FCA AI Lab Cohort 2: When the Regulator Tests Live Instead of Ruling

While the European Union guides its institutions through the risk classifications of the Artificial Intelligence Act (EU AI Act), the UK Financial Conduct Authority (FCA) takes the opposite route: it lets artificial intelligence (AI) run under supervision in real markets and observes what happens – before it decides on rules. On 21 April 2026, the FCA announced the second cohort of its AI Live Testing programme with eight financial firms. According to the regulator, it is the first regulatory programme of this kind in the financial sector worldwide. And it works without a single new AI-specific rulebook.

This constellation is more than a British idiosyncrasy. It defines a regulatory divergence that becomes practically relevant for every German institution with cross-border business: principles-based and downstream in the United Kingdom, classification-driven and upstream in the EU. Anyone operating in both spaces steers two distinct AI compliance logics in parallel from 2026. This article contextualises what Cohort 2 concretely is, why the FCA deliberately forgoes new rules, where the limits of the approach lie, and what conclusions German actors should draw from it.

What the AI Lab Is – and What Cohort 2 Means Within It

An architecture of five building blocks

The FCA's AI Lab, launched in October 2024, is not a single instrument but a bundle: the AI Sprint as a consultation format, the AI Spotlight as a digital showcase, the AI Input Zone for collecting good and poor practice, the Supercharged Sandbox with compute capacity in partnership with Nvidia, and finally AI Live Testing. The programme is led by Jessica Rusu, the FCA's Chief Data, Information and Intelligence Officer, under the overall responsibility of Chief Executive Officer Nikhil Rathi.

AI Live Testing is the sharpest building block because it takes place not in a sealed-off playground but in the real market. The first cohort started on 3 December 2025 with seven firms. The second cohort, announced on 21 April 2026, comprises eight participants and works in a three-phase structure of Discovery, Framework Validation and AI System Testing. Notably, Scottish Widows, as part of Lloyds Banking Group, appears in both cohorts – an indication that the FCA is building longitudinal supervisory relationships rather than one-off experiments.

Who is in Cohort 2 and what is being tested

The eight participants are Aereve, Barclays, Coadjute, Experian, GoCardless, Lloyds Banking Group with Scottish Widows, Palindrome and UBS. Caution is warranted in mapping the application areas, because the FCA has not published a complete firm-by-firm breakdown: robustly attributable are Experian's consumer credit-score insights and the AI-enabled targeted investment support of Lloyds and Scottish Widows. The remaining themes can be named as a cluster – anti-money-laundering detection, agentic payment services and customer-facing support – without speculatively assigning them to individual institutions. This precision is not a detail but an expression of the same diligence this article demands of the regulator.

Why the FCA Deliberately Forgoes New Rules

Principles instead of paragraphs

The FCA has clarified its stance several times: it does not plan additional regulations for AI but relies on existing frameworks. The Consumer Duty, in force since July 2023, thereby functions as a de facto AI governance framework, because it obliges firms to demonstrate good consumer outcomes rather than merely tick off rule compliance. The Senior Managers and Certification Regime complements personal accountability. Chief Executive Officer Nikhil Rathi has, according to widely reported statements, justified the forgoing of AI-specific rules on the grounds that the technology evolves every three to six months – any rigid rulebook would already be outdated by the time it took effect.

This philosophy is not laissez-faire. It is a bet that empirical learning on the running system produces more robust guardrails than abstract upfront classification. Jessica Rusu named the next horizon at the Innovate Finance Global Summit in April 2026: agentic commerce, in which consumers encode preferences, permissions and constraints and intelligent systems transact on their behalf. A regulator that understands this transition, the argument runs, must observe it before it codifies it.

The institutional flanking

The AI Lab does not stand alone. The Bank of England and the Prudential Regulation Authority established an AI Consortium as a public-private format in May 2025, examining concentration risk from third-party models, explainability of generative AI, credit-risk and trading edge cases, and AI-accelerated contagion. In parallel, Sheldon Mills, the FCA's Executive Director, initiated in January 2026 the review named after him, which reports to the FCA Board by summer 2026 and is to deliver an outlook to 2030. The UK regulator is thus building not a solitaire but a coupled system of conduct supervision, prudential supervision and long-term analysis.

