2 | The risks and rewards of AI: the regulatory view
By Alys Jones
In its 2025 to 28 three-year strategy, the UK Financial Reporting Council (FRC) positions itself as a regulator focused on serving the public interest while supporting UK economic growth, with a clear emphasis on driving higher audit quality and operating more agilely in response to emerging market developments, including advancements in technology, such as AI. It describes an “improvement regulator” model that goes beyond setting standards and enforcing compliance, aiming instead to encourage those it regulates to embed continuous improvement, learning and the right culture and behaviours – alongside proportionate, targeted interventions where serious shortcomings arise.
Against that backdrop, the FRC has recently published landmark guidance on generative and agentic AI and, through its Innovation and Improvement Hub, announced new initiatives including an Audit Tech and AI Sandbox, a second round of the Simplifying Annual Reporting Sandbox, and a research programme to explore barriers to technology adoption in audits – designed to help firms and businesses test real-world use cases with regulatory input while maintaining confidence that audit quality and reporting expectations are met.
The FRC's guidance on generative and agentic AI
The FRC is supportive of innovation and the "appropriate" use of AI. In particular, the FRC believes that generative and agentic AI tools have the potential to significantly enhance audit quality.
In non-prescriptive guidance published on 30 March 2026, the FRC discusses the potential risks of AI in some detail, as well as providing its views on how these risks may be mitigated. The guidance is intended to codify good practice that the FRC has seen, promote audit quality, build confidence in the use of these technologies, and provide a conceptual foundation for future FRC work in this area.
The FRC identifies the key risks as being:
- Risk of deficient output – the risk that issues in system inputs or the design of the system result in a deficient output (including, for example, hallucinations, omissions, distortions), which may then be relied upon during the audit.
- Risk that outputs are misused – the risk that an output from an AI tool is misinterpreted or misunderstood by the user, possibly leading to an inappropriate conclusion in the audit.
- Risk that the audit methodology is not compliant with auditing standards – It may be challenging to compare the persuasiveness of outputs of an AI tool to evidence obtained from more traditional approaches, making it difficult to ascertain if the requirements of the auditing standards have been met.
The guidance explains that these audit quality risks can be mitigated in a number of ways, including through appropriate system design and development, certification, staff education and governance and human review and oversight.
One of the key takeaways from the guidance is that the audit firm and the engagement partner retain full responsibility for audit quality, in accordance with ISQM (UK) 1 and ISA (UK) 220 respectively, and significant professional judgement will be required by auditors to determine how to incorporate AI tools into audits in ways that comply with auditing standards.
What's next?
Overall, the FRC’s guidance has been seen by many as a positive step that starts to reduce the regulatory uncertainty many firms cite as a barrier to adopting AI meaningfully and at scale. However, this is only the beginning: the ICAEW has said that firms are still grappling with the practicalities of implementation of AI and want more real-world examples and use cases, with the ICAEW keen to work with the FRC to develop the position further. It also highlights a harder, unresolved issue – independent assurance over third-party products may be difficult in a nascent market, and audit firms will need greater clarity on where product developers’ responsibilities end and where implementers’ and users’ responsibilities begin – making continued collaboration and ongoing dialogue critical if the sector is to strike the right balance between innovation, risk and ethical adoption.
