UK solutions · FCA SYSC · ICO Article 22A–22D · Consumer Duty

FCA SYSC, ICO Article 22A–22D
and Consumer Duty —
covered.

The EU AI Act is the loudest deadline, but UK FCA-regulated firms face three overlapping obligations on AI agent activity. UK-specific export packs cover SYSC operational resilience, ICO automated decision-making, and Consumer Duty fair-value evidence in one platform.

Book a 30-minute walkthrough See a sample pack
FCA SYSC 4 · 8 · 15 ICO Article 22A–22D Consumer Duty PRIN 12 Operational Resilience SS1/21

In this section

FCA SYSC

Senior Management Arrangements, Systems and Controls — SYSC 4 and SYSC 8 require operational resilience evidence for material outsourced services and critical functions, including AI-driven services.

ICO Articles 22A–22D (UK GDPR)

The Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A–22D (in force 5 February 2026) — moving solely automated decisions with legal or similarly significant effect from a prohibition to a right to safeguards: the person must get information about the decision and be able to make representations, obtain human intervention and contest it. You must be able to show the decision logic and the authority the agent was acting under at the moment it acted — pinned then, not reconstructed.

FCA Consumer Duty

Firms must evidence fair outcomes for retail customers. Where AI is in the decisioning loop, the firm must be able to show how a specific decision was made and on what data.

Why UK firms can't just wait for the EU deadline.

The EU AI Act creates the loudest extraterritorial pressure on UK firms, but the domestic obligations apply already. An ICO subject access request can land tomorrow. The FCA can ask about your AI agent governance at any supervisory review. Consumer Duty applies whether the AI is in scope of the AI Act or not.

What we ship for UK firms

FAQUK regulator questions, answered

Frequently asked, by UK CISOs.

Does Agent Audit cover FCA SYSC operational resilience for AI?

Yes. Our FCA SYSC export pack maps every receipt to the obligations under SYSC 4, SYSC 8 and SYSC 15A — including evidence of testing, monitoring, third-party AI service oversight, latency p95/p99, degraded-service windows and incident response. The pack is generated tenant-wide.

What about ICO Articles 22A–22D — automated individual decision-making?

Our ICO SAR pack is available today. For any named data subject it returns every action the agent took on their behalf, the lawful basis claimed at the time, the model and tools involved, and whether the decision had a legal or similarly significant effect under Articles 22A–22D of the UK GDPR — the regime that replaced Article 22 under the Data (Use and Access) Act 2025, in force 5 February 2026.

How does this fit with Consumer Duty?

Consumer Duty requires you to evidence that AI-driven decisions are delivering good outcomes for retail customers. Agent Audit's receipts capture decision outcome, confidence, and routing — which feed directly into the "fair value" and "consumer understanding" outcomes the FCA expects firms to demonstrate.

Is the FCA about to bring in new AI-specific rules?

No. The FCA's 2026 position — set out in its AI review (the "Mills Review", published July 2026) and its October 2026 plans for agentic finance oversight — is to supervise AI through existing frameworks: SYSC, the Senior Managers & Certification Regime, and Consumer Duty, not a bespoke AI rulebook. That makes contemporaneous, tamper-evident records of what your agents actually did the foundational control — you can't evidence SM&CR accountability or Consumer Duty outcomes for an AI journey without them.

Is the data residency UK-only?

By default, yes. Managed cloud customers can pin storage to London (UK) or Frankfurt (EU). Enterprise customers can bring their own S3 bucket in any AWS region, or self-host the entire backend on-premises.

A customer disputes an automated decision months later and the policy has since changed — what do we hand the ICO/FCA?

The as-of decision record. It fixes what the agent was authorised to do at the instant it acted — in force, in scope, delegated up the chain — so a later policy change never rewrites the answer. Every correction, dispute and revocation since sits in a verifiable order on top of it, with nothing silently dropped. You hand over one signed artefact showing what was authorised then and everything that followed, plus independent verification that it has not been altered, omitted from or backdated — rather than reconstructing the decision after the fact.

Will my auditor accept the pack format?

The packs are co-designed with compliance officers at FCA-regulated beta partners and reviewed by an independent AI assurance firm. Each pack ships with a verifiable hash-chain proof and an RFC 3161 notarisation receipt, both of which auditors can independently re-verify without contacting us.

Further reading: Article 12 vs SOC 2 — what each one actually covers · Retention vs notarisation · SCIM + SSO procurement checklist.

Built for the regulators you actually answer to.

We've co-designed our UK packs with compliance officers at FCA-regulated firms. The format matches what your supervisors expect.

Book a 30-minute walkthrough → See a sample pack