Contents
Deploying AI in FCA-regulated insurance is not just a technology project. It is a compliance project.
The Financial Conduct Authority's principles apply regardless of whether a human or AI interacts with the customer. Treating customers fairly. Providing clear information. Acting in the customer's best interest. Handling complaints appropriately. Identifying and supporting vulnerable customers.
AI can meet these requirements, sometimes better than humans. But only if the system is designed with compliance as a core consideration, not an afterthought.
The Regulatory Framework
Before designing compliant AI, understand what compliance requires.
Treating Customers Fairly (TCF)
The FCA's TCF outcomes apply to all customer interactions:
- Customers can be confident they are dealing with a firm where fair treatment is central to corporate culture
- Products and services are designed to meet the needs of identified customer groups
- Customers are provided with clear information and kept appropriately informed
- Advice is suitable (where given)
- Products perform as customers have been led to expect
- Customers do not face unreasonable barriers to changing products, switching providers, or making complaints
AI customer service touches outcomes 1, 3, and 6 directly. The AI must provide clear information, maintain fair treatment, and not create barriers to complaints or complaints handling.
Consumer Duty
The Consumer Duty (effective 2023) raises the bar further:
- Act in good faith toward retail customers
- Avoid causing foreseeable harm
- Enable and support customers to pursue their financial objectives
AI must support these outcomes. It must not mislead, must not obstruct, and must actively help customers achieve their goals.
Complaints Handling
The FCA's DISP rules require firms to handle complaints fairly and promptly. An AI that makes it difficult to register a complaint, or fails to recognise a complaint when expressed, violates these rules.
Vulnerable Customers
FCA guidance on vulnerable customers requires firms to understand their customer base, equip staff to recognise and respond to vulnerability, and take practical action to support vulnerable customers.
AI must be designed to identify potential vulnerability and respond appropriately.
Designing for Compliance
Compliant AI conversations require specific design elements.
Clear Identification
Customers should know they are interacting with AI. While the FCA has not (yet) mandated explicit disclosure, best practice suggests clarity:
"Hello, I'm the SwiftCase assistant and I can help with your policy query. What would you like to know?"
This establishes that the interaction is AI-powered without creating awkward or legalistic disclosure language.
Accurate Information
AI must provide accurate information about policies, claims, and coverage. This requires:
Integration with authoritative data: The AI must read from your policy administration and claims systems, not rely on generic knowledge.
Clear sourcing: Information should be traceable to specific policy terms, system records, or documented business rules.
Uncertainty handling: When the AI cannot determine accurate information, it must say so rather than guess. "I'm not sure about that specific scenario. Let me connect you to someone who can give you a definitive answer."
Regular validation: Periodically audit AI responses against source data. Detect drift before it causes customer harm.
Disclosure Requirements
Certain information must be disclosed in certain contexts. Insurance sales conversations require specific risk warnings. Claims conversations may require information about the complaints process.
Configure the AI to deliver required disclosures at appropriate points:
"Before we proceed, I need to let you know: this policy includes an excess of £250, meaning you'll pay the first £250 of any claim. Do you have any questions about that?"
Disclosures should be clear, not buried in rapid speech or scrolling text. They should be delivered conversationally, not read as a legal script.
Complaints Recognition
Customers complain in many ways. Some say "I want to complain." Others say "This is ridiculous" or "I'm very unhappy with how this has been handled" or simply describe a problem with evident frustration.
AI must recognise complaint signals even when not explicitly stated:
Explicit: "I want to make a complaint."
Implicit: "This is the third time I've called about this and nobody has helped."
Emotional: Expressions of anger, frustration, or distress about service.
When complaint signals are detected, the AI should acknowledge and route appropriately:
"I can hear you're frustrated with your experience. I want to make sure this is handled properly. Would you like me to register a formal complaint and have our complaints team contact you?"
Escalation Triggers
Some conversations must route to humans regardless of AI capability:
- Complaints (unless AI is explicitly authorised to handle)
- Legal or regulatory queries
- Complex coverage disputes
- Situations involving potential fraud
- Customers who request human assistance
- Customers showing signs of vulnerability or distress
Configure explicit escalation rules. Err on the side of over-escalating rather than under-escalating. A conversation that should have been escalated and was not creates compliance risk.
Vulnerable Customer Handling
Vulnerability manifests in many forms: financial difficulty, health conditions, life events, limited capability. The FCA expects firms to identify and support vulnerable customers.
