FCA and HKMA AI updates: retain the answer and the authority to act

The brief

The FCA published practical AI examples on 19 October, including consumer communications and the records needed to investigate problems. It says the examples create no new requirements. Separately, Hong Kong’s monetary authority announced its ART framework on 15 October, including further work on agentic AI governance. FCA examples. HKMA announcement.

These are different regulatory publications in different jurisdictions. Our analysis identifies a shared operational question: can a firm explain what its system told a customer and what it was permitted to do next? Preserve the answer and its supporting material, identify the responsible reviewer, and make escalation workable. A useful explanation should describe the effect on the customer, rather than depend on technical language alone.

The full record

The FCA’s consumer-understanding examples discuss reviewed rewrites, approved source material, testing and escalation. They also describe retaining prompts, outputs, model versions and relevant controls to support investigations. The examples are illustrative and non-exhaustive. Read the FCA’s consumer-understanding section.

HKMA’s ART announcement covers supervisory guidance, a training-data initiative and further sandbox work. A discussion paper on agentic AI governance is still forthcoming. Its proposed agent registry and intervention mechanisms should not be reported as a completed new rulebook. Read the 15 October release.

Our analysis: reconstruct one customer exchange

Start with a fictional customer question that leads to an important decision. Retain the exact answer supplied, the source material available at that moment and the person or process that approved release. Ask a reviewer to explain what the customer could reasonably do after reading it.

Then change one underlying fact. Can the team identify the affected answer and prevent further use of the old version? The proposed test concerns the connection between source, output and correction. A general statement that a model is monitored does not reveal whether this particular exchange can be reconstructed.

Separate explanation from permission

For a system that can take actions, record the boundary of the task. Preparing a message, sending it and carrying out the instruction it describes should each have an identifiable authorisation path. If a user asks a question, do not assume the question also authorises an associated transaction.

Use a controlled test in which the requested action exceeds that boundary. Check whether the process stops, routes the issue to the right person and preserves the reason. Record the result as a finding about the tested configuration; do not extrapolate it into a guarantee about every deployment.

Make the human handover useful

A reviewer receiving an escalation needs the customer’s question, the proposed answer, the relevant source and the unresolved point. Passing only a transcript can leave the reviewer to discover the problem from scratch. Define what a completed review means and who may communicate its outcome.

The immediate takeaway is to keep the customer-facing answer and the authority behind any following action connected. Neither publication establishes that a particular product achieves that result. It is something a firm should be able to demonstrate in its own workflow.

Read the FCA examples dated 19 October and HKMA release dated 15 October 2026. This article compares their communication implications, not their legal equivalence. We have not reviewed HKMA’s full supervisory guidance or its forthcoming discussion paper and make no clause-level claims about them. Proposed exercises are unperformed editorial tests.

1. FCA: AI in financial services, good and poor practice, 19 October 2026
2. HKMA: ART framework announcement, 15 October 2026