Consumer Duty board report: the AI section, with a template and example

What the FCA expects in a board report

PRIN 2A requires the board to review and approve, at least once a year, an assessment of whether the firm is delivering good outcomes for retail customers. The FCA's review of firms' first reports set out good practice and areas for improvement: reports that are specific to the firm rather than generic, that use data on the four outcomes (products and services, price and value, consumer understanding, consumer support), that say what was found and what action follows, and that show the board challenged the findings.

AI belongs in the report wherever it touches the customer journey: a chatbot answering support queries, an app drafting letters, an assistant reading accounts to suggest a product, an agent updating records. Each is a place where outcomes can improve or quietly degrade.

The AI section: a template

A structure that fits inside the existing report, under consumer support and consumer understanding or as a section of its own:

1. Where AI is used in the customer journey: each AI app, what it does, which customers it touches, and who owns it.
2. What customer data each AI app can reach, and what it cannot: the tools it can call and the ones switched off.
3. The safeguards: personal data redacted before it reaches a model, actions that are blocked, drafts that are checked for misleading claims, human review points.
4. The evidence for the year: how many calls the apps made, how many were blocked or warned on and why, what was redacted, and any incidents or complaints involving AI.
5. Outcomes: what the data shows about customers served by AI compared with the rest, including vulnerable customers.
6. Issues found and actions agreed, with owners and dates.
7. The plan for next year: new uses under consideration and how they will be assessed before launch.

An example of the AI section

An illustrative outline for a firm using an AI assistant in customer support, with placeholders for the firm's own figures: "During the year the support team used [app] to draft replies to [n] customer emails and to look up account details in [system]. The assistant can read account and transaction history and draft replies; it cannot send a reply, change a customer record or move money. Personal data in the records it reads is replaced with placeholders before it reaches the model: [n] sort codes, [n] account numbers and [n] National Insurance numbers were redacted during the year. A check on every draft blocks claims of guaranteed returns and warns on language that may not be clear to customers; it blocked [n] drafts and warned on [n]. Complaints involving AI-drafted replies: [n], against [n] for the team overall. Customers in vulnerable circumstances were routed to a person at [stage]. Actions: [list]. Planned for next year: [uses], each to be assessed against the Duty before launch."

The point of the example is the shape: specific uses, specific limits, counted safeguards, outcomes compared, actions owned.

When the board report is due

At least once a year. The FCA set 31 July 2024 for the first reports, and most firms have kept that cycle, so the AI section needs its evidence gathered through the spring. Ongoing monitoring continues between reports; the board report summarises it.

Where ContextGate's record helps

ContextGate records every tool call your AI apps make through it. For the AI section that gives you the personal data redacted from tool results before the AI app saw it, by type; the governance checks that warned on or blocked a call, such as a draft that promised a guaranteed return; and which AI apps used which customer-facing tools, and how often. Judging the outcomes and writing the report stay with you.