An AI voice agent that rings your customers is not regulated by a special set of AI rules. The FCA has said it will rely on the frameworks it already has, chiefly the Consumer Duty, the Senior Managers and Certification Regime and its expectations on governance and controls. So the question for an advice firm is a familiar one: would this call meet the standard you expect of a person on the phone, and can you show that it did?
How does the FCA regulate AI in financial services?
It does not have a separate rulebook for it. On its AI approach page and in a 2026 blog on its approach, the FCA has said it is not going to introduce new regulations for AI. Instead it relies on existing frameworks: the Consumer Duty, the Senior Managers and Certification Regime (SM&CR) and its expectations on governance and controls.
Two FCA publications are useful alongside the rules:
- AI Live Testing. In September 2025 the FCA published FS25/5, its feedback statement on AI Live Testing, a voluntary service where firms test AI systems in real-world conditions with regulatory support. Respondents asked for help with model evaluation and scenario testing. FS25/5 summarises feedback; it is not policy.
- Good and poor practice. On 19 October 2026 the FCA published AI in financial services: good practice and areas for improvement, with examples covering consumer outcomes, governance and operational resilience. The examples do not create new requirements, but they show how the FCA expects the existing rules to be applied. Two key findings matter most for AI callers: firms should tell consumers how they have used AI, and its limits, and test their understanding where appropriate; and they should test consumer outcomes across different consumer characteristics and scenarios.
So "is our AI caller compliant?" is not a question about AI law. It is whether each call meets the Duty, and whether your governance would stand up if the FCA asked how you know.
How do the Consumer Duty's cross-cutting rules apply to an AI caller?
The cross-cutting rules in PRIN 2A.2 apply to every interaction, whoever or whatever is on the line. A firm must:
- act in good faith towards retail customers (PRIN 2A.2.1R);
- avoid causing foreseeable harm to retail customers (PRIN 2A.2.8R); and
- enable and support retail customers to pursue their financial objectives (PRIN 2A.2.14R).
The Handbook describes good faith as a standard of conduct characterised by honesty, fair and open dealing, and acting consistently with customers' reasonable expectations. The guidance gives examples of falling short, including exploiting customers' behavioural biases or taking advantage of their vulnerabilities.
| Cross-cutting rule | What it can mean for an AI call (illustrative) |
|---|---|
| Act in good faith | Honest about what it is and why it is calling; no false urgency or pressure; "not interested" accepted straight away |
| Avoid foreseeable harm | Figures only from approved sources; known failure modes tested before launch; distressed customers reach a person |
| Enable and support customers to pursue their objectives | The call gets the customer to the information or adviser conversation they asked for, without trapping them in a loop |
"Foreseeable" matters. The ways an AI caller can go wrong, such as inventing an answer or carrying on when someone is upset, are well known, so a firm that has not tested for them will struggle to argue the harm was unforeseeable.
Consumer understanding on an AI call
The consumer understanding outcome in PRIN 2A.5 requires communications that meet customers' information needs, are likely to be understood and equip them to make effective, timely and properly informed decisions. Firms must tailor communications to customers' characteristics, including vulnerability, and to the channel used. When a firm deals with a customer one to one, including on the phone, it must, where appropriate, tailor the communication to that customer and ask whether they understand and have any further questions. Nothing in PRIN 2A.5 exempts a conversation because software is speaking.
On a phone call there is nothing to point at, so in our view an AI caller should:
- Speak plainly and briefly. One point at a time, no unexplained jargon.
- Check understanding. Ask whether the customer has followed and has any questions, and rephrase when they sound unsure.
- Use figures only from approved sources. Rates, amounts, fees and limits come from facts your firm has approved, never the model's general knowledge.
- Present any figure as an estimate, not a quote. Say so clearly, and explain that the adviser will confirm the real position.
- Be clear about its limits, including what it cannot do, such as give advice.
Our guide to the consumer understanding outcome covers checking understanding and evidencing it from calls in more depth.
