WARRANTThe duty extends to AI-driven decisions.
Eleven words. Everything else in PRIN 2A is the FCA explaining what discharges them. Principle 12 sits above the four outcomes at PRIN 2A.3 to 2A.6 (products and services, price and value, consumer understanding, consumer support) and the cross-cutting obligations at PRIN 2A.2. It binds the firm's decisions however those decisions are produced. A decision an agent makes or shapes is in scope on the same terms as one a human makes. Nothing in PRIN 2A excuses a firm on the ground that a model produced the decision, and the evidential burden at PRIN 2A.8.3R to 2A.8.5R read with PRIN 2A.9 sits on the firm. That the supervisor would reject "the model decided" is Warrant's reading of that burden, not a published FCA statement. For the clause-level reading, see FCA Consumer Duty Principle 12, read against the agent.
Per-decision evidence shape.
trace[*].outputs. The signed package keeps actions[*], whose only properties are action_id, actor, action and subject, so those submitted outputs are not re-emitted. Against each action, obligations.<action_id>[] carries a row whose id is the corpus sub-clause id "fca_consumer_duty.prin_12" and a compliance verdict — obligations is an object keyed by action_id whose values are arrays of rows, so there is no obligations[] path. good_customer_outcomes is that sub-clause's parent_obligation in the corpus, not a key in the package.
regulated_entity, a root field of the trace the firm submits, names the firm. No field in warrant-v1 names an individual, so Senior Manager Function accountability is not evidenced by a named holder in the package.
The senior manager owns the chain.
SMCR is the test. The same instrument that inserted Principle 12 inserted a matching individual conduct rule — COCON 2.1.6R, Rule 6: You must act to deliver good outcomes for retail customers, with the new COCON 2.4 setting its scope. Above it sits the duty of responsibility at FSMA s.66A(5). Per DEPP 6.2.9-AG the Authority can act against an SMF manager where the firm contravened a relevant requirement, the manager was responsible for the management of the activities in which the contravention occurred, and the manager did not take such steps as a person in their position could reasonably be expected to take to avoid it. Where consumer harm follows an AI-driven decision and the firm cannot evidence what steps were taken, that is the evidential gap. The record is the trail. It does not name the person. A Warrant record names the regulated entity — a firm, not an individual — and no field in warrant-v1 names an SMF holder. Binding the evidence to the person who carries the duty of responsibility is the institution's own governance record: the firm's SMF responsibilities map has to tie the business unit and the agent to the named holder, and the Warrant package is what that map points at.
The explainability burden sits on the firm through the consumer-understanding outcome. PRIN 2A.5.3R(1) requires a firm to support retail customer understanding so that its communications meet the information needs of retail customers, are likely to be understood by them, and equip them to make decisions that are effective, timely and properly informed. Retain the evidence, and deliver the same trail to the consumer (where requested) and to a supervisor.
Is the FCA enforcing Consumer Duty now?
Consumer Duty has been in force since 31 July 2023 for new and existing products and, under the PRIN transitional provisions, only from 31 July 2024 for closed products. Both application dates have passed, so the Duty now reaches the whole retail book. We do not assert a supervisory posture we have not verified. What the enacted text settles is the standard and who carries the proof: PRIN 2A.1.17G(1) records that Principle 12 imposes a higher and more exacting standard of conduct, and a broader application, than Principles 6 or 7 would otherwise have required · and PRIN 2A.8.3R to 2A.8.5R read with PRIN 2A.9 put the evidential burden on the firm. As at FCA 2022/31 as made, in force 31 July 2023.
The nearest enforcement analogue predates the Duty and still sets the shape. The FCA's Final Notice against TSB Bank plc, dated 9 October 2024, imposed a financial penalty of GBP 10,910,500 for breaches of Principles 3 and 6 in the handling of retail customers in arrears or financial difficulty between 25 June 2014 and 1 March 2020. The Authority identified 232,849 customers who suffered or were at risk of suffering loss; TSB had paid GBP 99.9 million in redress by the date of the notice. Read it as the pre-Duty version of a Consumer Duty case. The conduct sat in arrears handling, the proof sat in individual case files, and the penalty followed from what those files could not show.
