What Regulated Firms Must Govern in 2026

The Governance Gap Is Already Open

Three quarters of UK financial services firms have adopted some form of AI. The Bank of England and FCA's own joint survey, published in late 2024, confirmed the figure: 75% already using it, with a further 10% planning to do so within three years. And yet ask most compliance teams how their firm governs the content those AI tools produce (the customer communications, product disclosures, letters, and digital copy) and the answer is usually incomplete.

The tooling has arrived. The governance has not caught up.

The FCA has been consistent and unambiguous: there is no AI-specific rulebook coming. The existing regulatory framework: Consumer Duty, SM&CR, and the conduct rules already in force applies to AI-generated content in exactly the same way it applies to anything a human writes. Firms treating AI as outside the compliance perimeter are already exposed.

The FCA's Position: Existing Frameworks Apply, Full Stop

In its 2024 AI Update, the FCA confirmed it will not introduce AI-specific regulation. Jessica Rusu, the FCA's Chief Data, Information and Intelligence Officer, told the Treasury Committee that the regulator does not intend to:

"introduce prescriptive AI rules"

…but will embed AI oversight within current conduct and prudential standards. Law firm BCLP summarised the regulator's stance as:

"technology-neutral, principles-based, and outcomes-focused, relying on existing frameworks such as Consumer Duty, SM&CR, and operational resilience rules."

The FCA's own submission to Parliament was equally direct:

"The complexity of AI does not diminish their accountability for its use or its impact on consumers. We would not characterise this approach as one of wait and see. No new technology is without risk; we will support firms seeking to do the right thing, addressing harm where it occurs."

The practical consequence is straightforward: if an AI tool generates a customer communication that a consumer cannot understand, that is a Consumer Duty breach. It does not matter whether the content was written by a model or a member of staff. The Duty's cross-cutting rules on consumer understanding are not qualified by the method of production. AI-generated complexity is still complexity.

Senior Managers and Certification Regime (SM&CR): Senior Managers Cannot Delegate Away the Risk

In January 2026, the House of Commons Treasury Committee concluded that the FCA and other regulators were not doing enough to manage the risks AI poses to consumers. Its formal recommendation was that the FCA should, by the end of 2026:

"publish comprehensive, practical guidance for firms on: (a) the application of existing consumer protection rules to their use of AI; and (b) accountability and the level of assurance expected from senior managers under the Senior Managers and Certification Regime for harm caused through the use of AI."

That guidance has not yet arrived. The Committee's chair, Dame Meg Hillier, captured the concern bluntly:

"Based on the evidence I've seen, I do not feel confident that our financial system is prepared if there was a major AI-related incident and that is worrying."

In the meantime, the FCA has been clear about what the existing framework already requires. David Geale, the FCA's Executive Director for Payments and Digital Finance, told the Committee that senior managers should:

"demonstrate they understood and controlled risks within their areas of responsibility"

…and that this can be captured under the existing SM&CR framework without the need for a new senior manager function.

A senior manager cannot point to an AI model and disclaim responsibility for what it produced. If an AI tool was deployed without a systematic approach to reviewing output quality, and customers received communications they could not understand, the accountability trail leads directly to a named individual.

Why AI Content Creates Specific Intelligibility Risk

There is a structural reason why AI-generated content deserves particular scrutiny under the Consumer Duty: the way language models write is not the way most financial services customers read.

Ben Perkins, Director of Partnerships and Services at Plain Numbers, put it directly in a June 2026 analysis:

"The technology firms use to produce communications does not change what those communications need to achieve. Customers still need to understand what they are being told. That obligation does not change."

On the limits of what AI can reliably deliver, Perkins is equally direct:

"A list of rules cannot capture that. Neither can a language model - at least not with the level of understanding of a real person."

The scale risk compounds the problem:

"AI makes it faster and easier to produce more communication. Without the right human input, that also means it’s faster and easier to produce more communications that might not be any better for the customer. It could scale up current low customer understanding, and that means scaling confusion, complaints, and ultimately worse customer outcomes."

