Two Regulators, Same Technology, Opposite Instruments

Two regulators, same technology, opposite instruments.

The EU wrote a statute. The AI Act is horizontal and cross-sector, it sorts AI systems into risk tiers, and it hangs specific enumerated obligations off each tier: documented risk management for high-risk systems, conformity assessment before deployment, human oversight built into the design rather than promised afterwards. The UK’s Financial Conduct Authority looked at the same underlying risk and did none of that. As recently as December 2025 its chief executive reaffirmed that no AI-specific rules are coming.

The FCA’s actual reasoning, not a caricature of it

“No new AI rules” is easy to read as light-touch regulation, or as a wait-and-see punt from a regulator that hasn’t caught up. That isn’t the stated logic, and the stated logic deserves a hearing before anyone assumes the gap is an oversight.

The argument runs like this. AI capability turns over on a three-to-six-month cycle. Rulebooks take considerably longer than that to draft, consult on and finalise. Write specific rules now and you lock in assumptions about one generation of the technology, and those assumptions go stale before the rules are even in force. Meanwhile the frameworks that already exist reach the risks that actually matter: the Senior Managers and Certification Regime for accountability, Consumer Duty for outcomes, and existing model risk management expectations for how any model, AI or otherwise, gets validated and monitored.

The bet, in one line: outcomes-based, technology-neutral regulation ages better than a rulebook written against today’s systems.

There is more to it than a refusal. The FCA runs an AI Lab, and in 2025 it consulted on an “AI Live Testing” pilot, which lets firms test deployments in closer collaboration with the regulator instead of in isolation, and face examination only where something has genuinely gone wrong. Compare that with waiting for the AI Act’s obligations to bite on a date fixed in the regulation. It is a different posture entirely.

What this actually demands of a compliance function

More work, not less. That’s the part firms tend to get backwards.

A principles-based regime with no AI-specific checklist pushes the interpretive weight onto the compliance function. There is no enumerated list of high-risk AI use cases to walk through and tick off, the way Annex III of the EU AI Act hands you one. What there is instead is a familiar set of questions that now has to be put to every AI deployment with the rigour previously reserved for a material model change. Who is the accountable senior manager. What is the evidence that the outcome is fair, and that somebody is monitoring it. Would any of this survive scrutiny if a customer complained or a transaction went wrong.

An absent rulebook is not an absent standard. It is a bet that the existing standard, applied honestly, already covers the ground.

Why the comparison matters even for firms outside EU AI Act scope

A UK-only firm isn’t bound by the Act’s classification tiers. The Act is still worth reading as a reference model, though, precisely because it is explicit about distinctions the FCA leaves firms to work out for themselves.

Take the fraud-detection-versus-AML split described elsewhere on this site. The EU had to legislate that boundary. A UK firm has to reason it out under a principles-based duty to get the outcome right whether or not a rule spells it out. So the EU’s enumerated categories become useful as a diagnostic checklist even where they don’t bind: run your own AI governance against them and you find out whether it would survive the kind of scrutiny a prescriptive regime forces by default.

The honest summary is that the FCA has decided to trust compliance functions with judgment on a fast-moving problem rather than hand them a fixed answer key.

That is either the right call or a gap waiting to be exposed. Which one depends entirely on how firms read it. Treat “no new rules” as permission to relax and the gap opens. Treat it as confirmation that the judgment you were already supposed to be exercising now has to stretch further than it used to, and the bet pays.