Consumer support: easy to stop, easy to reach a person
The consumer support outcome in PRIN 2A.6 requires support that meets customers' needs, including those with characteristics of vulnerability, and that puts no unreasonable barriers in their way. The FCA calls unnecessary, harmful barriers sludge. An AI caller designed around the firm's targets can create it quickly:
| Sludge on an AI call (illustrative) | A better design |
|---|---|
| The agent keeps steering back to booking after the customer says no | Accept "not interested" or "not now" first time, and end politely |
| "Speak to a person" gets a loop of questions or no answer | Offer a person whenever asked: a transfer where available, otherwise a booked callback |
| "Don't call me again" is noted but calls continue from another campaign | An opt-out on the call stops all contact from the firm straight away |
| The customer must repeat details they gave on an earlier call | The agent uses what the firm already holds, and records what it learns once |
Giving a customer time to talk to family is protective friction, not sludge; our consumer support outcome guide explains the difference.
Vulnerable customers: recognise the signs, hand to a person
The FCA's vulnerable customers guidance, FG21/1, expects firms to recognise and respond to characteristics of vulnerability. It lists cues staff can watch for, such as a customer asking for information to be repeated, or signs of confusion, and suggests offering more than one channel where possible and recording needs so customers need not repeat them. FG21/1 dates from 2021 and is written mainly with staff in mind, but its expectations apply whatever the channel.
Many people called about later-life lending are older, and some are bereaved or unwell. In our view, an AI caller should not try to manage vulnerability itself. It should:
- be built and tested to notice signs such as confusion, distress, bereavement, ill health or mention of financial difficulty;
- stop gathering details or discussing figures when those signs appear;
- offer a person, and flag the call so someone follows up; and
- never use what it hears to press harder.
The FCA's October 2026 examples point the same way. In one example of good practice, a firm worked with frontline staff to choose the vulnerability indicators its chatbot should look for, and kept a live list of terms the tool flags to staff so that consumers who may need extra support reach a person. Test detection across different customers too. Our page on supporting vulnerable customers covers how COSA flags possible signs on calls for a person to review.
Honesty about being an AI
We have not found a UK law that specifically requires an AI caller to announce that it is an AI. That is not the same as saying it is safe to stay quiet:
- The good faith standard in PRIN 2A.2 rests on honesty and open dealing. A customer who wrongly believes they are talking to a person has been misled about something many would care about.
- The FCA's October 2026 examples say firms should tell consumers how they have used AI, and its limits.
- The CMA's guidance, Complying with consumer law when using AI agents (March 2026), says businesses are responsible for what their AI agents do, as for their employees, and points them towards clearly labelling AI agents rather than giving the impression a person is providing the service. The guidance is not itself law, but explains how the CMA reads existing consumer law.
In our view, the agent should say it is an AI assistant in its opening line, never claim or suggest it is a person or an adviser, and answer honestly and offer a person whenever asked. Disclosure is separate from consent: whether you may make AI calls at all depends on PECR and the consent you hold (see is AI calling legal in the UK?).
The advice boundary
For equity release, MCOB 8 sets the advising and selling standards, and advice must be suitable for the customer. In our view, a suitable recommendation depends on a proper understanding of the customer's needs and circumstances, which a short follow-up call is not designed to gather and an AI agent should not attempt.
Whether something said on a call amounts to advice depends on what is said, so the safe design is a hard boundary. The agent:
- gives factual information the firm has approved, gathers details and books a call with a qualified adviser;
- does not recommend a product, lender or course of action;
- never says the customer "qualifies", is eligible or is approved; and
- when asked "what should I do?", explains that the adviser will help with that and offers a time.
Our guide to AI calling for equity release enquiries covers the equity release side in more detail.
Testing and governance before launch
An AI caller is a new channel. It deserves the approval you would give a new script or adviser, with more testing because it runs at scale:
- Scenario testing. Run realistic calls repeatedly: the straightforward enquiry, the customer who wants to stop, asks for a person, is confused or bereaved, or asks "is this a scam?"