Notably, even AI tools themselves acknowledge the limitation. In researching his analysis, Perkins asked a leading AI model whether AI alone was sufficient to guarantee customer understanding. Its conclusion:

"AI can contribute to improving understanding of customer communications, but its success depends on how well it is integrated into a broader strategy that includes human oversight."

Why LLMs are not a Substitute for a Compliance-Grade Assessment

The intuitive response to the AI content governance problem is to use AI to solve it; to ask an LLM to assess whether a communication is clear enough. Amplifi's own research demonstrates why that approach creates more risk than it removes.

The fundamental issue is architectural. As Amplifi's analysis of LLMs and compliance risk sets out, LLMs are probabilistic systems: they predict the next most likely word based on patterns in training data, rather than applying fixed rules against a defined standard. That probabilistic nature makes them inherently unreliable as assessment tools.

Amplifi tested this directly. When ChatGPT was asked three times to score the same publicly available credit card agreement using identical prompts, it returned three materially different intelligibility scores each time. Gemini, when asked to provide an Amplifi intelligibility score for the same document, it ‘assumed’ an estimated score of 71–90. The actual Amplifi score, produced by its deterministic Cognitive Risk Engine™, was 55. As Amplifi's research concludes:

"False positives create risk. The LLM score could lead firms to believe their communications are intelligible, when in reality, they have complexity which creates confusion and anxiety."

The compliance consequence is direct: an LLM-generated assessment cannot serve as evidence of Consumer Duty compliance precisely because it is not reproducible. The FCA requires firms to demonstrate that they have objectively tested their communications. A score that changes on every run cannot support that demonstration.

There is a second, equally significant problem. LLMs are optimised for readability so surface fluency, rather than intelligibility. These are not the same standard, and only one of them is the legal requirement. As Amplifi's analysis of ChatGPT and regulated communications explains:

"Readability scores measure surface features, like sentence length and word difficulty. But in regulated communication, that's not what matters. Clarity isn't about simpler words. It's about whether the reader understands the context, the consequences, and what to do next."

The regulatory grounding for this distinction is explicit. The FCA Handbook requires that communications use 'plain and intelligible language' (CONC 3.3.2). The Court of Justice of the European Union has held that a term must 'allow the consumer to evaluate, on the basis of clear, intelligible criteria, the economic consequences for them.' Readability is not recognised in law. Intelligibility is.

The third problem emerges when LLMs are used not just to assess but to simplify, and then to assess their own simplified output. Amplifi's head-to-head comparison of Amplifi and Microsoft Copilot in Word found that Copilot's self-assessment of its own simplified text was materially overstated. In one test, Copilot scored a simplified press release at 82/100; Amplifi's objective assessment of the same document returned 50/100. As the study concluded:

"MS Copilot significantly over-scored its own work… This creates a material compliance risk by providing false evidence of clarity."

The same study found that Copilot improved a credit card agreement's intelligibility score by 31% on Amplifi's scale. Amplifi's own simplification tools, working paragraph by paragraph on the same document, produced a 66% improvement; more than double, with a traceable audit trail attached to every intervention.

The content governance challenge extends beyond individual documents. Amplifi's analysis of AI-generated content governance identifies the core problem firms face as fragmented governance: when communication is spread across multiple teams, departments, and external partners, consistency collapses. Without a centralised mechanism to enforce language standards, firms risk not just regulatory scrutiny but a fundamental failure of their duty to help customers understand the products they are buying. As Amplifi's research on content governance notes:

"As firms adopt AI to speed up drafting, the risk of 'hallucinated' brand tones or unapproved phrasing increases."

The solution is not to avoid AI in the content workflow, it is to ensure that AI-generated content passes through a compliance-grade assessment before it reaches customers, and that assessment produces the same result every time.

Where Amplifi Sits in This Framework

Amplifi is the only technology that assesses AI-generated content for intelligibility risk against the same regulatory frameworks as human-authored content.

