AI compliance for credit brokers starts with the next update

The broker approved the system on Friday. By Monday, the supplier had improved it. That is a perfectly plausible technology success story, right up to the moment somebody asks whether the improved version still does what the broker approved. Perhaps it now interprets a customer's income differently. Perhaps it gives a more confident answer about eligibility. The screen looks familiar, the contract has not changed and applications are still arriving. Somewhere underneath, however, the service may have acquired a different view of the customer.

This is an illustrative scenario, not an allegation about a particular firm. It captures a practical question raised by the FCA's October 2026 publication, AI in financial services: good practice and areas for improvement, published on 19 October 2026 and updated on 20 October. Its examples cover consumer outcomes, governance and operational resilience. They are expressly illustrative, not new requirements or a prescribed operating model. For credit businesses, the useful question is what those observations reveal about arrangements already running under their own brand.

AI compliance for credit brokers becomes much harder when approval attaches to a product name instead of a defined use. A firm may know which supplier it pays without knowing which part of the application journey that supplier can alter. That gap matters commercially as well as regulatorily. A lender receives data it did not expect, a customer relies on an assurance nobody intended to give, or an appointed representative changes its service through a setting described as a routine enhancement. The following examples and controls are our practical analysis of those risks, not an FCA checklist.

The update that changes the service

Imagine a broker using an AI tool to turn customers' descriptions of their employment into application fields. The intended task is modest: organise what the customer has said. A customer explains that they have a permanent job but that overtime varies. The tool records the distinction, and the customer checks the result. After an update, the tool begins estimating a single monthly income from the whole description. It still produces a neat form. It is now doing something materially different. A change in interpretation has become a change in the information entering the credit process.

That distinction will be missed if the acceptance test asks only whether all mandatory fields are populated. It becomes visible if the test asks whether the field preserves the customer's meaning. In this example, the broker could compare the original statement, the extracted information and the final submission using controlled test cases. A useful result would identify where the system summarises, calculates or assumes. Those are different operations. Treating them as one feature called 'application assistance' makes it difficult to decide which errors matter and who should correct them before information reaches a lender.

The supplier may quite reasonably see a new feature as an improvement across its wider customer base. The broker has a narrower question: is it an improvement for this service, with these products and these customers? A generic accuracy score cannot settle that. Nor does purchasing a specialist financial-services product settle it automatically. The practical specification needs to describe the behaviour being bought, including what the tool must leave unresolved. An empty field accompanied by an intelligible question can be more useful than a completed field built on an unsupported inference. Tidiness is not a credit assessment.

A broker score is not a lending decision

The legal distinctions survive the software upgrade. Where CONC 5.2A applies, a lender's creditworthiness assessment considers both the risk of repayments not being made when due and affordability risk to the customer. The latter concerns the customer's ability to repay without, among other things, borrowing to meet repayments or suffering a significant adverse effect on their financial situation. These are existing requirements, subject to the section's scope and qualifications. A broker's estimate of eligibility is not a substitute for that assessment. FCA Handbook, CONC 5.2A.

Consider a separate hypothetical tool that predicts whether an enquiry is likely to convert into a funded loan. It might be commercially useful for allocating staff time. It does not follow that its output measures affordability, identifies the most suitable product or predicts a lender's actual decision. Before using the score elsewhere, the broker should understand what success meant in the data used to develop it. A prediction trained against completed transactions answers a different question from an assessment of whether repayments are sustainable. Reusing the same number under a more reassuring label does not bridge that gap.

This is also a relationship problem between firms. Suppose a lender believes a field represents income supplied and confirmed by the applicant, while the broker's updated tool has estimated it. Both firms may believe the transfer worked because the file arrived successfully. The misunderstanding concerns meaning, not delivery. Our recommendation is to agree that meaning explicitly: what was stated, what was verified, what was calculated and what remains uncertain. If a change affects those categories, the receiving firm needs an opportunity to assess its consequences. Technical compatibility is a very low bar for a lending relationship.

The customer hears the answer rather than the architecture

An assistant that previously said a customer could check possible options might, after a change, say that finance is available. The wording is shorter and more encouraging. It may also communicate a certainty the business cannot support. Under PRIN 2A.5, firms within scope must support customer understanding and communicate clearly, fairly and without misleading. The requirements apply across channels, with testing before communication where appropriate and monitoring afterwards. They do not disappear because individual sentences are assembled dynamically rather than selected from a fixed script. FCA Handbook, PRIN 2A.5.

For a broker, a sensible test would ask what a customer believes has happened after reading the answer. Have they received a lender's offer, an indicative result or an invitation to apply? Do they know who will decide? A technically accurate explanation of the AI model would be a poor substitute for resolving those questions. Equally, a footer saying that the firm is a broker cannot be assumed to undo a prominent statement suggesting it has approved the loan. The whole exchange needs to make sense, including the point at which a customer is asked to commit time or disclose information.

The issue extends beyond a chatbot. A tool might write follow-up emails, shorten product explanations or choose which information appears beside a result. Our practical recommendation is to test the places where language changes a customer's next action, rather than reviewing every generated sentence as if it carries identical risk. A wrong office address and an unsupported approval claim both need correction, but their consequences differ. This is where compliance input becomes commercially useful: identifying the assertions that need tightly controlled wording, and the less consequential passages where greater flexibility can be justified.