We are not citing a Final Notice in which Principle 12 is the operative breach, because we have not verified one. That gap is the honest state of the record, not a reason to reach for a plausible-looking case number. What the TSB notice does establish is the evidential pattern a Principle 12 case would inherit: the Authority reconstructs the customer journey from the firm's own records, and a gap in those records is read against the firm.
What the enacted text settles is the route, not the enforcement posture. Principle 12 reaches the decision however it was produced, and the senior manager personally accountable for the affected business unit carries the duty of responsibility under FSMA s.66A(5) — the route DEPP 6.2.9-AG sets out, which turns on whether the SMF manager took such steps as a person in their position could reasonably be expected to take to avoid the firm's contravention. The following is Warrant's inference, not a regulator statement: reading that route together with the TSB pattern above, we would expect a specific customer case file (vulnerable, loss-making, opaque rationale) to be the entry point rather than the firm-wide MI pack. We have not verified a Principle 12 case that shows it. Stated as at 2026-08-06.
Per-outcome field map.
The four outcomes operationalise PRIN 12 across products and services, price and value, consumer understanding, and consumer support. Each sits in its own PRIN 2A section, and the numbering is worth getting right: PRIN 2A.1 is application and purpose, PRIN 2A.2 carries the cross-cutting obligations, and the outcomes run 2A.3 to 2A.6. The mapping below names the obligation, the supervisory expectation, and what the warrant-v1 evidence package actually carries against it. The published schema, api/spec/warrant-v1-evidence.schema.json, sets additionalProperties: false at its root and on every action, so the field list is closed and a package cannot carry a sign-off, a risk assessment, pricing parameters or a target market. The rows below name the fields that do exist and state plainly where there is none.
authorizations[*].within_purpose and authorizations[*].reversible carry the per-action assessment, and obligations.<action_id>[].compliance the verdict. warrant-v1 has no risk_assessment field, so foreseeable harm is not carried as its own field.
trace[*].outputs. The signed package keeps actions[*], whose only properties are action_id, actor, action and subject, so those submitted outputs are not re-emitted. Against each action, obligations.<action_id>[] carries a row whose id is the corpus sub-clause id "fca_consumer_duty.prin_2a_cross_cutting_objectives" and a compliance verdict — obligations is an object keyed by action_id whose values are arrays of rows, so there is no obligations[] path. enable_financial_objectives is that sub-clause's parent_obligation in the corpus, not a key in the package.
regulated_entity and agent_id, both root fields of the submitted trace. warrant-v1 has no target-market field, so fit between the product design and its target market is not evidenced in the package.
authorizations[*].justification is the per-action reasoning the signed package carries, and it is Warrant's assessment of the action rather than a copy of the agent's own words. A firm's own reasoning travels in the free-form trace[*].outputs it submits — the sample traces put a rationale key there — and warrant-v1 does not re-emit it, so a subject-access disclosure drawn from the agent's own rationale has to come from the firm's trace store, not from the package.
authorizations[*].human_oversight_appropriate is Warrant's per-action assessment of whether human oversight was appropriate. It is not a record that a human was present or intervened, and warrant-v1 has no field that carries one: a human_review_recorded flag a firm puts in the free-form trace[*].outputs it submits is not re-emitted in the signed package. warrant-v1 has no vulnerable-customer field either, so that marker is not a package field.
regulated_entity, a root field of the submitted trace, names the firm, and the per-action authorization and obligation rows are the trail. No field in warrant-v1 names the SMF holder, so the firm's own governance record has to make that link.
Questions a CCO and SMF holder ask first.
Primary citations.
The enacted text is the Consumer Duty Instrument 2022, FCA 2022/31 — that is the instrument that inserted Principle 12 into PRIN 2.1.1R and created PRIN 2A, and every pinpoint on this page is checked against it rather than against the policy statement. FCA PS22/9 sits at fca.org.uk/publications/policy-statements/ps22-9-new-consumer-duty. The finalised non-Handbook guidance is at FG22/5. The FCA AI overview is at fca.org.uk/firms/ai-financial-services. SMCR reference at fca.org.uk/firms/senior-managers-certification-regime.