The platform's Cognitive Risk Engine™ analyses communications for the factors that drive consumer misunderstanding: sentence complexity, vocabulary accessibility, structural clarity, and cognitive load, and produces an intelligibility score mapped to FCA Consumer Duty expectations. It applies the same methodology regardless of whether content was written by a person or generated by a model. The Consumer Duty does not distinguish between the two, and nor does Amplifi.

This matters because it closes the governance gap AI adoption has created, and because it creates an evidence trail. When the FCA asks how a firm satisfied itself that its communications met the consumer understanding requirement, an assessment record produced at the point of approval is the kind of answer that demonstrates genuine governance rather than aspiration.

What Good AI Content Governance Looks Like in 2026

The following checklist covers the components the FCA is most likely to probe in a supervisory review, and directly addresses the accountability questions the Treasury Committee guidance on SM&CR assurance for AI-related harm has raised.

Assessment methodology

• Every AI-generated customer communication is assessed for intelligibility before approval, using a defined methodology aligned to Consumer Duty outcomes
• The assessment applies consistent criteria regardless of whether content was AI-generated or human-authored
• Conceptual complexity, ambiguity, language clarity, and structural clarity are each evaluated, not just surface-level readability

Approval workflow

• No AI-generated customer communication is published or sent without passing through a documented approval workflow
• The workflow includes compliance or regulatory sign-off for high-risk communication types (product disclosures, terms and conditions, key information documents)
• Approval is conditional on meeting defined intelligibility thresholds, not just legal accuracy

Evidence trail

• Assessment results are logged and retained for each communication, creating an auditable record
• The record captures: the communication, the assessment score, who approved it, and the date
• This evidence is accessible for FCA supervisory review without requiring manual reconstruction

Board-level accountability

• A named Senior Management Function (SMF) holder has oversight responsibility for AI content governance, consistent with the FCA's expectation that senior managers demonstrate they understood and controlled risks within their areas of responsibility
• The board receives periodic reporting on AI content output quality, including intelligibility metrics
• AI content governance is explicitly referenced in the firm's Consumer Duty monitoring and reporting framework

Ongoing monitoring

• Post-publication monitoring is in place to detect intelligibility issues at scale (through complaints analysis, customer feedback, or outcome testing)
• The firm has a defined remediation process where AI-generated content is found not to meet the standard

The Regulatory Clock Is Running

The FCA has not built a new rulebook for AI. It has pointed at the rulebook that already exists and made clear that it applies. Consumer Duty is live. SM&CR accountability is live. The outcomes the regulator expects from customer communications do not change because the production method has.

Treasury Committee guidance on SM&CR assurance for AI-related harm is expected by the end of 2026. As Freshfields observed in its analysis of the FCA's position, regulatory flexibility does not mean a lack of scrutiny. Plain Numbers' Ben Perkins frames the practical challenge:

"The firms that will use it well are the ones that treat it as a tool within a process, not a replacement for one."

Firms still building governance frameworks around their AI content tools need to move from principle to process. Not as a future project. As a current compliance requirement.

Amplifi helps regulated firms assess and improve the intelligibility of AI-generated and human-authored communications for FCA Consumer Duty compliance. To see how the Cognitive Risk Engine™ applies to your AI content workflow, speak to the team at amplified.global/contact

Sources

• FCA, AI Update, April 2024

• FCA, Response to the Treasury Select Committee on AI in Financial Services, April 2026

• House of Commons Treasury Select Committee, AI in Financial Services: First Report, January 2026

• Bank of England / FCA, Artificial Intelligence in UK Financial Services: 2024 Survey, November 2024

• Jessica Rusu (FCA Chief Data, Information and Intelligence Officer), oral evidence to Treasury Committee, 2025 - via BCLP analysis

• David Geale (FCA Executive Director, Payments and Digital Finance), oral evidence to Treasury Committee - via Global Regulation Tomorrow

• BCLP (Bryan Cave Leighton Paisner), AI Regulation in Financial Services: Turning Principles into Practice, December 2025

• Freshfields, Navigating the New Regulatory Momentum: AI in UK Financial Services, 2025

• Ben Perkins, Exploring the Role of AI in Addressing the Customer Understanding Challenge, Plain Numbers, June 2026

‍