# AI and client data in an advice firm: what the FCA expects, what advisers already do, and the six conditions before a tool touches a client file > Advisers already draft with general AI. What the FCA expects (existing rules, SM&CR, Consumer Duty), what surveys show, six conditions before AI reads a file. - Page to cite: https://aeolookup.com/financial-advisers/ai-client-data-advice-firm-fca-consumer-duty/ - Publisher: AEO Lookup (https://aeolookup.com/) - Section: Financial advisers and mortgage brokers, Consumer Duty, the FCA and client data - Published 1 October 2026 - Key fact: In 2026 surveys, 39% of UK advisers used ChatGPT or Claude-type tools for research and drafting and 95% said they had deployed AI in some form, while small firms lagged on the formal uses (meeting notes 31% in firms of five or fewer advisers against 72% in larger ones; suitability reporting 24% against 62%), and 80% of advisers were comfortable with AI collating review and suitability packs but only 43% with AI on pension transfers. - Sources: FE fundinfo adviser survey, 16 July 2026 (39%, 95%, 51% saving over five hours a week); Fidelity IFA DNA via Professional Paraplanner, 9 September 2026 (72% vs 31%, 62% vs 24%); GBST and the lang cat via IFA Magazine, 19 August 2026 (80%, 77%, 76%, 75%, 43% of 178 advisers); FCA AI Update (April 2024: existing framework, no new AI rules; SM&CR accountability); UK GDPR; read 2026-10-01. Not legal or regulatory advice. The debate about whether AI belongs in financial advice has been overtaken by what advisers do. In FE fundinfo's July 2026 survey, 39% of UK advisers used ChatGPT or Claude-type tools for research and drafting, 95% said they had deployed AI in some form, and 51% of the AI users saved more than five hours a week per user. The question for a small firm is not whether, but under what conditions, because some of that 39% is client information pasted into a consumer chatbot on a personal account. ## What the FCA expects The FCA's position, set out in its AI Update of April 2024 and repeated since, is that it has no AI-specific rules and does not plan them: the existing framework applies. That means the Consumer Duty (good outcomes, understanding, support), the Senior Managers and Certification Regime (a named senior manager is accountable for the firm's use of the tool and its outputs), the systems and controls requirements in SYSC (outsourcing and operational resilience), and the suitability rules, under which the adviser is responsible for the recommendation however it was drafted. A suitability report drafted by a tool and signed by an adviser is the adviser's report; the [file check](https://aeolookup.com/financial-advisers/suitability-report-file-check-cobs-9-4-7/) applies to it unchanged. ## What advisers are comfortable with GBST and the lang cat asked 178 advisers in August 2026. 80% were comfortable with AI collating annual review and suitability packs, 77% with onboarding, 76% with KYC, 75% with fee reconciliation, and 43% with pension transfers. The line advisers draw is the right one: administrative preparation yes, client-money judgement no. It is also the line the FCA's accountability rules draw, because the senior manager who signs off a pension transfer recommendation cannot delegate that judgement to anything. Fidelity's IFA DNA research found the small-firm gap: formal AI meeting notes in 72% of firms with six or more advisers against 31% in firms with five or fewer; AI suitability reporting 62% against 24%. Small firms are using the tools informally and adopting them formally more slowly, which is the worst of both: the data risk without the governance. ## Six conditions before a tool reads a client file 1. **A business account, not a personal one**, with the provider's commercial terms, which exclude training on the firm's data and give the firm control of retention and deletion. A consumer chatbot on a personal login fails this on its own. 2. **A processor contract and a UK GDPR footing.** The firm is the controller; the vendor is a processor acting on instructions; the privacy notice tells clients what the tool does. Financial data is not special category data in the Article 9 sense, but health information in a fact-find is, and vulnerability notes often contain it. 3. **A named senior manager** responsible for the tool, under SM&CR, with the responsibility written into their statement of responsibilities. 4. **Drafts, not decisions.** The tool prepares; the adviser decides and signs. Anything client-facing is reviewed by a person before it leaves, and the review is recorded. 5. **A check on the output.** Paraplanners on the sector's main forum report notes cut from one or two hours to twenty or thirty minutes, and also report that tools put wrong information in notes. The check is part of the process, not an afterthought, and the [file check](https://aeolookup.com/financial-advisers/suitability-report-file-check-cobs-9-4-7/) is one form of it. 6. **An exit.** Data returned or deleted, in writing, on a date, when the firm stops using the tool. ## What the firm writes down An AI and data policy of two pages: which tools, on which accounts, for which tasks, who is responsible, what is reviewed and by whom, what clients are told. It goes in the compliance file, is referred to in the [Consumer Duty board report](https://aeolookup.com/financial-advisers/consumer-duty-annual-board-report-small-advice-firm/), and is the document a buyer's due diligence asks for, since consolidators now ask about system dependencies and cyber governance before they buy. ## Where Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) sits An AI assistant set up by Overlyft runs on the firm's own commercial account with the model provider, on the firm's machine with the firm's logins; it retains nothing after a task, drafts everything for review and sends nothing to a client by itself. The six conditions are the install checklist, the policy template is part of the install, and the named senior manager is the firm's. It never makes or implies a recommendation. General information; not legal or regulatory advice. ## Short answers from this page **Can a financial adviser use ChatGPT or Claude with client data?** Not on a personal or consumer account. The FCA has no AI-specific rules; the Consumer Duty, SM&CR accountability and the suitability rules apply. A firm needs a business account whose terms exclude training on its data, a processor contract, a named senior manager, human review of anything client-facing, a check on outputs and an exit plan. The adviser remains responsible for every recommendation. --- ![](https://aeolookup.com/img/d/owner-line.png) General information for UK small firms, not legal, tax or financial advice.