AI is now good enough to do some compliance work that used to be impossible at scale — and still not good enough to do other work that vendors sometimes claim. For a regulated advice firm, the useful question is not "should we use AI?" but "for which tasks, with what checks, and who stays accountable?"

Where AI earns its place in compliance

1. Reviewing every conversation

Transcription and language models can apply the same written rules to every call — something no QA team can do by hand. The value isn't just coverage; it is consistency, and findings that arrive within minutes of a call rather than at a file review months later.

2. Noticing vulnerability

Signs of vulnerability tend to surface in passing. Reading every call for them, in context, means they no longer depend on someone happening to listen. (See identifying vulnerable customers on calls.)

3. Summaries and next steps

Accurate call summaries and next steps save advisers time and make files better — provided each point is marked as quoted from the call or paraphrased, and figures that may have been misheard are flagged for checking.

4. Cross-checking documents against conversations

Comparing what was said with what was sent — an illustration, a suitability report — catches inconsistencies that are tedious to find by hand.

5. Answering questions across a client's records

Assistants that answer questions about a client's calls, with citations to the passages they used and the ability to play the recording from that moment, turn hours of searching into minutes of checking. (See how cited AI answers work.)

Where it doesn't belong

  • Making the final compliance decision. AI can recommend a verdict with evidence; an authorised person should own the decision.
  • Unexplained scores. A risk score nobody can trace back to the conversation can't be defended to a customer, an ombudsman or a supervisor.
  • Replacing suitability judgement. Whether advice was right for a customer depends on facts and professional judgement that no transcript fully captures.

How the FCA approaches AI

The FCA has said it is technology-neutral and regulates firms' use of AI through its existing rules rather than new AI-specific ones — setting this out in its AI Update in April 2024. In practice that means:

  • the Consumer Duty applies to outcomes produced with the help of AI just as it does to any other;
  • under SM&CR, a named senior manager remains accountable for the area where AI is used;
  • the systems and controls rules expect firms to understand, test and govern the tools they rely on.

Explainability is a compliance requirement

If a tool flags a call, a reviewer should be able to see why in seconds: the quoted words, a plain-English explanation and how confident the assessment is. If a reviewer disagrees, they should be able to override it — and the original verdict should stay on record. Without those three things, AI output is hard to rely on and harder to defend.

Data protection

Call recordings are personal data, and often include special category data such as health information. Before processing them with AI, establish the lawful basis (and the additional condition for special category data), complete a data protection impact assessment, set retention periods, and check how the supplier isolates your data, controls access and logs activity. The ICO's guidance on AI and data protection is the right starting point.

Before you rely on AI: a checklist

  1. Is the task well defined enough to write down as rules?
  2. Does every result come with evidence a person can check?
  3. Can authorised people override results, with the original kept?
  4. Have you tested it on your own data, against your own reviewers?
  5. Do you know what it doesn't cover, and is that logged?
  6. Is a senior manager accountable for its use?
  7. Is there an audit trail of logins, exports and decisions?
  8. Have you completed a DPIA and agreed retention?
  9. Is your data isolated from other customers' data?
  10. Can you explain the process to a supervisor in one page?

Where to start

Pick one process with high volume and clear standards — call QA is the usual candidate — calibrate it on your own calls, measure the results, and expand from there. That is how firms like Compare Retirement moved from sampling around a quarter of calls to reviewing every one.

This article is general information, not legal or regulatory advice.