The FCA didn't say human oversight isn't enough. It said a rubber stamp isn't.

On 19 October the FCA published AI in financial services: good practice and areas for improvement. It is a practical document: what the regulator saw firms doing well and badly with AI, organised around the Consumer Duty, governance and accountability, and operational resilience. It sets no new rules. It shows how the FCA reads the existing ones.

Within a week it was being summarised as "the FCA has told firms that human in the loop isn't enough". That headline is half right, and the half that is wrong matters to anyone deciding how to govern AI.

What the FCA actually wrote

The review's criticism is aimed at a particular kind of human review. Among its areas for improvement, firms relied too heavily on staff to check AI outputs, "without addressing underlying model risk or governance responsibilities". Elsewhere it warns against human review that becomes a "box-ticking exercise" rather than meaningful oversight.

Its case study O describes how that happens. Reviewers were placed in the loop. Over time they increasingly accepted the AI's recommendations without scrutiny, and because the escalation criteria were unclear, low-confidence outputs went through. Nobody removed the human. The human stopped doing anything.

Read the good practice in the same section and the regulator's position is clear. It wants human oversight. It wants it designed:

• Firms decided where human oversight was needed, and what it should look like, from a risk assessment.
• A qualified person with the authority to escalate was involved at the points that mattered.
• Escalation routes had clear thresholds and defined ways to challenge or override an output.
• Firms recorded whether staff reviewed AI outputs, and whether they approved, overrode or escalated them.
• In case study N, affordability reviewers assessed cases without seeing the AI's proposed outcome, which reduced automatic deference to the system.

So the message is not "take the human out". It is "a human who rubber-stamps is not oversight, and you need to be able to show the difference".

Why "use rules instead" doesn't answer it

One response is to replace the reviewer with deterministic logic: encode the policy, let the engine decide, and show its working. For a well-defined, high-volume decision with clear rules, that is a good idea. A consistent engine applying the same policy to every case beats a tired reviewer applying it unevenly.

It doesn't remove the person, though. Deterministic engines still produce cases they refer. Rules still have to be written, approved and changed by someone. And the FCA's accountability section asks firms to show a named senior manager owns the AI risk from design onwards, with decisions recorded alongside their rationale, challenge and escalation. Somebody is still accountable. The question the review raises is whether that somebody is doing real oversight, and whether the record can prove it.

What meaningful oversight looks like in practice

Three things turn a reviewer from a rubber stamp into a control.

Ask the person only when it matters, and say why. If every action goes to a human, the human learns that the answer is always yes. Rules should settle the routine and send people the cases that carry risk: above an amount, outside a pattern, below a confidence threshold. That is the FCA's "clear thresholds" in practice, and it is what keeps a reviewer's attention for the decisions that need it.

Let them think before they see the answer. Case study N is the most practical idea in the review. If a reviewer sees "Recommend: approve, 92% confident" before they look at the case, agreeing is the easy path. If they form a view first, the recommendation becomes a second opinion instead of the answer.

Measure the oversight, not just the outcome. An approval record that says "approved by Sam at 14:02" cannot tell a ten-minute review from a four-second click. A record that shows whether Sam opened the request, how long it was in front of them, what they thought before they saw the system's recommendation, and whether they changed their mind to follow it can.

How Deliverd does this

This is the work Deliverd is built for: putting a named person in front of the actions that carry risk, and keeping a record that shows what they did.

• Gates let you write the thresholds. Allow the routine, deny what must never happen, and send a person what sits between, matched on the amount, the data, the destination or a model's confidence score.
• Oversight quality records when each approver first opened a request and how long they had it, and flags the pattern of nearly everything approved, quickly, as a possible rubber stamp. An optional slow-down rule asks for a minimum time with high-risk requests.
• Blind review, new this week, does what case study N describes. When a high-risk request carries what a model or decision engine recommends, the approver records their own view first and sees the recommendation after. Both go into the record, and Approval analytics shows how often people agreed before they saw it and how often they changed their minds to follow it. A rising share of the second is case study O happening, and you can see it before a regulator does.
• An FCA AI good practice mapping joins the framework packs, alongside the EU AI Act, DORA, PRA SS1/23 and others. It maps each section of the review onto the controls a governed AI use can evidence. As with every pack, it is a starting point for your own compliance review, not a legal conclusion.

The point

The FCA has not given up on human oversight. It has told firms that oversight is something you design, measure and keep evidence of, rather than a person placed at the end of a process and forgotten. Rules engines, models and agents will all get better at making decisions. Someone will still be accountable for them, and the record will still need to show that person did their job.

That is the record we build.