--- title: >- Consumer Duty and AI: evidencing good outcomes when the decision was made by a model description: >- The FCA will not write AI-specific rules in the near term. Instead, firms must demonstrate AI compliance through Consumer Duty, SM&CR, and SYSC 9, which raises a hard question about reconstructing model-made decisions. author: murilo date: '2026-06-06' tags: - consumer-duty - fca - smcr - compliance categories: - compliance --- The FCA has been consistent about its near-term approach to artificial intelligence: it does not intend to introduce AI-specific rules. Instead, firms are expected to demonstrate that their use of AI is compliant through the frameworks that already govern them. For retail financial services, the most important of these is the Consumer Duty, supported by the Senior Managers and Certification Regime and the record-keeping requirements of SYSC 9. This is, on the surface, a reassuring position. Firms are not being asked to learn a new rulebook. But it carries a subtle and demanding implication. If AI decisions must be compliant under the Consumer Duty, then firms must be able to evidence that compliance for decisions that were made by a model rather than a person. That is a materially harder problem than it first appears, and it is worth working through carefully. ## What the Consumer Duty actually requires The Consumer Duty, set out in the FCA's Principle 12 and the supporting PRIN 2A rules, requires firms to deliver good outcomes for retail customers. It is built around four outcomes: products and services, price and value, consumer understanding, and consumer support. Underpinning these are cross-cutting obligations to act in good faith, to avoid causing foreseeable harm, and to enable and support customers to pursue their financial objectives. Crucially, the Duty is not satisfied by good intentions or well-designed processes alone. Firms are expected to monitor whether they are in fact delivering good outcomes, to identify where they are not, and to act on what they find. Boards are expected to review outcomes regularly. The Duty is, in a meaningful sense, an evidence regime: a firm must be able to show, not merely assert, that its customers are receiving good outcomes. ## The reconstruction question This is where AI introduces a specific difficulty. When a human adviser recommends a product, there is a person who can explain the reasoning, a suitability assessment on file, and a chain of accountability that runs to a named individual. When a model produces the same recommendation, the question becomes: who can explain it, and on what basis? The honest reconstruction test is this. A regulator, an ombudsman, or the firm's own board asks why the firm's AI recommended a particular action for a particular customer on a particular date. To answer, the firm must be able to retrieve the inputs the model received, the output it produced, the version of the model in use at the time, and the context that made that output appropriate for that customer under the conditions that then applied. Most firms cannot answer this question with confidence. They can produce application logs, which show that a request was made. They can produce aggregate model performance metrics, which show how the model behaves on average. What they often cannot produce is a complete, structured record of the specific decision, the one the customer is asking about, or the one the regulator has selected. The average behaviour of the model is not evidence about an individual outcome, and under the Consumer Duty it is individual outcomes that matter. ## Where SM\&CR and SYSC 9 fit The Senior Managers and Certification Regime sharpens the point. SM\&CR places personal responsibility on named senior managers for the activities they oversee. A senior manager who is accountable for a function that deploys AI is accountable for the decisions that AI makes. It is difficult to discharge that responsibility for decisions that cannot be reconstructed and examined. SYSC 9 supplies the record-keeping backbone. It requires firms to keep orderly records of their business and internal organisation, sufficient to enable the FCA to monitor the firm's compliance. For regulated activities, the expected retention period runs to several years. Read alongside the Consumer Duty, SYSC 9 implies that the records a firm keeps must be sufficient to evidence good outcomes, including outcomes that were determined by a model, for the full retention horizon. Taken together, these three frameworks describe a single capability without naming it. The Consumer Duty requires evidence of good outcomes. SM\&CR requires that a named person can stand behind those outcomes. SYSC 9 requires that the records supporting them are kept in an orderly way for years. For AI decisions, satisfying all three means being able to reconstruct, explain, and defend any individual decision the model made, long after it was made. ## The complaint that arrives later There is a timing dimension to all of this that firms often underestimate. A decision made by a model today may not be questioned today. A customer may complain months later. The Financial Ombudsman Service may consider a case later still. The firm's own board, conducting its periodic review of outcomes under the Consumer Duty, may surface a pattern that prompts it to examine specific historic decisions. In each case, the firm is asked to account for a decision made at a point in the past, under conditions that no longer apply. This is precisely the situation in which reconstruction fails. The model in production today may not be the model that made the decision under scrutiny. The data that described the customer may have changed. The thresholds and policies in force at the time may have been superseded. A firm that did not capture the decision as it happened is left trying to reassemble a moment that has passed, from records that were never designed to preserve it. The only reliable defence is to have captured the decision faithfully when it was made, so that the account the firm gives years later reflects what actually happened rather than what the firm can piece together after the fact. ## What an evidence-ready firm looks like A firm that is genuinely ready to evidence Consumer Duty compliance for its AI decisions has moved beyond logging and monitoring. It captures each decision as a structured record at the moment it is made, linking output to inputs, model version, and the customer context that justified it. It retains those records for a horizon consistent with SYSC 9 rather than the short lifespan of operational logs. It can retrieve any single decision on request, rather than reconstructing it from fragments. And it protects those records against later alteration, so that a decision produced as evidence can be trusted. This is not about distrusting the model or second-guessing every output. It is about being able to answer the questions that the Consumer Duty, SM\&CR, and SYSC 9 will eventually ask. A firm that can produce a clear account of why a specific decision was appropriate for a specific customer is in a fundamentally stronger position than one that can only describe how its model behaves in general. ## The question is when, not whether The FCA's decision not to write AI-specific rules does not reduce the compliance burden on firms deploying AI. It relocates it. The burden now sits inside frameworks firms already know, which means the expectation is immediate rather than deferred to some future rulebook. The reconstruction question, can you explain this specific decision?, applies today. Firms that treat the evidencing of AI decisions as a first-class capability, rather than something to be assembled under pressure when a complaint or a regulatory request arrives, will find the Consumer Duty far less daunting. Aegis Trace was built to make this capability straightforward. A single integration captures complete provenance for every AI decision, with tamper-resistant storage and retention configured to match SYSC 9 expectations, so that any individual outcome can be reconstructed and defended on demand. ### Evidence good outcomes with confidence. Request early access to Aegis Trace and our technical documentation. [Request Access →](/request-access)