The FCA is explicit about status. The examples are illustrative and non-exhaustive, and they do not create new requirements. Read together, the areas for improvement describe firms that could not later demonstrate what they had done.

Firms that did well mapped AI responsibilities across senior management functions and kept, in the FCA's words, auditable records of decisions, including rationale, challenge, and escalation. Firms with room to improve had decisions on AI tools that were poorly documented, with limited audit trails or supporting rationale. Responsibilities were unclear, fragmented or overly diffused, especially between technology and business teams. In some firms senior managers handed AI development entirely to technical teams, which the FCA calls particularly concerning for consumer-facing, higher-risk uses.

The FCA does not ask for technical depth. It says it does not expect senior managers to be technical specialists. It expects them to take reasonable steps to understand the risks in their area, obtain expertise where needed, and provide effective challenge. Reasonable steps is the language of the senior manager's duty of responsibility, under which a senior manager can be held accountable if they did not take reasonable steps to prevent or stop a breach in their area.

Reasonable steps are shown by what was done and when. A step nobody recorded is hard to tell from a step never taken.

Statisticians distrust a hypothesis chosen after the results are in. A study registered beforehand can be trusted because the choice was fixed and dated first. A rationale written after the outcome is selected to fit it, however sincere its author. In a speech the same day, the FCA's Jessica Rusu said some firms retrofit governance after the technology has been deployed.

A rationale written after the outcome is known is a story, not a record.

Delegating to the technical team feels prudent. The team knows the model, so the senior manager takes its assurance. That is borrowed assurance: confidence held on someone else's word and never tested by the holder. It is comfortable until a supervisor, an insurer or a court asks what the senior manager did to challenge it. "We were told it was fine" is an account of what was said. It is not a record of what was asked.

The pattern runs outward to suppliers. The FCA lists untested vendor assurances among its areas for improvement and says firms remain accountable for outsourced AI services. One case it describes is a firm that built an AI-enabled product around a particular model without establishing a viable alternative. When the model was retired, the firm had to redesign the product. Notice of model changes, which the FCA counts as good practice to secure by contract, tells a firm that a change is coming. It does not supply the substitute. The vendor notices of recent weeks, which start what this series has called the second clock, are the same pattern at speed.

Banana growers lost the Gros Michel to Panama disease in the 1950s and 1960s and carried on because the Cavendish could be planted in its place. A crop that depends on one variety has not decided anything about that dependence. It has inherited it.

A model you cannot replace is a decision someone else has made for you.

An IBM-commissioned survey, fielded by Censuswide in September, shows the scale. Of 3,221 executives at organisations of 1,000 or more employees, in the UK, five other European countries, Saudi Arabia and the UAE, 80 per cent said an AI-related incident had reached their board or C-suite in the past year. Fewer than half of those organisations, 40 per cent, changed their governance policy or framework in response. IBM sells governance products, so read this as a vendor's survey, though the sample is large and the pattern matches the FCA's.

A board that hears about an incident has been informed. It has not necessarily decided anything. Aviation draws the line cleanly: an occurrence report that changes no procedure is a log, not a safety system. The report earns its place when the next crew flies differently.

Escalation without a recorded decision is a log, not governance.

Four questions, none technical.

First, for each AI use in a regulated activity, which senior manager owns the risk from design onwards, and where is that written down?

Second, where is the dated record of their challenge: what they asked, what they were told, and what they decided?

Third, which assurances do they hold on someone else's word, the technical team's or the supplier's, and on what date was each tested?

Fourth, when a model changes or is retired, who decides, and what is the fallback?

None of this needs a new rule. A board that cannot answer the four questions does not need one to know it has a problem.

A senior manager is expected to show challenge, not to explain the model.

This is a practice, not a policy: a named owner for each use, a dated record of what was asked and decided, and a standing test of every assurance held on someone else's word. If the FCA asked tomorrow what you did to challenge the AI in your area, what would you hand over, and when was it written?

Roche-Review. Executive Governance, with Human Observability.

Sources: FCA, AI in financial services: good practice and areas for improvement (published 19 October 2026); FCA, Building the future of finance in the age of AI, speech by Jessica Rusu (19 October 2026); FCA, Senior Managers Regime page (duty of responsibility); IBM, EMEA enterprise AI governance study, Censuswide fieldwork 14 to 24 September 2026; Encyclopaedia Britannica, Gros Michel.

The Roche-Review is the weekly publication of Dr Ivan Roche FRSS FRSA MInstP, Founder of Otopoetic Limited. Subscribe at roche-review.com.