approach to AI. Rather than introducing a separate AI-specific regulatory framework, the FCA has confirmed that it intends to rely on existing regulatory obligations when assessing firms' use of AI.

For financial institutions, this approach presents both opportunities and challenges. On the one hand, the absence of detailed AI-specific rules provides greater flexibility to innovate and adapt to technological developments. On the other hand, firms remain subject to broad obligations relating to customer outcomes and consumer protection. As customer-facing AI becomes more prevalent, understanding the Consumer Duty is therefore becoming increasingly important.

THE CONSUMER DUTY AND AI

At its core, the Consumer Duty requires firms to act to deliver good outcomes for retail customers. The Duty is built around a Consumer Principle, supported by three cross-cutting rules and four customer outcomes.

The three cross-cutting rules require firms to:

• act in good faith towards customers;
• avoid foreseeable harm; and
• enable and support customers in pursuing their financial objectives.

Although the Consumer Duty was not designed specifically with AI in mind, it provides a useful framework for understanding how the FCA may assess AI-related risks.

For example, firms deploying AI tools should consider whether customers are being provided with information that is clear, accurate and genuinely helpful. The requirement to avoid foreseeable harm may be particularly relevant in the AI context. Firms may need to consider risks arising from inaccurate outputs, model bias, third-party technology failures, cybersecurity incidents or customer over-reliance on AI-generated information.

The Duty may also require firms to consider the needs of vulnerable customers. If a firm can reasonably anticipate that certain customers may struggle to understand lengthy disclosures or complex AI-generated explanations, additional support may be required. This could include simplified communications, visual explanations, alternative communication channels or easier access to human assistance.

The four outcomes under the Consumer Duty are equally relevant:

1. Products and Services – firms should ensure products and services are designed for and distributed to the appropriate target market.
2. Price and Value – customers should receive fair value in return for the price they pay.
3. Consumer Understanding – customers should be provided with information they can understand and use to make informed decisions.
4. Consumer Support – customers should receive appropriate support throughout their relationship with the firm.

In practice, these outcomes provide a useful lens through which firms can assess customer-facing AI solutions. Financial institutions should consider whether AI-enabled services remain suitable for their intended customers, whether they deliver fair value, whether consumers understand the information they receive, and whether adequate support remains available when required.

Importantly, these expectations are not new. The Consumer Duty was not created to regulate AI. Rather, AI is testing how existing consumer protection principles apply in a new environment. As AI becomes increasingly embedded in customer interactions, questions of accountability may become more complex, particularly where third-party technology providers or sophisticated AI models are involved. The FCA's response has not been to create a separate AI rulebook, but instead to emphasise that existing standards, including the Consumer Duty, continue to apply.

CONCLUSION

For financial institutions, the message is clear: the key regulatory question is not whether a firm uses AI, but whether its use of AI delivers good outcomes for customers. Firms that can successfully combine innovation with strong governance, effective risk management and a clear focus on customer outcomes are likely to be best placed to realise the opportunities presented by AI while managing the associated risks.