AI compliance for credit brokers includes the supplier contract

The FCA's October 2026 publication specifically identifies third-party oversight, visibility of model changes, contingency arrangements and exit options as relevant practices. It also highlights assessing suppliers' own use of AI. A business can therefore encounter AI risk through a service it did not originally purchase as an AI product. FCA AI practice publication, section 4.2. The practical response is to inspect the service as it operates now, not merely retrieve the questionnaire completed when the supplier was first approved. That old questionnaire may describe an entirely accurate past.

A useful contractual discussion starts with an ordinary event: the supplier wants to release a change next Tuesday. Who receives the notice? What can that person learn about the effect on the broker's use case? Can the broker test it, defer it or disable the affected function? These are proposed negotiating questions, not universal FCA contractual clauses. A small broker may have limited leverage over a large provider. That makes the available choices more important, not less. If advance notice is unavailable, the firm needs to decide whether the intended use is acceptable with the controls it can actually operate.

Price the answer honestly. A cheap subscription that requires substantial manual checking may still be worthwhile, but the checking belongs in the business case. So do the staff hours needed to investigate errors, maintain lender confidence and change provider if necessary. Ask how the broker would retrieve its records and keep essential work moving during an exit. A contractual right to leave is of limited comfort if the application journey cannot function without the service. The decision should reflect that dependence before volumes grow, while the firm still has room to choose a different design.

Principal oversight has to reach the live configuration

An appointed representative adds another relationship to the picture. The principal may approve a customer journey while the AR controls the software account used to deliver it. If someone enables an automated feature, the live service can move beyond the version the principal reviewed. Existing SUP 12.6 provisions address principals' continuing obligations, including reasonable steps to prevent unlawful regulated activity by their ARs. Associated guidance places responsibility for controlling and monitoring AR activities with the principal's senior management. FCA Handbook, SUP 12.6. The AI publication does not replace those arrangements with a separate exemption for technology.

An introducer appointed representative needs particular care. The FCA describes IARs as limited to introductions to their principal and distribution of non-real-time financial promotions. That is not interchangeable with a wider AR appointment. FCA regulatory guide for credit brokers. Whether a particular interactive tool stays within the permitted activity depends on what it actually does; calling it a digital receptionist does not answer the question. A feature that moves from collecting an introduction to selecting or progressing finance options warrants a fresh assessment of the activity and appointment scope before anyone assumes it is covered.

A practical principal review could therefore follow a change from request to release. Take one enabled feature, establish who changed it and compare the resulting journey with the agreed activity. The exercise is more revealing than asking whether an AI policy exists. It also exposes administrative weaknesses: a principal may have view-only access to a demonstration account while the AR's supplier can alter production settings. The remedy depends on the arrangement, but the objective is straightforward. People responsible for oversight need usable evidence of what customers encounter, and an effective way to have unacceptable behaviour stopped or corrected.

Test the change against the customers it could disadvantage

Suppose the updated income tool completes more applications overall but makes more errors for people whose earnings vary. The headline result could look favourable while a particular group receives a worse service. Under PRIN 2A.9, in-scope firms must regularly monitor customer outcomes, identify relevant differences between groups and take appropriate action where the rules require it. The accompanying guidance makes monitoring proportionate to a firm's role and circumstances. It does not prescribe one universal review interval. FCA Handbook, PRIN 2A.9. A broker should choose measures that can reveal the consequences of its own activity.

In the income example, our suggested test would include ordinary descriptions of overtime, seasonal work and more than one source of earnings. It would examine whether the system preserves uncertainty, asks a useful follow-up question or silently invents a stable figure. Those cases need not contain real customer identities. Carefully constructed test material can help isolate the behaviour being checked, alongside appropriately controlled review of actual outcomes. A result should not be labelled discriminatory merely because groups differ; the firm needs to investigate the reason. Equally, an improvement in the average should not end the enquiry.

There is a time dimension too. Compare results before and after the release, but avoid attributing every movement to the software. A changed lender panel, a new advertising campaign or a shift in the mix of applicants could also explain it. The practical value of dated change records is that they make those competing explanations testable. Without them, an investigation can become a meeting in which everyone remembers a different version of the service. Establishing what ran, when it ran and which applications it touched gives staff a starting point for deciding whether customers need a correction or further help.

The business case needs a credible pause button

In her 19 October speech on AI, the FCA's Jessica Rusu described the shift towards systems that can act on people's behalf and stressed the risks of behaviour changing at scale, under stress or as underlying models change. That is supervisory direction, not a newly invented credit-broking permission. For firms considering more autonomous tools, the commercial question is how much authority they genuinely want to delegate. Drafting an application summary and submitting that application are different decisions, even when a supplier can combine them into a single convenient workflow.

A useful rehearsal would ask what happens if the income tool starts producing unreliable figures during a busy morning. Can the broker stop the affected function without losing enquiries already received? Is there a workable route for customers whose applications are part-complete? Who can tell lenders which submissions may be affected? These are proposed operating tests, not claims about a mandatory FCA exercise. Their value is that they uncover the true cost of dependence. A manual fallback staffed for a handful of cases may not be a credible alternative once the business has built its capacity around automation.

This is the practical territory in which Authorised Compliance Ltd supports credit brokers: reviewing customer journeys, business models and the controls around them. The aim should be to make a useful technology dependable enough to keep using, with evidence that holds up beyond the sales demonstration. A broker need not build its supplier's model or demand that software never changes. It does need a defensible decision about the service it is prepared to put in front of customers. When the next update arrives, the important question is not whether the product has improved. It is whether the firm still understands what it has authorised it to do.