AI tools for UK mortgage brokers fall into a few kinds: meeting transcription and notes, document reading, drafting of fact finds, file notes and suitability letters, client chasing, and file checking. Before buying any of them, check where client data is processed and kept, whether it trains models, and that an adviser approves every output before it is relied on, because the firm stays accountable under FCA rules.
The regulatory starting point
The FCA's page "AI and the FCA: our approach" says: "We do not plan to introduce extra regulations for AI." The existing rules apply instead: MCOB for the advice and its record, the Consumer Duty for outcomes, and the Senior Managers and Certification Regime for accountability. We know of no FCA scheme that approves AI tools, so "FCA compliant" on a vendor's website is the vendor's opinion.
Buying a tool does not move responsibility. The FCA's Consumer Duty guidance, FG22/5, says that where firms use a third-party provider, they remain "responsible and accountable" for their regulatory obligations (paragraph 11.29).
The kinds of tool, and where the risk sits
| Kind | What it does | Where the risk sits |
|---|---|---|
| Meeting transcription and notes | Records the advice meeting, transcribes it, and drafts a summary or file note | Recording without a clear basis or notice, and summaries that reach the file unchecked |
| Document reading | Reads payslips, bank statements, ID and statements, and extracts the figures | A misread figure that nobody checks against the page |
| Fact-find drafting | Fills the fact find from documents, a questionnaire and the meeting | Values with no visible source, and gaps that look like answers |
| Letter and file-note drafting | Drafts the suitability letter or file note from the fact find and the meeting | Generic reasons that do not reflect what this client said |
| Client chasing | Works out what is missing and drafts the requests to the client | Messages sent to clients without anyone reading them |
| File checking | Checks a case file against a checklist before submission or review | Treating a clean check as proof that the advice was suitable |
| Client-facing chatbots | Answers client questions on a website or in a portal | In our reading, the closest to giving advice or making a financial promotion without an adviser |
The first six support work an adviser already does. The last one talks to clients directly, which is a different level of risk, and the one to take to your compliance function first.
Questions to ask before you buy
Data
- Where is client data stored, and where is it processed? Those can be different countries, and your privacy notice has to cover both.
- Which AI providers does it use? Ask for the sub-processor list and how you will be told when it changes.
- Is anything you send used to train models? Get the answer in writing, with the clause that says so.
- How long does each provider keep what it receives, and is that a fixed limit or a default with exceptions?
- Will the vendor sign a data processing agreement? UK GDPR Article 28 requires a written contract with any processor.
Control
- Does anything reach the client file, or the client, without an adviser approving it? It should not, and any setting that allows it should start switched off.
- Can you see where every extracted value came from? A figure without a source has to be checked by hand anyway.
- Is any decision about a client made solely by automated means? UK GDPR Article 22 restricts decisions with legal or similarly significant effects made that way.
- Does the tool record which version of its model or prompt produced each draft? That matters when a file is reviewed years later.
Fit
- Does it work with the CRM or back office you already run, or become a second place where client data lives?
- Will your network allow it? Ask before any client file goes near it, not after.
- How do you get your data out, in what format, and what is deleted when you leave?
Test it properly
- Run it on recent cases, with your compliance function's agreement and under your normal data controls, not on the vendor's sample documents.
- Compare every output with the source by hand for the first cases, and count the corrections.
- Look hardest at the correction path: how an adviser fixes a wrong value, and whether the fix is recorded.
- Ask your compliance function to review a finished file before the tool is used on live advice.
The paperwork your firm needs
The ICO's list of processing that needs a data protection impact assessment includes innovative technology, which it says includes AI, when combined with another risk factor, and UK GDPR Article 35(3)(b) requires one for large-scale processing of special category data such as health. Most firms adopting an AI tool for client files will want a DPIA. Update your privacy notice so clients are told that AI services process their documents or meetings, where, and for how long, and record your lawful basis and, for health and similar details, your Article 9 condition.
See what Crestwell drafts, and what stays with the adviser. Crestwell Autopilot.