UK-T2 Regulated-Firm AI Checklist (FCA and PRA)
Verification required. This is a working template, not a regulator-approved form. Where it names an instrument or a date, the claim comes from secondary sources or from memory of the law and is a pointer to check. This is not legal advice.
How to use: This is a blank form. Copy it and fill in the empty cells and blanks for your system. To copy it, follow the "Suggest an edit to this page" link in the footer to reach its Markdown source.
The statements and rule references are [Recalled]. Verify them against the current FCA Handbook and PRA publications.
| # | Area | Question | Status | Evidence | Wiki control |
|---|---|---|---|---|---|
| 1 | Accountability | Named senior manager with responsibility for AI (SM&CR) | AI-CTRL-012 | ||
| 2 | Consumer outcomes | Consumer Duty outcomes tested for AI-driven journeys | AI-CTRL-041 | ||
| 3 | Model risk | Inventory, validation, performance monitoring (SS1/23 for banks) | AI-CTRL-011, AI-CTRL-037 | ||
| 4 | Operational resilience | Important business services that rely on AI are mapped; impact tolerances set | AI-CTRL-040 | ||
| 5 | Outsourcing | AI suppliers assessed; exit plans | AI-CTRL-014 | ||
| 6 | Data | UK GDPR basis; automated decision safeguards (UK-T1) | AI-CTRL-013 | ||
| 7 | Explainability | Adverse decisions explained to customers | AI-CTRL-041 | ||
| 8 | Financial crime | Alerts from AI used in monitoring are reviewed by a person | AI-CTRL-023 | ||
| 9 | Incident | Regulator notification routes | AI-CTRL-035 | ||
| 10 | Governance | Board reporting on AI risk | AI-CTRL-037 |