AI Audit Readiness: What UK Regulated Firms Must Show

What is AI audit readiness? It is being able to demonstrate, on demand, that your firm’s AI use is governed: which tools are in use, what data each may touch, who is accountable, and how outputs are checked. It matters now because the FCA has said it will publish a good and poor practice report for AI in financial services later in 2026, the benchmark supervised firms will be measured against, and more than 75% of UK financial services firms already use AI (FCA, Mills Review, 6 July 2026).

Firms keep asking us how to get their AI "approved." No UK regulator approves AI tools. What they supervise is whether you can evidence that your use of AI is controlled. That reframes the whole exercise: readiness is not a technology project, it is an evidence pack, and an evidence pack is finishable.

Why "readiness" became urgent in 2026

The finance sector is furthest ahead, so watch it as the leading indicator. On 6 July 2026 the FCA published the final Mills Review, led by Sheldon Mills, examining how AI could transform retail financial services out to 2030. In parallel, the FCA’s AI Live Testing programme moved into its second cohort, eight firms including Barclays, Lloyds Banking Group and UBS, with trials that began in April 2026 and conclude by the end of the year; an evaluation report follows in Q1 2027 (FCA, 21 April 2026).

The practical signal for everyone else is the promised good and poor practice report. When a regulator publishes what "good" looks like, the firms that can already show their governance pass with a conversation; the firms that cannot start a scramble. Readiness is cheaper before that document lands than after.

It is not just a finance question

The same evidence expectation is arriving through data-protection law, which reaches every sector. The Data (Use and Access) Act 2025 reframed the UK rules on automated decision-making from a near-blanket prohibition into a right of challenge with safeguards, letting firms rely on any Article 6 lawful basis while keeping requirements for meaningful human involvement and decision-specific information. The ICO consulted on updated guidance to match, and that consultation closed on 29 May 2026. The shift is subtle but important: the burden moves from "are you allowed to do this?" to "can you evidence the safeguards?" That is an audit-readiness question by another name.

For the fuller map of how these regimes overlap, our guide to AI compliance for UK businesses untangles GDPR, the FCA and the EU AI Act into one checklist.

What an auditor or regulator actually looks for

Strip away the acronyms and the questions are the same across the FCA, the ICO, the SRA and the CQC. An audit-ready firm can answer all five without a meeting:

• Inventory. Which AI tools are in use, sanctioned or not? You cannot govern what you cannot see, and the most common failure we find first is shadow AI, staff using unapproved consumer tools on live work.
• Data handling. For each tool, does the vendor train on or retain your inputs? A free public chatbot and a tool contracted not to retain your data can produce the same draft, but only one is defensible.
• Accountability. Who owns each material AI use? Regulators expect a named person, not "the team."
• Human check. How is output reviewed before it reaches a client or a decision? "The AI said so" is not a defence in any regulated context.
• Policy. Is there a written rule staff actually follow, and does it match what they really do?

The evidence pack, in a weekend

Readiness is four documents in most firms: a register of approved tools and permitted uses, a one-page AI policy staff will actually follow, a short data-handling note per tool, and a named owner. That is the pack that turns a regulator’s question into a two-minute answer. It is governance work, not a build, and a small firm can assemble the first version in a weekend. Finance firms will want to align theirs with the direction of travel in our guide to AI software for FCA compliance.

We work directly in FCA, SRA, ICO and CQC contexts and build the evidence pack around how your team actually operates. Our 90-minute AI readiness audit tells you, in plain English, exactly what you can already show and the two or three gaps to close before the regulator asks. Book a call to talk it through.

General information for UK firms, not legal, financial or compliance advice. Verify your obligations against current regulator guidance and, where needed, take professional advice. Last updated: 23 July 2026.