SM&CR and AI-Written Code: Who is Accountable?

Under the Senior Managers and Certification Regime, accountability for AI-written software sits with the senior manager responsible for the business area it runs in. There is no special AI function. The FCA has told Parliament it does not plan detailed rules for this. A senior manager therefore needs evidence they can show now: a chain from each change to a named, approved, recorded decision.

Most firms are waiting for guidance before deciding what that evidence should look like. The FCA's own words suggest the wait will be long, and that what arrives will be examples rather than a checklist. This piece reads what the regulator has actually said and maps it to the release record a senior manager would need. It describes how the rules read from inside a company that builds release evidence. It is not legal advice.

What Does SM&CR Already Require When AI Writes the Change?

The senior manager conduct rules already cover it. They are technology-neutral. A senior manager must take reasonable steps to ensure their area is controlled effectively, complies with regulatory requirements, and that any delegation goes to an appropriate person with effective oversight. Who or what wrote the code does not change those duties.

The relevant rules sit in COCON 2.2 of the FCA Handbook:

SC3 is the one worth reading slowly. It talks about delegating to an appropriate person and overseeing that delegation. An agent that writes code is not a person in that sense. Our reading is that the oversight chain has to reach a human who can show what they reviewed. That human is often the person signing the release, not the senior manager themselves. It is still an interpretation, and one for your compliance function to test.

The practical point holds either way. "Reasonable steps" is judged after the event, against what you can show. A release you cannot account for makes that a difficult conversation.

What Has the FCA Said About AI and Accountability?

Parliament asked for guidance. The FCA replied that it will not write AI-specific rules, and will instead share examples of good and poor practice. The Treasury Committee recommended comprehensive, practical guidance on senior manager accountability by the end of 2026. In March 2026 the FCA answered that its approach steers away from traditional rules and guidance. It also said firms accept that AI's complexity does not reduce their accountability.

The sequence, from primary sources:

• 20 January 2026. The House of Commons Treasury Committee published its report on AI in financial services (HC 684). It recommended that the FCA publish practical guidance by the end of 2026. The guidance would cover consumer protection rules and the accountability and assurance expected from senior managers for harm caused through AI.

  
  

• 27 January 2026. The FCA launched the Mills Review, a long-term look at how AI will reshape retail financial services.

  
  

• 18 March 2026. The FCA's written response, published by the Committee on 16 April in its Seventh Special Report (HC 1791), made four points:

  • Its 2024 AI Update already explains how the Consumer Duty and SM&CR apply to AI.

  • It has deliberately moved away from traditional rules and guidance.

  • It will share examples of good and poor practice as its innovation work progresses.

  • It will publish an AI Live Testing evaluation report around the end of 2026 or early 2027.

  
  

Read together, the message to senior managers is plain. The accountability is already yours. Do not expect a checklist that defines "reasonable steps" for AI-written software. Expect to be judged on whether you can show control, using examples that will appear over time.

Waiting for guidance is a decision. On the regulator's own account, it is a decision to arrive without a record.

What Evidence Links an AI-Written Change to a Named Senior Manager?

It takes seven links, each with an artefact you can produce on request. The chain starts at the change and its author. It runs through the source the change answers to, the test, the approval and the result. It ends at the release decision and the senior manager whose Statement of Responsibilities covers that business area. A missing link is where a regulator's question gets answered with a narrative.

We call this the Named Human Chain.

Three things stand out when firms try to fill this table.

• Link 1 is getting harder. More change arrives from coding agents and vendor releases, and authorship is often recorded as a service account.

• Link 4 is usually missing. Plenty of people approve releases. Very few approve tests.

• Link 7 rarely connects to anything below it. The senior manager's oversight is described in a policy, not shown in a record.

The regulator names one human. The evidence has to reach them through every link in between.

Illustrative Scenario: The Question Six Months Later

This scenario is illustrative. It describes a pattern, not a specific firm.

Picture a UK wealth manager whose client portal shows a fee illustration before a client switches funds. In spring, a coding agent refactors the illustration service. The pull request passes its tests and ships in a routine release. An edge case now drops one platform charge from the illustration for clients holding a particular fund class.

