FCA and CySEC brokers can strengthen AI governance with a three-layer architecture — policy, retrieval and evaluations — designed before launch. Each AI-touched customer surface should map to firm-approved controls, retained evidence and accountable human ownership. The firm’s qualified compliance owners determine whether the implementation meets its obligations.
Compliance is architecture, not review
The most common failure mode we see is treating compliance as a review gate at the end. That is where AI pilots die. Compliance survives when it is architecture — a policy layer defining what the AI is allowed to do, retrieval scoped to approved sources, and evals continuously proving the system stays within the envelope.
Related questions
Does the FCA have specific AI rules?
Not a standalone AI rulebook. Consumer Duty, SM&CR, financial-promotion regs, model risk management principles and vulnerable-customer standards all apply. The three-layer architecture maps to all of them by construction.
CySEC-specific expectations?
Governance and audit-trail depth, particularly around client-facing automation. The same architecture applies.
SMF ownership of AI?
Named SMF holder responsible per system, documented in the policy layer.
How is this different from manual?
Stronger audit trail, faster to evidence, easier to sign off on new automations once the envelope is in place.
How does the £15k Diagnostic address this?
The Diagnostic includes a control-mapping artefact against your regulator that becomes the foundation for the build.
Compliance-safe AI is not slower AI. It is faster, because once the envelope is in place, new automations ship in weeks not quarters.
The £15k AI Diagnostic produces the control map and the costed build plan.