- Adversarial testing. Try to make the agent give advice, say "you qualify", quote an unapproved rate, claim to be human or ignore an opt-out. If a tester can, a customer eventually will.
- Version control. Keep each version of the agent's instructions, facts and wording, with what changed and why.
- Compliance sign-off. Your compliance lead approves the script, answers, figures and any estimate wording before launch and after material changes.
- Accountability. Name the senior manager who owns the agent. The FCA's AI approach page points to SM&CR as relevant to the safe use of AI; what reasonable steps look like in practice is covered in our guide to SM&CR reasonable steps and oversight.
Your supplier can provide tools for this, but the CMA guidance is clear that a business stays responsible for its AI agent even if someone else built it. The same logic runs through the Duty: the outcomes customers get are the firm's responsibility, whichever tool produced them.
Monitoring every AI call afterwards
Launch is where oversight starts. An AI caller can make many calls a day, and a small sample can miss a failure that recurs in a few calls in a hundred. In our view, firms should:
- Keep a transcript and recording of each AI call, filed on the customer's record alongside your human calls.
- Check calls against written AI call rules, such as "introduced itself as an AI assistant", "no advice or recommendation", "opt-out accepted straight away" and "vulnerability passed to a person". These are checkable; "the call was fair" is not. See writing compliance rules an AI can check.
- Have a person review the exceptions: failed rules, vulnerability flags, complaints and opt-outs.
- Produce MI by rule and by agent version, to see whether a change helped.
- Report it in your Consumer Duty monitoring and board report, with actions, owners and dates.
How the COSA AI Dialler is designed around these points
The COSA AI Dialler was built around these points. By default, its agents introduce themselves as an AI assistant from your firm, and a locked rule stops them claiming or suggesting they are a person or an adviser; if asked, they say they are an AI and offer a person. They never advise or recommend, never say someone qualifies, and give rates, amounts or providers only from facts and answers your firm has approved. Optional equity release estimates are framed as "not a quote" and need your compliance lead's approval before publishing. Signs of crisis or vulnerability lead the agent to stop gathering details and offer a person. A version must pass scenario-based evaluation before it can be published. Every answered AI call is filed in COSA on the client's record with a transcript, and can be checked against your AI call rules. See how COSA supports the Consumer Duty.
A Consumer Duty checklist for AI voice agents
| # | Check | Basis |
|---|---|---|
| 1 | The agent says it is an AI assistant, never claims to be a person, and answers honestly if asked | PRIN 2A.2 (good faith); CMA guidance; FCA AI examples |
| 2 | No pressure, urgency or scarcity; "not interested" is accepted first time | PRIN 2A.2; PRIN 2A.6 |
| 3 | Answers are plain and short, and the agent checks the customer has followed | PRIN 2A.5 |
| 4 | Figures come only from approved sources and are presented as estimates, not quotes | PRIN 2A.2 (foreseeable harm); PRIN 2A.5 |
| 5 | The agent gives information and books; it never advises, recommends or says "you qualify" | MCOB 8; our suggestion |
| 6 | Customers can stop the call, opt out or reach a person at any point | PRIN 2A.6 |
| 7 | Signs of vulnerability lead to a person, and the call is flagged for follow-up | FG21/1; PRIN 2A.6; FCA AI examples |
| 8 | Realistic and adversarial scenarios are tested, including across different customers, before each version goes live | FCA AI examples; our suggestion |
| 9 | Compliance signs off scripts, approved answers and figures, and versions are kept | Our suggestion |
| 10 | A named senior manager owns the agent and can show the reasonable steps taken | SM&CR |
| 11 | AI calls are recorded, checked against written rules, and reported to governance with actions | PRIN 2A; our suggestion |
These checks fit the same call QA scorecard you use for adviser calls.
This article is general information, not legal or regulatory advice. It reflects PRIN 2A, FG21/1, MCOB 8, the FCA's published material on AI and the CMA's guidance on AI agents as at 24 October 2026; the FCA's good-practice examples are not requirements. Always refer to the FCA Handbook and the regulators' own guidance for your firm's obligations.