Six months later, complaints point to the problem. Supervisory questions arrive under the Consumer Duty, addressed through the firm to the senior manager whose responsibilities cover the platform.

Walk the Named Human Chain.

1. Change. The commit log shows the refactor. The author is recorded as an automation account.

2. Source. The fee disclosure rule exists in a policy document. Nothing links it to the refactor.

3. Test. The tests the agent wrote check that the service returns a value, not that the value includes every charge.

4. Approval. Nobody approved those tests as a fair check of the fee rule.

5. Result. Green, in every run.

6. Decision. The release ticket says "regression complete".

7. Senior manager. The senior manager can show a governance policy. They cannot show that the policy reached this change.

None of this is unusual. That is the problem. The firm had controls on paper and tests that passed. What it lacked was a chain that made those controls visible at the level of a single change.

What Could "Re asonable Steps" Look Like for AI-Written Change?

Nobody can say definitively yet, and anyone who claims otherwise is guessing. What a senior manager can do is put themselves where a reasonable-steps assessment would look first. That means knowing which changes in their area touch regulated outcomes, and being able to show that each of those was tested against its source and approved by a named person.

The goal is a position you can show, not one that merely reads well. In practice that tends to mean four things:

1. Scope: The senior manager knows which systems in their area carry regulated outcomes: fee disclosures, suitability, claims decisions, member calculations.
   
   

2. Rule: For those systems, a written rule says that AI-written change needs a test traced to its source and a named human approval before release. Lower-risk areas can run with lighter control.
   
   

3. Evidence: The rule produces records as a by-product of the work. If evidence has to be assembled after the event, the rule is not really operating.
   
   

4. Oversight: The senior manager periodically samples releases and asks for the chain. The fact that they asked, and what came back, is itself part of the record.
   
   

The honest part. A record does not make a firm compliant. It makes the firm able to show what it did, which is a different and more modest claim. A release record will also never settle whether a requirement was the right requirement. That judgement stays with people, and it should.

Where Does Virtuoso QA Touchstone Fit?

Touchstone produces links 2 to 5 of the Named Human Chain as a by-product of building tests: source, test, approval and result. AI reasons, a deterministic engine executes, a person approves what matters, and every decision leaves evidence.

• Source: Touchstone reads the documents you select, such as policies, product rules, specifications and tickets. It cites the source for every requirement it proposes, so it cannot invent an obligation you never gave it.

  
  

• Test: The Analyst, Architect and Autopilot agents turn approved requirements into runnable journeys in a real browser. You review and steer at each stage.

  
  

• Approval: Nothing reaches build without a named human approving it. Each change is reviewed as a diff against the previous version and its source. The decision is recorded, timestamped and versioned.

  
  

• Result: Virtuoso QA's deterministic engine runs the journey and produces the same result every run. The system that proposes the test did not write the code and does not execute it.

  
  

• When a policy changes: Upload the revised document and Touchstone flags the requirements it affects and proposes updates as diffs with citations. Journeys built on an outdated requirement are flagged too.

  
  

What Touchstone Does Not Do Today

• It does not record who or what authored a code change. Link 1 comes from your source control and your vendors' release notes.

  
  

• It does not make the release decision or map systems to Statements of Responsibilities. Links 6 and 7 stay with your people and your governance.

  
  

• A single audit timeline across every asset will follow and is not available today. Approvals and versions are recorded on requirements and journeys.

  
  

• It tests browser-based applications. Native mobile and desktop apps, and load or performance testing, are outside its scope.

AI generates software. Virtuoso QA generates the evidence to trust it.

To see how agents write and maintain tests while every action stays tied to a named person, take a look at Virtuoso QA’s agentic AI software testing.

What Should You Do Before the FCA’s Examples Arrive?

Here are five things you can do this quarter without buying anything:

AI will keep writing more of the code each quarter, but the regulator will still look for a named person. Being ready means that person can point to actual records for each release, not just a policy.