Evidence a Supervisor Will Ask For During an AI Review

During an AI review, supervisors will expect to see evidence that your organisation is actively managing AI systems in line with existing UK regulatory expectations. The focus is on demonstrating that AI governance is embedded into daily operations, not merely a policy on paper. Below are the key categories of evidence that supervisors are likely to request, with practical examples to guide your preparation.

1. AI Risk Assessments and Impact Evaluations

Supervisors will want to see formal risk assessments that identify potential harms or unintended consequences of AI systems. These must be tied to specific AI models or processes. For example, if your bank uses an AI model to assess creditworthiness, the risk assessment should detail potential biases in data inputs, such as gender or geographic factors, and explain how these have been mitigated or monitored. The assessment must also show how these risks are reviewed and updated over time. The FCA expects such evaluations to be proportionate to the AI system’s impact and risk level. Where AI systems are used in high-risk areas such as investment advice or fraud detection, these must be reviewed at least annually or whenever there is a significant change in data or usage.

• Documented risk assessment for AI models used in customer-facing decisions
• Records of bias testing or fairness audits
• Mapping of AI systems to identified risk categories

2. AI Governance Framework and Oversight

Supervisors will look for evidence of a clear governance framework that assigns roles and responsibilities for AI oversight. This includes who is accountable for AI decisions, who is responsible for monitoring, and how decisions are escalated. For example, a senior manager should be identified as the AI governance owner, with a cross-functional team including data scientists, legal, compliance, and IT specialists. The framework must also show how AI decisions are reviewed and approved, such as through a formal approval process or AI audit trail. The framework must be aligned with existing organisational structures and processes, not treated as a separate or isolated function.

• Organisational chart or responsibility matrix for AI governance
• Minutes or records of AI governance committee meetings
• Procedures for AI decision-making and approval

3. Technical Documentation and Model Monitoring

Supervisors will expect detailed technical documentation that explains how AI systems work, including data sources, algorithms, and decision logic. This is especially important for high-risk AI systems. For example, if an AI tool is used to detect money laundering, documentation must explain how data is preprocessed, which features are used, and how the model makes classifications. The documentation must also show how models are monitored for drift or degradation. Regular monitoring logs, such as accuracy checks or data quality reports, must be maintained. Where models are retrained or updated, these changes must be documented and reviewed for impact.

• Technical specification documents for AI models
• Monitoring dashboards or logs for model performance
• Change management records for AI systems

In addition to these core areas, supervisors may ask for evidence of AI literacy training, data governance, and transparency measures. For example, staff who interact with AI systems must have received training on how to identify potential issues or misuse. Data used by AI systems must be properly managed, including data quality checks, access controls, and retention policies. Where AI systems are used to make decisions that affect customers, there must be a mechanism to explain or justify these decisions. This is particularly important for systems that fall under EU AI Act transparency obligations, such as those placed on the market after 2 August 2026.

Organisations must also be ready to demonstrate compliance with ISO/IEC 42001:2023, which sets out requirements for an AI management system. This includes having processes for AI risk management, data governance, and continuous improvement. The standard requires that AI systems are designed and operated in a way that aligns with organisational values and regulatory expectations. Where an organisation has achieved certification under this standard, such as through BSI, this must be presented as evidence of good practice. The certification must be current and relevant to the AI systems being reviewed.

Lastly, supervisors may request evidence of how your organisation is preparing for future regulatory developments. This includes planning for obligations such as those in Regulation (EU) 2026/1744, which defers certain high-risk AI obligations to 2027 or 2028. Showing that your organisation is proactively addressing these future requirements, such as through pilot projects or policy development, helps demonstrate forward-thinking governance. The goal is to show that AI is not treated as a static tool but as an evolving part of your risk and compliance framework.