The Regulatory Divergence from the EU AI Act

Two opposing logics

The substantive core for German readers lies in the contrast of architectures. The EU AI Act regulates upfront via risk categories: high-risk applications must be classified, documented and conformity-assessed before deployment. The FCA regulates downstream via outcome obligations: what counts is the demonstrated consumer outcome, not the formal classification. Both approaches pursue the same goal – responsible AI in the financial sector – but come from opposite ends.

Particularly instructive is the timing asymmetry. Article 57 of the EU AI Act obliges member states to establish regulatory AI sandboxes by 2 August 2026. By that cut-off date, the FCA is already at its second live-testing cohort. While EU institutions are still classifying their high-risk systems under Article 6, the UK regulator is accumulating supervisory experiential knowledge on the running business. For German institutions with London activity, this means a dual compliance reality: principles-based in the United Kingdom, classification-driven in the EU.

The German perspective

For the Federal Financial Supervisory Authority (BaFin) and the institutions supervised under it, the lesson is not to copy the British model – the EU legal framework already forbids that. The lesson is more subtle. First: outcomes-based supervision produces learning curves that classification-driven supervision does not produce. Anyone who meets the EU obligations should additionally establish their own empirical impact measurement instead of confusing compliance with effectiveness. Second: the FCA now has a real benchmark against the BaFin, after the BaFin began its own on-site inspections with an AI cyber focus in May 2026. Divergence does not mean that one side is right, but that both models become empirically observable.

The Critical Counter-Calculation

The approach deserves applause with reservation. The UK Parliament, through the Treasury Select Committee, submitted a report in January 2026 that sharply criticises the restraint of the FCA, the Bank of England and the Treasury.

The finding hits a real point: the scale problem. Cohorts of seven to eight firms, whose tests end at end-2026 and whose evaluation is only available in the first quarter of 2027, stand against a market reality in which, according to a Treasury Committee report, more than 75 per cent of UK financial firms already use AI. The sandbox provides regulatory proximity for a tiny selection; the overwhelming majority of deploying firms operate outside this proximity in a principles space without concrete guardrails. This scale problem is precisely structurally identical to the one the BaFin faces without its own sandbox – the British head start in learning does nothing to change the reach gap.

There is also a political uncertainty: the Mills Review could shift the line by summer 2026. Sheldon Mills himself has named the systemic risks – fraud amplification, financial exclusion, algorithmic bias, explainability deficits and misalignment of autonomous systems. The FCA's current position is therefore a snapshot, not an end state.

What German Institutions Should Do Now

The divergence between UK and EU supervision is not an academic topic but a steering task for every institution with cross-border AI deployment. Four measures are priorities:

Risks and Open Questions

Three reservations remain. First, the capacity question: principles-based supervision demands more professional judgement per case from the authority than rules-based supervision. Whether the FCA can scale this depth of judgement across many cohorts without losing quality is open. Second, comparability: as long as each regulator defines its own measure of success, UK live-testing results and EU compliance evidence cannot be cleanly set against each other – divergence generates learning but no common metric.

Third, political reversibility. The Mills Review, parliamentary pressure and a possible pivot towards a more centralised framework could shift the current line. Anyone basing their strategy solely on the assumption of a permanently principles-based UK supervision builds on a snapshot.

For German capital-markets and banking actors, the strategic consequence reads: the FCA Cohort 2 is neither a model to imitate nor a negligible island regulation. It is a running large-scale experiment in outcomes-based AI supervision whose results will feed into the international debate from 2027 onwards – including the European one. The most productive stance is neither imitation nor ignorance but attentive reading along: what the FCA learns empirically, the EU will sooner or later discuss. Anyone who anticipates this helps shape it. Anyone who ignores it will be caught up after the fact.

Christian Schablitzki

Strategy & Management Consultant · Agentic AI expert for financial institutions

Over 20 years in investment banking and derivatives trading, followed by more than 10 years advising financial institutions. Currently a Partner at Infosys Consulting in Germany. Certified in Google AI, Generative AI Leader (Google Cloud) and IBM RAG and Agentic AI.

LinkedIn profile →