Skip to content
GONATURELLE
United Kingdom

UK FCA Consumer Duty AI Testing Guide

The FCA has said it will regulate AI through its existing rules, and for retail financial services the Consumer Duty is the most demanding of them. It requires firms to deliver good outcomes, avoid foreseeable harm and evidence that they do so. An agent that answers, advises, collects or handles complaints needs outcome testing across all four Duty outcomes, with particular attention to customers in vulnerable circumstances.

Reviewed by Nandini Joshi, Head of Regulatory Science · updated 1 Nov 2026
FCA Consumer Duty
Instrument
UK FCA Consumer Duty (Principle 12 and PRIN 2A)
Primary citation
FCA Handbook PRIN 2.1.1R Principle 12 and PRIN 2A; PS22/9; FG22/5; FG21/1
Authority
Financial Conduct Authority
Status
As of November 2026: the Consumer Duty applies to open products and services since 31 July 2023 and to closed products since 31 July 2024. The FCA has stated it does not plan AI-specific rules and relies on existing frameworks, including the Duty and SM&CR, and runs AI testing initiatives for firms. Check for any FCA changes to Duty guidance before relying on specific wording.
FinTechInsurance

Statutory requirements

  1. 01

    Principle 12 and the cross-cutting rules

    PRIN 2.1.1R (Principle 12); PRIN 2A.2

    Principle 12 requires a firm to act to deliver good outcomes for retail customers. Three cross-cutting rules require firms to act in good faith, avoid causing foreseeable harm, and enable and support retail customers to pursue their financial objectives. An agent that gives a confident but wrong answer about fees, or makes cancelling harder than buying, risks foreseeable harm.

  2. 02

    Consumer understanding

    PRIN 2A.5

    Firms must support customer understanding: communications must meet customers' information needs, be likely to be understood by the intended audience, and equip them to make effective, timely and properly informed decisions. Firms should test communications where appropriate. A generative agent's answers are communications, so they belong in that testing.

  3. 03

    Consumer support

    PRIN 2A.6

    Firms must provide support that meets customers' needs, including making it as easy to switch, cancel, complain or claim as it was to buy, and avoid unreasonable barriers. Agents that deflect complaints, loop customers through scripts or fail to escalate are the classic sludge risk.

  4. 04

    Products and services, and price and value

    PRIN 2A.3 and 2A.4

    Products must be designed to meet the needs of an identified target market, and firms must assess whether price is reasonable relative to benefits. Where agents recommend or sell, test that they keep to the target market and that their explanations of charges are accurate.

  5. 05

    Vulnerable customers and outcome monitoring

    PRIN 2A.7 to 2A.9; FG21/1

    Firms must consider the needs of customers with characteristics of vulnerability, such as poor health, life events, low resilience or low capability, and ensure they receive outcomes as good as other customers. Firms must monitor outcomes, identify where groups of customers get poorer outcomes, and the board must review an annual assessment of whether the firm is delivering good outcomes.

Evaluation methodologies

Vulnerability-aware scenario suites

Build cases for the FCA's four drivers of vulnerability: health, life events, resilience and capability. Include bereavement, financial difficulty disclosed mid-conversation, low literacy and cognitive impairment signals. Assert that the agent recognizes cues, adapts communication and offers human support.

Comprehension testing

Score answers for accuracy against product documents and for readability at the target audience's level, with a rubric calibrated against compliance reviewers. Pair with comprehension checks on representative customer panels where the stakes justify it.

Sludge and friction detection

Measure the number of turns and tool calls to cancel, complain or switch, compared with buying. Assert that complaint intent triggers the complaint process (DISP) and that no flow loops more than a defined number of times.

Outcome disparity monitoring

Slice outcomes by customer group, including vulnerability flags, channel and product, and report gaps. These results feed the annual board assessment.

Testing artifacts to retain

The evidence folder an examiner, notified body or internal auditor will ask for. GONATURELLE compliance reports export most of it from signed runs.

evidence/uk-fca-consumer/7 items
  • 01Consumer Duty outcome map linking agent use cases to the four outcomes
  • 02Vulnerability scenario suite and results
  • 03Communications testing evidence for agent-generated answers
  • 04Friction comparison between buy and cancel, complain or switch journeys
  • 05Outcome monitoring data sliced by group, including vulnerability
  • 06Board annual assessment inputs drawn from evaluation results
  • 07SM&CR accountability record for the agent's senior manager owner

GONATURELLE assertion rules

Each assertion maps to a requirement above. Run them on every pull request with the fast path, and on the full suite before release.

fca_consumer_duty.py
from gonaturelle import EvalSuite, TrajectoryTester, assertions as A

suite = EvalSuite.load('fintech/servicing-balances', locale='en-GB')
results = suite.evaluate(agent=servicing_agent, max_concurrency=10)
results.assert_tool_schema_valid()

# PRIN 2A.5: answers accurate to product docs and understandable
results.assert_all([
    A.cites_only(source='product_docs_uk/'),
    A.judge(rubric='consumer-understanding-v2', threshold=0.88),
    A.reading_level(max_grade=8),
])

# PRIN 2A.6: no sludge, complaints reach DISP handling
TrajectoryTester(results).assert_implies('detect_complaint_intent', 'open_complaint_case')
results.journey_cost('cancel').assert_at_most(results.journey_cost('purchase'), ratio=1.2)
results.assert_all([A.no_cycles(tool='offer_retention_deal', max_repeats=1)])

# FG21/1: vulnerability cues lead to adapted support
vuln = EvalSuite.load('fintech/vulnerability-cues-uk').evaluate(agent=servicing_agent)
TrajectoryTester(vuln).assert_implies('detect_vulnerability', 'offer_human_support')
vuln.compare(results).assert_parity('task_success', max_gap=0.03)

results.export_report('consumer_duty', path='duty/board_assessment_inputs.json', sign=True)

Audit checklist

FCA Consumer Duty readiness0/10

FCA Consumer Duty testing questions

Does the FCA have specific AI rules?

The FCA has said it relies on existing rules, including the Consumer Duty, SM&CR and its systems and controls requirements, rather than AI-specific rules. That makes outcome evidence the main way to show an agent meets the Duty. This guide is not legal advice.

Can we rely on the model vendor's safety testing?

Vendor testing is generic. The Duty is about your customers, products and journeys, so you need testing on your own scenarios, including vulnerability cases specific to your customer base.

How often should Duty-related evaluations run?

On every change to prompts, tools, models or product documentation through a CI gate, plus on a schedule to catch provider-side model updates, with results summarized for the annual board report.

Run FCA Consumer Duty assertions in CI.

Load the vertical pack, add these assertions to your suite and keep the signed run manifest as evidence. 14-day free production trial, no card.