When someone asks a chatbot which life insurance policy suits their circumstances, or how much they should be putting into a pension, could the response amount to regulated financial advice? The answer hinges on what’s actually said, not on who — or what — says it.

The legal test hasn’t changed

Whether content is generated by a human, a rules-based tool or a generative AI model does not, by itself, determine whether a regulated activity has taken place.

UK regulation is built around FSMA 2000 and the FCA’s Regulated Activities Order (RAO), and both focus on an activity rather than a messenger. The activity that triggers regulation is giving a personal recommendation — a specific product or investment suggestion tailored to someone’s individual circumstances. For insurance specifically, the RAO separately regulates “advising on” and “arranging” contracts of insurance, so both the recommendation itself and the process of helping someone take one out can fall inside the perimeter.

Generic information sits outside that definition. Explaining how income protection insurance works, or what excess means on a car policy, is guidance — not advice — however it’s delivered. A printed leaflet, a call-centre script, and an AI chatbot are all judged by the same test: does the output amount to a personal recommendation? The moment a response gets specific enough to say, in effect, “given your situation, you should take out this policy” or “put £X a month into this fund,” it crosses into regulated territory — irrespective of whether a human or a model produced it.

Why the line is under real pressure in 2026

That framework is being tested hard this year, and regulators are increasingly focused on how well it’s holding up for everyday insurance and personal finance queries.

A review commissioned by the FCA found that over a quarter of UK consumers already trust generative AI tools for financial advice, with many unaware that the safeguards built around regulated financial services simply don’t extend to AI platforms. Sheldon Mills, the FCA’s executive director, has warned that chatbots risk blurring the boundary between generic guidance and regulated advice — particularly where responses become personalised or where continuous, adaptive prompting starts to resemble the kind of tailored recommendation reserved for authorised firms.

That warning sits within a wider piece of work: the FCA launched a review in January 2026 into how advanced AI could reshape retail financial markets, covering how AI itself might evolve, how that evolution could affect firms and competition, and how consumers will be influenced by — and increasingly interact with — AI in financial decisions. The resulting Mills Review was published on 6 July 2026.

Separately, the FCA’s March 2026 perimeter report flagged the rapid growth of general-purpose AI tools offering financial advice or recommendations as an emerging risk at the edge of its regulatory remit, noting that such tools may not fit neatly within the existing framework. The FCA has since urged government to consider whether the regulatory perimeter itself needs updating if consumer harm starts to materialise.

No AI-specific rulebook — for now

Despite that pressure, the FCA’s public position hasn’t shifted: it intends to keep regulating AI through existing frameworks — chiefly Consumer Duty and the Senior Managers and Certification Regime — rather than introducing bespoke AI rules. Further guidance on audit trails and human-in-the-loop protocols is expected later in 2026, but the underlying legal test (personal recommendation vs. generic guidance) remains the one insurers, advisers, and content providers are working to.

What if a prompt forces the AI to personalise anyway?

This is where regulatory risk increases. If a user (or a business deploying an AI tool) writes a prompt that pushes the model to give a tailored recommendation — “here’s my age, income, health history, and existing cover — tell me exactly which policy to buy” — and the AI complies, that output may, depending on its content, context and the applicable regulatory regime, amount to a personal recommendation or other regulated advice. The legal consequences don’t depend on whether the personalisation was intentional, accidental, or coaxed out by clever prompting; FSMA judges the activity produced, not the intent behind the prompt.

If that activity is being carried on “by way of business” without the necessary FCA authorisation or exemption by an unauthorised party, several things follow:

• It’s a criminal offence. Breaching the general prohibition in section 19 FSMA is an offence under section 23, carrying penalties including up to two years’ imprisonment and/or an unlimited fine.
• Any resulting agreement can be unenforceable. Under sections 26–27 FSMA, a contract entered into on the back of unauthorised advice can be unenforceable against the customer, who can typically recover money paid and claim compensation for loss — while the business is left without a means of enforcing the deal.
• Restitution and disgorgement. Courts and the FCA have powers under sections 382 and 384 FSMA to order restitution to affected consumers and disgorgement of any profits made.
• No automatic access to the Financial Ombudsman Service or Financial Services Compensation Scheme. Because the “adviser” isn’t authorised, the consumer loses access to the redress and compensation routes that exist precisely to protect people who take bad regulated advice.
• Separate financial promotion liability. If the AI’s output (or the surrounding marketing) also amounts to inviting someone into an insurance or investment product, that could also engage the restriction on financial promotions under section 21 FSMA.

For a business, this means the design of the AI tool matters enormously — the system prompt, the guardrails against answering “which policy should I buy” questions directly, and the discipline of steering personalised queries to a human adviser aren’t just good UX. They’re the difference between offering guidance and inadvertently carrying on a regulated activity without permission.

The practical takeaway

For insurers, brokers, and anyone producing AI-assisted personal finance content, the operative question isn’t “was this written by AI?” but “does this amount to a personalised recommendation?” A claim like “our tool gives guidance, not advice” only holds up if the underlying content — and the prompts that shape it — genuinely stay generic. That boundary is exactly what regulators are scrutinising right now, and it can be crossed by user-side prompting just as easily as by design choice on the provider’s side.

This article is provided for general information only and does not constitute legal or regulatory advice. Businesses should seek appropriate legal or compliance advice where AI-generated content may approach the boundary of regulated activities.

Sources

1. Global Policy Watch, “UK Financial Services Regulators’ Approach to Artificial Intelligence in 2026” (9–10 April 2026) — https://www.globalpolicywatch.com/2026/04/uk-financial-services-regulators-approach-to-artificial-intelligence-in-2026/
2. Digital Watch Observatory, “UK’s FCA rethinks AI oversight for financial services” — https://dig.watch/updates/fca-ai-regulation-financial-services
3. Global Regulation Tomorrow, “FCA publishes Mills Review into AI and the future of retail financial services” (6 July 2026) — https://www.regulationtomorrow.com/2026/07/fca-publishes-mills-review-into-ai-and-the-future-of-retail-financial-services/
4. Beinsure, “UK regulator FCA urged to review AI models used for financial advice” (7 July 2026) — https://beinsure.com/news/uk-regulator-fca-urged-to-review-ai-models/
5. Bryan Cave Leighton Paisner, “AI Regulation in Financial Services: Turning Principles into Practice” — https://www.bclplaw.com/en-US/events-insights-news/ai-regulation-in-financial-services-turning-principles-into-practice.html
6. FCA, “Rethinking regulation for the age of AI” — speech by Nikhil Rathi, 24 June 2026 — https://www.fca.org.uk/news/speeches/rethinking-regulation-age-ai
7. Sprintlaw UK, “What Happens If You’re Not FCA Authorised For Regulated Activities” — https://sprintlaw.co.uk/articles/what-happens-if-youre-not-fca-authorised-for-regulated-activities/
8. Legislation.gov.uk, Financial Services and Markets Act 2000 — Explanatory Notes (sections 19, 21, 26–29) — https://www.legislation.gov.uk/ukpga/2000/8/notes/division/6/2
9. FCA, Guidance consultation GC11/13 (on RAO Articles 25 and 53, insurance arranging and advising) — https://www.fca.org.uk/publication/guidance-consultation/gc11_13.pdf