What FCA and CMA rules mean for AI content in financial marketing?

What to take away

How FCA financial promotion rules reach AI-written marketing content

The FCA regulates financial promotions in the UK. A financial promotion is any invitation or inducement to engage in investment activity, communicated in the course of business. That definition does not care whether a human or an AI content tool drafted the text.

If your firm uses AI content tools to draft a savings product email, a pension transfer advert or a social post about a fund, the FCA financial promotion rules apply to the final text. The rules require promotions to be fair, clear and not misleading. They also require a clear indication of the risks where relevant.

A common mistake is treating AI output as a first draft that compliance will fix later. Compliance teams should instead be involved before the prompt is written. The prompt shapes the claims, and claims are what the FCA assesses.

Under the FCA's approach, a firm must be able to show who approved a promotion and when. That is a regulated content sign-off duty, and it sits with the firm, not with the AI vendor. The FCA has no register of approved AI tools, so tool selection does not transfer responsibility.

The FCA also expects firms to consider the target market. An AI content tool that generates the same pension copy for a first-time saver and a near-retiree is unlikely to meet that expectation. The advertising rules that apply to ad copy sit alongside the FCA regime, not instead of it.

Prompts are compliance artefacts

Prompts and system instructions are, in practice, part of the drafting record. If a prompt tells the tool to emphasise returns and omit fees, that instruction is evidence of intent. Keep prompts with the version of the copy they produced.

The senior manager question

Under the Senior Managers and Certification Regime, a named senior manager is accountable for the firm's compliance with financial promotion rules. AI does not dilute that accountability. The FCA has been clear that firms cannot outsource regulatory obligations to a tool.

Consumer duty and fair treatment in AI-assisted financial copy

Consumer duty requires firms to act to deliver good outcomes for retail customers. It has four outcomes: products and services, price and value, consumer understanding, and consumer support. AI-assisted financial copy touches at least two of them directly.

Consumer understanding means communications must be understandable. AI content tools tend to produce fluent text, which can hide complexity. Fluent copy about drawdown, early repayment charges or variable rates can still fail the understanding test if a typical customer misreads it.

Price and value is also relevant. If AI copy describes a product as good value without evidence, the firm risks a consumer duty breach as well as a financial promotion breach. The FCA expects firms to test whether customers understand the communication, not just whether it reads well.

Vulnerable customers need specific attention. AI tools trained on general web text may not account for characteristics of vulnerability, such as low financial resilience or limited digital confidence. A human reviewer should check that the copy does not pressure or confuse those groups.

The FCA's consumer duty expectations sit within a wider set of rules and ethics that govern how AI content operations are run. Firms should document how they test AI-assisted copy against the four outcomes.

Testing understanding

A practical test is to ask a small panel of representative customers what they think the promotion means. If their reading differs from the intended meaning, revise the copy. Record the test and the changes made.

Fair treatment in tone

AI tools can produce urgent, salesy language that conflicts with fair treatment. Set tone rules in the prompt and check the output against them. Urgency is rarely appropriate in a regulated promotion.

CMA consumer law duties and the DMCC Act 2024

The CMA enforces consumer law duties in the UK. These include the Consumer Protection from Unfair Trading Regulations 2008, which prohibit misleading actions and omissions in commercial practices. A misleading claim in AI-written marketing content can breach those regulations.

The Consumer Protection from Unfair Trading Regulations 2008 also cover aggressive practices and bait advertising. If an AI tool generates a headline rate that is not available to most customers, that is a misleading action.

Older legislation still matters. The Trade Descriptions Act 1968 underpins accuracy in marketing content, particularly around descriptions of goods and services. AI tools that invent specifications or features create exposure under this Act and its successors.

The Digital Markets, Competition and Consumers Act 2024 strengthens the CMA's hand. It gives the CMA direct enforcement powers over unfair commercial practices, including the ability to impose penalties without going to court. It also introduces new rules on subscription contracts, which matter if AI-written copy describes recurring payments or free trials.

Consumer contract and digital content rights come from the Consumer Rights Act 2015. If AI-written marketing content describes digital content, the statutory quality rights apply. Copy that suggests rights are waived is likely to be unfair.

The UK regulations picture is therefore layered: FCA rules for promotions, CMA and consumer law for commercial practices, and sector codes for advertising content. AI content tools must be configured with all of these in mind.

