In August I wrote about an AI engine that answered a broker's question by sending them to a compliance team, a firm-approved account and a register (You Are the Compliance Department). For a firm of one to five, none of those exist. I ended on this: the answers that exist were written for somebody else.
On 19 October the FCA published "AI in financial services: good practice and areas for improvement". It has five sections headed "Smaller firms focus".
So the regulator has now written some of those answers for the small firm. This is what they say.
What the page is, and what it is not
It is a set of examples drawn from the FCA's engagement with firms, industry, consumer bodies and others. It is not a rulebook, and it says so: the examples "do not create new requirements, prescribe a single model or replace firms' responsibility for considering what is appropriate and proportionate for their own AI use cases, risks and potential impact."
It is aimed wide. It is "relevant to regulated firms that develop, deploy, procure or use AI", and that includes tools "supplied by a third party, embedded in another system or used by staff to support decision making". A tool bought in rather than built is not outside it.
What it says to a smaller firm
The theme running through them is proportion, not scale.
On testing: "It may not always be proportionate or feasible to test at scale. Smaller firms need to judge what is proportionate for them." The FCA describes smaller firms working with samples and comparing outputs across scenarios, "without needing the same volume of testing as larger firms."
On governance, it saw smaller firms "scaling and tailoring their governance frameworks to their size, capability, and risk profile rather than copying large firm models."
On where to start: "Some small firms started with narrower, domain-specific use cases." It notes that this "reduced the risk of widespread harm from untested systems."
And in its key findings: "Smaller firms can govern AI effectively with targeted, proportionate controls."
As I read it, none of that is a lighter standard. It is the same expectation, met with less machinery.
The sentence that matters most
The section on senior managers and reasonable steps carries the line that answers August's question directly:
"Smaller firms may have simpler governance structures, but they still need to have clear responsibilities, understand the risks, and make informed decisions. They are accountable for how they use AI in their business, even where third-party providers are involved."
The same page says it elsewhere in plainer words: "Firms can outsource AI services, but remain responsible for them."
In August the argument was that the engines assume a department and the regulator assumes a person. This page agrees, and adds two things. The FCA does not expect that person to be an engineer: "we don't expect senior managers to be technical specialists." And it values evidence that oversight actually happened over an assumption that it did. One small firm it describes stressed recording whether staff needed to review AI outputs, whether they did, and what they did with them, creating "an audit trail showing how oversight operated in practice, rather than relying on an assumed control."
That last phrase is the one I would keep. A review that nobody can show happened is an assumed control.
Where it stops
Three parts of the page do not reach every broker, and one subject is outside it altogether.
Appointed representatives. The senior manager examples belong to the senior managers regime. The Handbook says of that chapter: "In general this chapter does not apply to appointed representatives of SMCR firms. SUP 10A applies instead." (SUP 10C.1.8G). If you are an appointed representative, the question is what your principal requires. We set that out in October (Where AI Fits in a Brokerage, and Who Signs It Off).
Commercial work. The page's first main section is about the Consumer Duty, which applies in relation to a firm's retail market business (PRIN 2A.1.3G). Commercial finance work for a business client may sit outside it. The same October article covers where that line falls.
Operational resilience. The page says that mapping AI dependencies into resilience planning "is a requirement for firms in scope of SYSC 15A". That chapter applies to enhanced scope SMCR firms, banks, building societies, designated investment firms and Solvency II firms, among others (SYSC 15A.1.1R). A typical mortgage, protection or commercial finance broker is not on that list. For a firm outside that chapter, the example is good practice, not a SYSC 15A duty.
Client data. The page "is not intended to address" data protection or equality law, and points firms to the regulators responsible for them. It is not a guide to putting client data into an AI tool, and should not be read as one.
What I am not claiming
This is a decode of one FCA page, read at source on 4 November 2026. It creates no new rules, and nothing here turns its examples into a checklist you must follow. It does not tell you what your own governance should contain, because that depends on your firm, your tools and your clients.
What it does settle is the question from August. The regulator has looked at firms your size, and its answer is a person, not a department. For a directly authorised firm, there is still nobody else on your Statement of Responsibilities. For an appointed representative, the person to ask is at your principal.