When a supervisor writes about AI, a fund firm needs one answer: does this
change what we must document, test or sign off? This page tracks the AI rules, supervisory
statements and enforcement actions that reach fund managers, administrators and depositaries.
What appears: laws, rules, supervisory statements and enforcement
actions that a regulator, supervisor or legislator has published, with a date. Each links to the issuer's own document.
What does not: commentary on a rule, which is not a rule.
Coverage: the EU, UK, Luxembourg, Ireland, Jersey and Guernsey first. Other
jurisdictions appear when their statements reach fund firms here.
For AI that fund firms have deployed, see AI news for
funds. For the controls that apply job by job, see the use cases.
As at 2026-10-21 · Source: the issuer's document linked on each item (dated per item) ·
Limitations: coverage starts with the EU, UK, Luxembourg, Ireland, Jersey and Guernsey.
EU AI Act: which dates apply
The EU AI Act applies in steps. The prohibited practices and the AI literacy duty
have applied since February 2025; the high-risk rules come later.
1 Aug 2024In force The AI Act enters into force.
2 Feb 2025AppliesProhibited practices and the AI literacy duty. Firms that deploy AI take measures to give their staff a sufficient level of AI literacy (Article 4).
2 Aug 2025Applies Obligations for providers of general-purpose AI models.
27 Jul 2026In force The AI Omnibus amends the timetable for the high-risk rules.
2 Dec 2027NextHigh-risk rules for the Annex III areas.
2 Aug 2028Later High-risk rules for AI built into regulated products.
Who it affectsCompliance and riskFund operationsTechnology
The FCA wants senior managers to be personally accountable for the AI systems their firms use. It also wants significant AI failures and near-misses reported through the major-incident reporting its rules already require. Jessica Rusu, the FCA's chief data, information and intelligence officer, set this out in a speech on 19 October. She also gave good and poor practice examples from the FCA's testing with firms this year.
Governance: clear accountability, risk-based controls, human oversight and escalation triggers. The FCA says too many firms still under-invest here, and some add governance only after a tool is live.
Resilience: stress-test AI systems and keep fallback options. Know where suppliers are concentrated, including reliance on a single model.
Incidents: the duty to report major incidents must extend to significant AI failures and near-misses.
Assurance: agentic systems need continuous checks. A system that is safe at launch may behave differently at scale, or when the models beneath it change.
A joint FCA and Bank of England survey, due the following week, shows 86% of firms now use AI. The speech sets out what supervisors expect, not new rules. The FCA will update its good and poor practice as the technology moves.
At a UK fund manager, this lands on the senior managers, on compliance and on the owners of operational resilience. It also reaches the outside suppliers that run AI on fund records.
Which senior manager is accountable for the firm's AI systems, and does the incident log have a category for an AI near-miss?
In practice: add significant AI failures and near-misses to the incident log and its escalation thresholds now. Then map every AI tool in use, including those run by suppliers and delegates, to the senior manager whose responsibilities cover it.
Who it affectsCompliance and riskFund operationsFund administration
The Financial Stability Board has finalised 12 sound practices for the use of AI by financial institutions, and strongly encourages firms to reference them. Four deal with governance: the board and senior management's oversight role, clear roles and responsibilities, AI risk in the risk framework with AI use documented, and continuous learning. The other eight follow each AI use case through its lifecycle, from choosing the AI technology and assessing its risk at the outset to data governance, explainability, performance checks, human oversight, cyber and ICT risk, and reliance on outside AI suppliers. The FSB calls them a toolkit to add to the cyber and third-party risk frameworks a firm already has. In practice: at a fund manager or administrator, keep a list of AI use cases, each with a risk rating, a named owner and the human sign-off, so the board can show it has referenced the practices.
Who it affectsCompliance and riskFund operationsTechnology
The AI Act entered into force on 1 August 2024. The prohibited practices and the AI
literacy obligation have applied since 2 February 2025, and the general-purpose AI model
obligations since 2 August 2025. The AI Omnibus has been in force since 27 July 2026. It
moves the rules for high-risk systems in the Annex III areas to 2 December 2027, and for AI
built into regulated products to 2 August 2028. In practice: the AI literacy duty already applies to
any fund firm whose staff use AI tools. A training record per team is the evidence a
supervisor or auditor will ask for first.
Who it affectsCompliance and riskPortfolio management
ESMA's public statement expects firms that use AI to comply with the existing MiFID II
requirements. It points to organisational arrangements, conduct of business and the duty to
act in the client's best interest. No new rulebook: the AI tool sits inside
the controls the firm already has. In practice: for a manager with MiFID top-up permissions,
an AI tool used in advice or portfolio management gets the governance, outsourcing and
record-keeping treatment of any other system. It needs a named owner.
How to read a regulatory item
Is it binding? A regulation or a rule change binds. A speech, a discussion
paper or a "Dear CEO" letter shows where supervision is heading.
Who does it reach? Many AI statements are written for banks or retail
investment firms. They reach a fund manager through its MiFID top-up permissions or its
delegates.
What evidence does it imply? Most statements end in a request for a
register, a policy, a training record or a named owner.
In practice: keep one AI register per firm, listing each tool, its owner, the data it
touches and where the human sign-off sits. That register is the document these statements
end up asking for.
To verify
AI literacy after the Omnibus: the Commission's November 2025 Omnibus proposal would have moved the Article 4 literacy duty from firms to Member States and the Commission. Confirm the adopted text in the Official Journal before relying on the literacy duty as it stands above.