UK financial services
SM&CR and AI agents: evidencing reasonable steps under the duty of responsibility
The Senior Managers and Certification Regime (SM&CR) is the FCA and PRA framework that makes named senior managers personally accountable for the areas they run. Under the duty of responsibility a senior manager can be held responsible for a breach in their area unless they can show they took reasonable steps to prevent it, and that now includes what AI apps do there.
Not sure this rule covers you? See who each rule covers
The rule
The Senior Managers and Certification Regime: the duty of responsibility
- Who it covers
- FSMA-authorised firms. Firms authorised only as payment or e-money institutions are outside SM&CR.
- What it asks
- A senior manager answerable for each area where AI apps act must be able to show the reasonable steps they took: the controls in place, how they are monitored, and how someone can step in.
- When
- Whenever a supervisor asks; in practice, at each new use and on a regular review.
- Sources
- FCA: SM&CR
What SM&CR asks of senior managers
Each senior manager holds a statement of responsibilities setting out what they are accountable for, and the firm keeps a responsibilities map showing that nothing falls between people. The conduct rules apply to almost everyone in the firm, and the certification regime covers staff whose roles could cause significant harm.
The duty of responsibility is the part that bites when something goes wrong: the FCA can take action against a senior manager where a breach occurred in their area and they did not take the steps a person in their position could reasonably be expected to take to prevent it. The FCA and PRA consulted in 2025 on streamlining parts of the regime; check the FCA's SM&CR page for the current position.
Reasonable steps when AI apps act in your area
Once staff in an area use AI apps that read customer records, draft communications or act on systems, the senior manager's reasonable steps extend to those apps. In practice that means being able to show:
- Which AI apps are in use in the area, by whom, and what they can reach.
- The controls in place: which tools each app can call, what it must never send, which calls are blocked or need a person.
- How the controls are monitored: who reviews the record of what the apps did, and how often.
- How someone can step in: who can switch a tool off, pause an app or revoke a key, and how quickly.
- That the controls were reviewed when something changed: a new app, a new tool, a new model behind the app.
The evidence pack
ContextGate records every tool call made through it with the AI app, the user, the tool, the arguments, the redacted result and the policy outcome. For a senior manager that gives a pack with three parts: the policies applied to each connection and toolbox and the tools switched off, as the controls in place; the activity record, as how the controls are monitored; and the blocked and warned calls, as evidence the controls work.
Naming the senior manager, deciding the controls and reviewing them stay with the firm. ContextGate sees only the tool calls that go through it, not an AI app's built-in tools or the chat itself.
The report
SM&CR reasonable-steps Pack
SM&CR duty of responsibility
Evidence that the senior manager answerable for AI took reasonable steps: the controls in place, how they are monitored, and how someone can step in.
What it covers
- The policies applied to each connection, and the tools switched off.
- The activity record, for how the controls are monitored.
- Blocked and warned calls, as evidence the controls work.
Who needs it
FSMA-authorised firms. Firms authorised only as payment or e-money institutions are outside SM&CR.
What you still do
Name the senior manager, decide the controls and review them.
Questions people ask
What is SM&CR?
The Senior Managers and Certification Regime, the FCA and PRA accountability framework for UK financial services. Senior managers are approved by the regulator and hold statements of responsibilities; the firm certifies staff in roles that could cause significant harm; conduct rules apply to almost everyone.
What is the duty of responsibility?
The rule that a senior manager can be held responsible by the FCA or PRA where a regulatory breach occurred in their area of responsibility and they did not take reasonable steps to prevent or stop it. The burden is on the regulator to show the steps were not taken.
What are reasonable steps under SM&CR?
The steps a person in the senior manager's position could reasonably be expected to take: understanding the area, putting proportionate controls in place, monitoring them, acting on warning signs, delegating properly and keeping a record. For AI apps, that includes knowing what they can do and being able to show the controls operating.
Does SM&CR apply to payment and e-money firms?
Not unless the firm is also FSMA-authorised. Firms authorised only as payment or e-money institutions are outside SM&CR, though they are inside the Consumer Duty where they serve retail customers and inside the new incident reporting rules.
Who is accountable when an AI agent causes a breach?
The senior manager responsible for the area in which the AI app was used. An AI app is a tool used by the firm, not a person the regulator can act against. That is why the reasonable steps need to cover what the apps can reach and a record of what they did.
A summary, not legal advice: check your obligations with your compliance team or adviser.
Ready to see what your AI agents do?
Create a free workspace and add ContextGate to your AI apps in minutes. No card required.
Get started free
We'll email you a sign-in link to set up your workspace.
Rather talk it through first? Book a 30-minute call