There is no separate FCA AI rulebook. Obligations follow the activity, the customer, the permissions and the use case, not the technology label, and not the sector on your website.
This map shows where to start looking. Every column links to its source so your compliance officer can check it rather than take our word for it.
| Firm type | Consumer DutyPRIN 2A | Advice & recommendation standardsCOBS 9 / 9A · MCOB · ICOBS | SM&CRSYSC 23–27 | Records, outsourcing & third partiesSYSC 8 / 9 · PSRs / EMRs where applicable From 18 Mar 2027 PS26/2 splits: incident reporting is broad (all Part 4A firms + PSPs); material third-party reporting is narrow (enhanced SM&CR, banks, designated investment firms, CASS large, authorised payment/e-money) | Operational resilienceSYSC 15A | UK GDPR & automated decision-makingArts. 5–35 · Arts. 22A–22D · DUAA 2025 · ICO ADM/AI guidance Automated-decision provisions bite only where a significant decision is made without meaningful human involvement | Vulnerable customersFG21/1 | EU AI Act2024/1689 · Art. 2 amended by 2026/1744 |
|---|---|---|---|---|---|---|---|---|
| Retail financial advice — IFAAdvising retail clients on investments | ||||||||
| Wealth & discretionary managementPortfolio management, mixed client base | ||||||||
| Mortgage intermediaryMCOB business | ||||||||
| Protection & general insurance intermediaryICOBS business | ||||||||
| VC — FCA-authorised managerProfessional / institutional investors only | ||||||||
| PE — FCA-authorised managerProfessional / institutional investors only | ||||||||
| Authorised payment or e-money institutionPI · EMI · RAISP | ||||||||
| Unregulated fintech / AI vendorSelling software into regulated firms | ||||||||
| Accountancy & professional servicesMay hold DPB or limited permissions |
The suitability rules address automation directly, and in terms:
"A firm that provides investment advice or portfolio management services (in whole or in part) through an automated or semi-automated system remains responsible for the suitability assessment required by this section. That obligation is not affected by the use of an electronic system in making the personal recommendation or decision to trade." COBS 9A.2.23 R — verified against handbook.fca.org.uk, 4 September 2026
Note what it does and does not say. It does not require a human to make every decision. It says the firm remains responsible. So the question is never "is the tool approved". It is "can the firm evidence how responsibility, oversight and suitability were maintained where automation was used". Every control we teach exists to answer that.
Selling AI into a regulated firm? Most of the FCA columns above do not bind you, and that is not the relevant question. Your customer's obligations become your commercial requirements.
A bank, wealth manager or advice firm will ask for evidence on governance, record-keeping, data protection, resilience, human oversight and client outcomes before your software touches client data. You may not be directly subject to their FCA rulebook, although GDPR and possibly the EU AI Act reach you in your own right. But if your product prevents them satisfying theirs, procurement is unlikely to approve you.
Cells in this table will move. Rather than repeat the timetable here, it lives on its own page: every dated change to 2028, what work each one creates, and who it actually binds.
The nearest change to this page: the ICO's guidance on Articles 22A–22D is still in draft consultation, so the data protection column is the first one likely to move.
Your sector tells you which questions to ask. It does not answer them. Five things settle your actual position: permissions, client classification, activities, where AI touches the file, and geography.
The readiness check walks through those five and returns a written report naming each gap and what closes it.
The evidence a regulated buyer will ask for before your software touches client data — ready in advance, rather than assembled during a procurement cycle.
PRIN 2A, COBS, MCOB, ICOBS, SYSC. Every chapter states its own application.
Including 9A.2.23 R on automated and semi-automated systems.
The operational resilience scope list, in the Handbook's own words.
Applies where the Principles apply, to retail customers who are natural persons.
Check Article 2 for territorial scope, and the authentic OJ text rather than a consolidated version.
Verification
This stays on the page in whatever state is true.
Read directly from the Handbook on 4 September 2026 and quoted verbatim above. It is a Rule, not guidance, last updated 23 October 2025. The corresponding provision for insurance-based investment products is COBS 9A.2.24 G.
Read directly from the Handbook on 4 September 2026:
An earlier draft of this page described "Article 22 restrictions". That is out of date. The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A–22D, and significant solely automated decisions on non-special-category data are now permitted more widely, subject to mandatory safeguards. Read at the ICO on 4 September 2026 — where the guidance itself is currently in draft consultation, so this column needs the earliest review date on the page.
The FCA describes SM&CR as reaching solo-regulated firms, and has separately proposed extending it to e-money and payments firms — which establishes that they are outside it now. Checked 4 September 2026. The pale cell in that row is therefore evidenced, not inferred.
Every URL resolves to the official page it claims.
Indicators reflect MoiraCorp’s assessment of where each regime is likely to be relevant to the stated firm type. Actual application depends on permissions, activities, client classification, territorial scope and use case. The regimes, cited provisions and forward dates themselves have been checked against primary sources and are linked above.
CP26/23 (FCA, 29 Jun 2026, closes 18 Sep 2026, final rules Q1 2027), PS26/2 (FCA, published 18 Mar 2026, applies 18 Mar 2027), the UK cryptoasset regime (FCA, final rules 30 Jun 2026, regime 25 Oct 2027) and Regulation (EU) 2026/1744 (adopted 8 Jul 2026, in force 27 Jul 2026) have each been read at source. High-risk AI application dates under amended Article 113: 2 Dec 2027 (Art. 6(2)/Annex III) and 2 Aug 2028 (Art. 6(1)/Annex I).
If you believe a cell is wrong, tell us. We will change it and say that we did.
Last regulatory review: 4 September 2026 · Next review: on publication of the FCA's good and poor practice material on AI, or 1 December 2026, whichever is sooner.
Regulatory mapping for operational planning, not legal advice. Applicability depends on permissions, activities, customers and facts. Primary sources are linked throughout; firms should confirm their own position with their compliance or legal advisers.
You know which rules reach your firm.Now see what is changing, when, and what work each change creates.
Track what is changing →
The matrix tells you which rules apply. Regulator-Ready AI turns that into your firm’s policy, the registers behind it and the accountability mapping — £1,495 for a firm licence covering five people, or we can do it with you and evidence it, priced on application.