Subscription traps and AI copy

The DMCC Act 2024 targets subscription traps. AI tools that write free trial copy must not hide the rollover price or the cancellation route. Check reminder and cancellation wording against the new rules.

Enforcement risk

CMA enforcement under the DMCC Act 2024 can lead to fines and directions to change practices. For a financial firm, a CMA action alongside an FCA action is a serious operational and reputational event.

Substantiation and approval trails for financial marketing

Substantiation means having evidence for every factual claim. If AI-written financial marketing content says a fund outperformed its benchmark, the firm needs the data. If it says fees are the lowest in the market, the firm needs a defensible comparison.

The Advertising codes - ASA | CAP require that claims in advertising are substantiated before publication. The CAP Code also requires that marketing communications are obviously identifiable as such. Copy that blurs advertorial and editorial lines can breach that rule.

Approval trails should capture the draft, the prompt, the tool used, the reviewer, the approver and the date. A regulated content sign-off process should be documented in the firm's policies. If the FCA asks how a promotion was approved, the firm should be able to produce that record quickly.

Version control matters. AI tools can regenerate copy on demand, so the approved version must be locked. If a later prompt changes the wording, the approval no longer covers it. Treat any material change as a new promotion requiring fresh sign-off.

A disclosure policy helps here. It sets out when the firm discloses AI use, who reviews output, and how records are kept. Disclosure is not always required by law, but internal transparency supports good governance.

A worked example

A firm uses an AI content tool to draft a promotion for a stocks and shares ISA. The draft says "capital at risk" in small print but leads with "beat the market".

Checklist before publication

Where AI content tools create risk in regulated promotions

Hallucination is the most obvious risk. AI content tools can invent rates, dates, regulatory status or product features. In a financial promotion, an invented figure is a misleading claim, even if the tool produced it without intent.

Bias and stereotyping are subtler. Tools trained on historical marketing text may reproduce outdated assumptions about who invests or who manages money. That can conflict with consumer duty and with equality obligations.

Over-personalisation is another risk. If AI tools tailor copy using customer data, the firm must comply with UK GDPR and the Data Protection Act 2018. The ICO expects lawful bases, transparency and data minimisation. Personalised financial promotions can also cross into advice if they recommend a specific action.

Tone drift is common when AI tools rewrite copy for different channels. A compliant email can become a non-compliant social post after an AI edit. Each channel has its own constraints, and the advertising rules apply across them.

Prompt injection and data leakage are operational risks. If staff paste customer data into a public AI tool, that is a data protection incident. A delivery model that survives audit will include controls on what data can enter which tool.

Tool updates

AI tools change. A tool update can alter output style and factual reliability. Firms should re-test prompts after significant changes and re-approve any live promotions affected.

Third-party content

AI tools may pull in third-party text. Check that the firm has the rights to use it and that it does not infringe copyright. The Intellectual Property Office provides guidance on IP in the UK.

Sign-off, records and remediation when something goes wrong

Sign-off should be a defined step, not a formality. The approver must have the competence and authority to challenge the copy. For financial promotions, that usually means a compliance professional with knowledge of the FCA rules.

Records should be retained for the period the firm's retention policy requires, and at least as long as the promotion may be relied on. Store the approved copy, the evidence pack, the approval decision and the prompt history together.

Remediation starts with stopping the promotion. Then assess who saw it and what harm may have occurred. If customers may have acted on a misleading claim, the firm should consider corrective communications and, where appropriate, redress.

The FCA expects firms to notify it of significant issues where required. The CMA can also act under the DMCC Act 2024. Internal incident logs should capture AI-related causes so that patterns can be fixed at the prompt or tool level.

After an incident, review the controls. Did the prompt allow unsupported claims? Was the reviewer trained? Was the tool approved for that data? Update the disclosure policy and the delivery model accordingly. A delivery model that survives audit is one that learns from near misses as well as failures.

Root cause analysis

Ask why the AI content tool produced the error and why the human review missed it. Fix both. A prompt change alone will not help if reviewers are under time pressure.

Board reporting

AI content risk should appear in board or committee reporting. Trends in corrections, approvals rejected and tool changes give the board a view of whether controls are working.

Common questions