For a while now I've watched firms manage AI risk and Consumer Duty outcomes as separate workstreams, owned by separate committees, reported through separate channels. Two pieces of FCA research published this month should end that separation for good. The regulator isn't asking firms to think about AI risk and Consumer Duty in parallel any more. It's telling us, with data, that they're already the same risk.
The trust gap the FCA just measured
Start with the young investors. FCA research released on 27 August found that 80% of 18-to-40-year-old investors have used AI for investment help, and 56% of them trust AI tools more than TV, radio, the press or influencers. On its own, that's an adoption story — mildly interesting, not alarming. What makes it alarming is the second half of the survey. Forty-four per cent of those same investors wrongly believe AI-generated financial information is regulated. Thirty-eight per cent think it's fine to base an investment decision solely on what an AI tool tells them. And nearly a third wrongly assume they'd get compensation through the FSCS or the Financial Ombudsman if that AI advice turned out to be wrong.
Customers trust a channel they fundamentally misunderstand the protections around, at scale, right now. This is a foreseeable-harm question, quantified for the first time rather than argued from instinct.
Read those numbers as a Consumer Duty problem, not an AI problem, and they land very differently. This is a foreseeable-harm question, quantified for the first time rather than argued from instinct. Customers trust a channel they fundamentally misunderstand the protections around, at scale, right now. The FCA's own director of consumer investments put it plainly: AI can help with research and education, but customers need to understand how they're protected and keep using their own judgement. That's a sound message. The open question for every board is whether your own customer communications, and any AI-assisted guidance tools you've deployed, actually make that distinction explicit — or whether you're relying on customers to work it out for themselves, the way this survey shows most of them currently don't.
The regulator stops separating the two risks
Then look at what the FCA did in its own supervisory language. Its 2026 wealth management survey — covering roughly 400 firms managing close to £1 trillion for over 5.5 million clients — named AI as a growing source of fraud and cyber risk, and placed it in the same list of top priorities as fee transparency, fair value assessment and financial crime controls. Not adjacent to those Consumer Duty concerns. Inside the same list, with the same weight.
That's a deliberate signal, and it's worth taking literally. The FCA is not asking firms to run an AI risk register and a Consumer Duty outcomes framework as two separate exercises that occasionally cross-reference each other. It's telling firms, through the structure of its own supervisory priorities, that it will assess AI risk and Consumer Duty outcomes together, in the same conversation, because in practice they produce the same category of consumer harm. A pricing algorithm that isn't delivering fair value is both an AI governance failure and a Consumer Duty failure. A vulnerability-detection process that an AI system quietly degrades is both, at once, not in sequence.
The FCA is not asking firms to run an AI risk register and a Consumer Duty outcomes framework as two separate exercises. It's telling firms it will assess them together, because in practice they produce the same category of consumer harm.
What this actually changes for a board
The practical test I'd put to any board right now is a structural one, not a technical one. Does the committee that owns AI risk talk to the committee that owns Consumer Duty outcomes as a matter of routine, or only when something has already gone wrong? Is there a single person, or a single forum, that could credibly answer both "what AI systems influence this customer journey" and "what Consumer Duty outcome are we accountable for here" without handing the question to two different teams?
If the honest answer is that these still sit in different silos, reporting up through different lines, that's no longer just an organisational quirk. It's the specific gap the regulator has just told the market it will be looking for. The firms that close it first — genuinely, structurally, not just by adding a line to a terms of reference — will be the ones with a coherent answer when a supervisor asks the question that increasingly won't distinguish between the two. Because the FCA already isn't.