AI and client data in an advice firm: what the FCA expects, what advisers already do, and the six conditions before a tool touches a client file

The debate about whether AI belongs in financial advice has been overtaken by what advisers do. In FE fundinfo's July 2026 survey, 39% of UK advisers used ChatGPT or Claude-type tools for research and drafting, 95% said they had deployed AI in some form, and 51% of the AI users saved more than five hours a week per user. The question for a small firm is not whether, but under what conditions, because some of that 39% is client information pasted into a consumer chatbot on a personal account.

What the FCA expects

The FCA's position, set out in its AI Update of April 2024 and repeated since, is that it has no AI-specific rules and does not plan them: the existing framework applies. That means the Consumer Duty (good outcomes, understanding, support), the Senior Managers and Certification Regime (a named senior manager is accountable for the firm's use of the tool and its outputs), the systems and controls requirements in SYSC (outsourcing and operational resilience), and the suitability rules, under which the adviser is responsible for the recommendation however it was drafted. A suitability report drafted by a tool and signed by an adviser is the adviser's report; the file check applies to it unchanged.

What advisers are comfortable with

GBST and the lang cat asked 178 advisers in August 2026. 80% were comfortable with AI collating annual review and suitability packs, 77% with onboarding, 76% with KYC, 75% with fee reconciliation, and 43% with pension transfers. The line advisers draw is the right one: administrative preparation yes, client-money judgement no. It is also the line the FCA's accountability rules draw, because the senior manager who signs off a pension transfer recommendation cannot delegate that judgement to anything.

Fidelity's IFA DNA research found the small-firm gap: formal AI meeting notes in 72% of firms with six or more advisers against 31% in firms with five or fewer; AI suitability reporting 62% against 24%. Small firms are using the tools informally and adopting them formally more slowly, which is the worst of both: the data risk without the governance.

Six conditions before a tool reads a client file

1. A business account, not a personal one, with the provider's commercial terms, which exclude training on the firm's data and give the firm control of retention and deletion. A consumer chatbot on a personal login fails this on its own.
2. A processor contract and a UK GDPR footing. The firm is the controller; the vendor is a processor acting on instructions; the privacy notice tells clients what the tool does. Financial data is not special category data in the Article 9 sense, but health information in a fact-find is, and vulnerability notes often contain it.
3. A named senior manager responsible for the tool, under SM&CR, with the responsibility written into their statement of responsibilities.
4. Drafts, not decisions. The tool prepares; the adviser decides and signs. Anything client-facing is reviewed by a person before it leaves, and the review is recorded.
5. A check on the output. Paraplanners on the sector's main forum report notes cut from one or two hours to twenty or thirty minutes, and also report that tools put wrong information in notes. The check is part of the process, not an afterthought, and the file check is one form of it.
6. An exit. Data returned or deleted, in writing, on a date, when the firm stops using the tool.

What the firm writes down

An AI and data policy of two pages: which tools, on which accounts, for which tasks, who is responsible, what is reviewed and by whom, what clients are told. It goes in the compliance file, is referred to in the Consumer Duty board report, and is the document a buyer's due diligence asks for, since consolidators now ask about system dependencies and cyber governance before they buy.

Where Overlyft sits

An AI assistant set up by Overlyft runs on the firm's own commercial account with the model provider, on the firm's machine with the firm's logins; it retains nothing after a task, drafts everything for review and sends nothing to a client by itself. The six conditions are the install checklist, the policy template is part of the install, and the named senior manager is the firm's. It never makes or implies a recommendation. General information; not legal or regulatory advice.