FCA’s AI guidance: what it means for startups and smaller firms

Long awaited AI guidance for financial service firms published

On 19 October 2026, the FCA published its long-awaited examples of good practice and areas for improvement in the use of AI in financial services. It is the clearest signal yet of what the regulator expects to see, and with the FCA reporting that 86% of firms now use AI, it is relevant to almost every business in the sector. 

In a large firm, this guidance lands with a model risk team, a CISO and a full compliance function. In a startup or SME (a fintech platform, a small trading firm, or a team building machine learning tools for financial services clients), it usually lands with a founder or a compliance lead who is already wearing several hats. 

The good news is that the FCA has included a specific smaller firm focus, and proportionate AI governance is very achievable without building bank-scale bureaucracy. 

Practical steps you can take now

None of this needs to be complicated. Here is where we would suggest starting: 

1. Build an AI inventory. List every AI and machine learning tool in use, including models you have built, vendor tools and generative AI used by staff. Record what each one does, who owns it, what data it uses and what decisions it influences. This is usually the first thing a regulator, auditor or customer will ask for. 
2. Assign clear ownership. Make a named senior manager (an SMF, for regulated firms) accountable for AI risk from the design stage, not after go-live. They don’t need to be technical, but they do need enough understanding, and training that goes beyond general awareness, to challenge the technical team. 
3. Govern before you deploy. Introduce a simple approval step for new AI tools covering the problem it solves, the risks, how it was tested and who signed it off. Involving people from across the business in testing and sign-off is specifically called out as good practice. 
4. Decide where AI stops. Document what each tool can support or automate, and when it should escalate to a person. Set specific intervention triggers and agree how often each tool will be reviewed. 
5. Monitor outcomes, not just performance. Accuracy metrics alone aren’t enough: check the tool is delivering the outcomes you intended and watch for model drift. Where large-scale testing isn’t feasible, the FCA notes that good-quality sample testing can work well for smaller firms. 
6. Test your vendors. Ask suppliers for evidence rather than reassurance, include contractual terms requiring advance notice of material model changes, and consider how you would keep operating if a key provider failed. 
7. Include AI in resilience planning. Map AI dependencies within your important business services and include them in scenario testing and contingency plans. 
8. Write it down. Keep an audit trail of decisions, approvals, reviews and changes. If you were asked tomorrow to explain your approach to AI governance, your documentation should be able to do it for you. 

How twoSB can help

At twoSB, we build fit-for-scale management systems for startups and SMEs, cutting out unnecessary bureaucracy and focusing on what genuinely needs to be in place. For AI governance, our support typically looks like: 

• AI governance review: a fixed-scope review of how your business uses AI, benchmarked against the FCA’s good practice examples, with a prioritised and practical action plan. 

• Framework implementation: a proportionate AI governance framework built around how you actually work, aligned to ISO 42001 and integrated with your ISO 27001 or wider information security arrangements where you have them. 

• Ongoing support: acting as your outsourced AI governance lead, keeping you up to date as the FCA’s expectations evolve, supporting reviews of new AI tools, and helping you respond to customer and investor due diligence questionnaires.