AI supervision is evolving – why firms’ evidence must evolve with it

Are your financial crime controls working in practice?

AI is no longer only changing how financial services firms operate. It is beginning to reshape how they are supervised. 

In a recent speech, Jessica Rusu, the FCA’s Chief data, information and intelligence officer, set out how the regulator is developing its own use of AI as part of its ambition to become a smarter and increasingly “agentic regulator”. The FCA says AI can help it gather evidence, surface intelligence from different sources and identify early warning signs, allowing supervisors to focus on areas of greatest potential harm.  

At the same time, the regulator has published examples of good and poor practice for firms adopting AI. Rather than introducing a separate set of AI-specific requirements, the FCA states that its existing regulatory framework already applies to firms’ use of the technology.  

The FCA says it is expanding its use of AI while developing new tools intended to help scale its operations and focus supervisory resources on areas of greatest potential harm. 

The FCA is becoming an AI-enabled regulator

The FCA says it is developing AI tools to support oversight of approximately 60,000 anti-money laundering firms expected to come within its remit in 2028. It is also developing a “market first responder agent” to support the supervision of around 9,000 smaller wholesale-market firms that submit transaction reports. 

Crucially, this comes alongside a wider focus on testing, assurance, monitoring and surveillance. In her October 2026 speech, Jessica Rusu said the FCA was embedding six of the Review’s seven recommendations into live work. 

For firms, the significant point is therefore not simply that regulators are paying attention to AI. AI is also becoming part of the regulatory infrastructure itself. 

From AI adoption to AI evidence

The FCA’s accompanying examples of good and poor practice provide another indication of where expectations are heading. 

The regulator highlights three broad areas: Consumer Duty and consumers in vulnerable circumstances; governance and accountability; and operational resilience. Its examples are illustrative rather than new requirements, and the FCA says they do not prescribe a single model for firms to follow.  

However, evidence and monitoring run throughout its examples of good practice. 

The FCA points to firms monitoring live outcomes so issues can be identified and addressed quickly. It also highlights maintaining auditable records, including consumer prompts, AI outputs, model versions, filters and escalation decisions, to support monitoring, complaints handling, explainability and investigation.  

That makes the ability to understand, monitor and evidence AI activity an increasingly important part of responsible deployment.

Observability becomes critical

In Recordsure’s view, these developments make observability increasingly important. As AI becomes more embedded across financial services – and within the regulatory infrastructure surrounding them – firms need to understand what their systems are doing, identify potential issues and retain evidence of the outcomes delivered. 

Joe Norburn, CEO at Recordsure, comments: 

“The real significance of these developments is that AI is starting to reshape both sides of regulation. As the FCA uses AI to increase the scale, speed and depth of supervision, firms should anticipate greater supervisory scrutiny around oversight, accountability and evidence.”  

“The conversation is shifting from whether AI should be used to whether organisations can clearly demonstrate how it’s operating and the outcomes it’s delivering. That places a premium on observability: robust monitoring tools, deep evidence trails and high-quality data that allow firms to understand and explain decisions and evidence outcomes.” 

This interpretation aligns with themes in the FCA’s examples, including continuous monitoring, accountability, human oversight and auditable records supporting explainability and investigation. The FCA does not define observability as a separate regulatory requirement; rather, it is a practical lens through which firms can consider how they demonstrate that existing controls work in practice. 

The FCA also warns that AI systems may behave differently at scale, under stress or when underlying models change. Jessica Rusu described the resulting need for agentic systems as “continuous, conditional assurance”. 

In Recordsure’s view, as supervision becomes more data-led, the quality, accessibility and context of a firm’s evidence may become increasingly important. Firms should be prepared to demonstrate not only how their AI systems operate, but whether controls remain effective and appropriate outcomes are being delivered over time. 

What does this mean for firms?

Using AI is only one part of the challenge. Being able to evidence how it works and what outcomes it produces matters too. 

The appropriate arrangements will depend on the nature, scale, risks and potential impact of each AI use case. With that proportionality in mind, firms developing or deploying AI should place greater emphasis on: 

• Governance and accountability: establishing clear ownership, proportionate controls, effective human oversight and defined escalation routes around AI systems. 

• Monitoring: understanding how systems perform once live, with clear thresholds for intervention and escalation rather than relying solely on pre-deployment testing. 

• Auditability: maintaining records that can support monitoring, explainability, complaints and investigations.  

• Consumer outcomes: ensuring AI supports good outcomes rather than simply automating existing processes.  

• Resilience: preparing for failures, changes in model behaviour and dependencies on third-party technology.  

As AI becomes more sophisticated, firms should be prepared to demonstrate how their systems behave, whether controls remain effective and what outcomes they deliver.