AI can detect potential vulnerability signals:
Language indicators: Confusion, difficulty understanding, requests for repetition
Situational indicators: Mention of health issues, bereavement, financial stress, age-related challenges
Behavioural indicators: Erratic responses, long pauses, signs of distress
When vulnerability signals appear, AI should adjust its approach:
- Slow down the pace of conversation
- Use simpler language
- Offer to explain things again
- Proactively offer human assistance
- Flag the interaction for human review
"I want to make sure I'm explaining this clearly. Would it help if I went through that again, or would you prefer to speak with one of our team?"
Policy Guards and Guardrails
Compliance requires preventing the AI from saying or doing inappropriate things.
Content Restrictions
Configure the AI to never:
- Provide advice it is not authorised to give
- Make promises about claim outcomes before decisions are made
- Disclose information about other customers
- Use pressure tactics or create false urgency
- Make statements that could be construed as financial advice without proper authorisation
Response Validation
Before responses are delivered, validate them against compliance rules:
- Does the response contain required disclosures for this context?
- Does the response avoid prohibited statements?
- Is the information accurate according to system records?
- Does the response match the authorised scope of AI interaction?
Responses failing validation should be blocked and escalated.
Audit Trails
Every AI interaction must be recorded:
- Full transcript of the conversation
- Customer identification details
- Policy and claim references accessed
- Actions taken by the AI
- Escalation events and reasons
- Response validation results
These records must be retained according to regulatory requirements and be accessible for compliance review or complaints investigation.
Testing and Validation
Before deploying AI in customer-facing roles, validate compliance thoroughly.
Scenario Testing
Test conversations covering:
- Standard queries handled correctly
- Complex queries appropriately escalated
- Complaints recognised and handled
- Vulnerable customer signals detected
- Disclosure requirements triggered
- Prohibited statements blocked
Document test results and remediate failures before deployment.
Adversarial Testing
Test what happens when customers try to extract inappropriate information or manipulate the AI:
- Requests for information about other customers
- Attempts to get the AI to make promises about claims
- Fishing for legal or financial advice
- Attempts to bypass required disclosures
The AI must handle adversarial interactions appropriately, refusing inappropriate requests while maintaining customer service quality.
Ongoing Monitoring
Post-deployment, monitor continuously:
- Sample conversations reviewed for compliance
- Complaints related to AI interactions tracked
- Escalation rates monitored (too low may indicate failures to escalate appropriately)
- Customer satisfaction compared between AI and human interactions
- Automated detection of compliance-relevant keywords and patterns
Address issues quickly. Compliance failures can escalate to regulatory action.
The Human Oversight Question
Regulators increasingly focus on AI governance. The question is not whether humans oversee AI, but how.
Supervision Model
Define how AI conversations are supervised:
- Real-time monitoring of a sample of conversations
- Post-conversation review of flagged interactions
- Regular audit of randomly selected conversations
- Immediate review of escalated conversations
Accountability
Assign clear accountability for AI performance:
- Who reviews and approves AI conversation design?
- Who monitors ongoing compliance?
- Who is responsible for addressing identified issues?
- Who reports to the board on AI compliance status?
Documentation
Maintain documentation that demonstrates governance:
- AI system design rationale
- Compliance testing records
- Monitoring and audit results
- Incident records and remediation
- Board and committee oversight records
This documentation supports regulatory inquiries and demonstrates that AI deployment is governed appropriately.
The Compliance Advantage
Done well, AI can improve compliance, not just maintain it.
Consistency: AI delivers disclosures every time, not when the handler remembers.
Accuracy: AI reads from source systems, not from memory that may be outdated.
Recording: Every interaction is fully documented without relying on handler notes.
Monitoring: Automated compliance checking catches issues that human supervision might miss.
Fairness: AI does not have bad days, biases, or favourites. Treatment is consistent across all customers.
Compliance is not just about avoiding regulatory action. It is about treating customers well. AI, designed and governed appropriately, can treat customers better than inconsistent human processes.
The key is designing compliance in from the start, not bolting it on after the AI is built.
Ready to build compliant AI customer service?
SwiftCase Switchboard includes policy guards, escalation rules, and full audit trails, designed for FCA-regulated insurance operations. Compliance built in, not bolted on.
Book a demo | Learn about Switchboard | See the insurance solution