Can a Regulator Sandbox Help Your AI Proof of Concept? What UK Fintech Teams Should Check With the FCA

Can a Regulator Sandbox Help Your AI Proof of Concept? What UK Fintech Teams Should Check With the FCA

A team that has built an AI proof of concept for a financial product soon meets a question that code cannot answer: should the regulator hear about this before customers do? The FCA publishes several routes for firms that want to test new products or AI, and they differ in purpose, eligibility and timing. Some are open, some are closed and some depend on a stage of development a proof of concept has not reached. This guide sets out what the FCA says on its own pages, as of the dates we read them, and offers our own view of how to match a proof of concept to a route. It is an outline, not legal or compliance advice, and every route should be checked live on the FCA website.

First decide whether you need the regulator at all

Not every AI proof of concept needs regulator engagement. A proof of concept that runs on synthetic or internal data, with no customers affected and no regulated activity carried out, is mainly an engineering and governance exercise. Regulator engagement becomes relevant when the work is heading towards real consumers, real money or a regulated activity.

That is our reading rather than an FCA statement, and the boundary is not always obvious. A summarisation tool for internal staff sits at one end. A model that influences a lending decision, or a chatbot that talks to customers about products, sits near the other. If you are unsure which side your project falls on, that uncertainty is itself a reason to take compliance advice early.

It is also worth being clear about what this article does not claim. We have no evidence on how many UK fintech teams use FCA testing routes for AI, and we are not suggesting it is common. The topic matters because the regulator is publishing its expectations on AI and engaging on agentic finance, and because teams building AI financial products often do not know which routes exist.

If your project is still at the stage of testing an idea with real users and building a business case, an AI proof of concept will usually come well before any regulator-facing testing. The questions below help you decide when that changes.

What the FCA says about the Regulatory Sandbox

The FCA's Regulatory Sandbox page, which showed a last updated date of 28 October 2026 and a first published date of 27 March 2022 when we read it, describes a route for testing new products and services live in the market with real consumers.

The most important point is that the sandbox is not a regulatory exemption. According to the page, firms carrying out regulated activities must be authorised or registered first, and restricted authorisation is one of the tools the FCA can use. Firms of any scale and in any sector, authorised or not, can apply. The page says that technology businesses delivering innovation to UK consumers or firms, and technology firms helping regulated firms meet their obligations, are eligible. Detailed criteria sit on a separate eligibility page that we did not read, so check it.

The tools the FCA describes

The page lists several forms of support. They include:

• Restricted authorisation.
• Signposting to existing rules.
• An informal steer, which is non-binding and followed at the firm's own risk.
• Individual guidance.
• Waivers or modifications of rules, though not of national or international law.
• No-enforcement-action letters, which cover FCA disciplinary action only, for the duration of the test, and do not limit a firm's liabilities to consumers.

Each firm is given a dedicated case manager. The page says tests need a clear objective and a positive impact for consumers, and are typically small, time-limited and limited in the number of consumers involved.

What the page says about timing and AI

The FCA says there are no fixed intake windows and that firms can apply at any time of year. It also says it encourages applications on AI and quantum, among other areas, and on financial inclusion and open finance, and that the list is not exhaustive. The page is explicit that the support is not a substitute for a compliance consultant, and that firms remain responsible for their own compliance.

What the FCA says about the AI Lab

The FCA's AI Lab page showed a last updated date of 3 July 2026 and a first published date of 13 October 2024 when we read it. It groups several initiatives, and the status of each is different. As the page is dated, anything described as open or closed here should be checked again.

Supercharged Sandbox

The FCA describes this as developed with NVIDIA, enhancing the FCA Digital Sandbox with high-performance computing, enriched datasets and AI tools. According to the page, a first cohort of 23 firms has completed, with a showcase on 28 and 29 January 2026. Applications for that cohort are closed, and the FCA says future cohorts will be shared "in due course".

AI Live Testing

AI Live Testing lets firms test AI systems in real-world conditions with regulatory support and oversight. The page describes it as aimed at firms further along: an AI proof of concept with plans to deploy, with pre-deployment testing and post-deployment monitoring considered, and a willingness to share findings with the FCA. Second-cohort applications ran from 19 January to 24 March 2026 and are closed, and testing began from late April 2026.

AI Spotlight

According to the page, AI Spotlight offers insight into how firms experiment with AI. Applications remained open when we read the page, via the Digital Sandbox events page, and selected projects feature on a sign-in Digital Showcase.

Completed activity

The AI Sprint, held on 29 and 30 January 2025, is complete. The AI Input Zone, a call for views on good and poor practice that ran from 14 May to 19 June 2026, is closed. The FCA says it will publish good and poor practice examples "later in 2026".

Matching a proof of concept to a route

Our interpretation, not the FCA's, is that the route follows the stage of the work. These are four stages we see in AI financial products, with the FCA routes that appear most relevant to each.

1. Idea and hypothesis. The team is checking whether a use case is worth pursuing. No regulator route is needed, but a conversation with your own compliance function about the regulatory perimeter is wise.
2. Prototype on safe data. The team builds and tests on synthetic or internal data. The Digital Sandbox and the Supercharged Sandbox are described by the FCA as offering datasets and compute, so look at whether future cohorts or events suit this stage.
3. Proof of concept with real users. The team tests with a small number of real people, perhaps under controls. If the proof of concept involves regulated activity or real consumer outcomes, the Regulatory Sandbox is the route most obviously described for live testing, with its small, time-limited tests.
4. Pre-deployment testing. The team has plans to deploy, has considered monitoring after launch and is willing to share findings. This is the stage the FCA describes for AI Live Testing, subject to whether a cohort is open.

AI Spotlight sits slightly apart, as a way to share how you are experimenting, and may suit teams who want visibility without a formal test.

Two cautions apply to this mapping. First, the stages are not a ladder every project must climb: many proofs of concept will stop at stage two or three because the evidence says the idea does not work, which is a perfectly good outcome. Second, moving from one stage to the next changes who can be harmed if the system is wrong, so the controls you need change too. A proof of concept that was safe on synthetic data may need human review, clear customer disclosure and a way to stop the test quickly once real people are involved.

What to prepare before you engage

Whichever route you consider, regulators respond better to a prepared team. The FCA's own wording points to several of these items, and the rest are our suggestions.

• A clear objective. The sandbox page asks for one. State what you want to learn and what success would look like.
• The expected consumer impact. Describe who would be affected, how, and why the effect is positive. Include what could go wrong.
• The data. Say what data the system uses, where it comes from and how it is protected.
• Accountability. Name who is responsible for the system's outcomes. On 19 October 2026 the FCA gave a speech on finance in the age of AI, reported at the time as applying existing frameworks, including the Consumer Duty and senior-manager accountability, to AI. Read the speech before relying on this summary. The practical point is that accountability stays with the firm.
• Monitoring and human oversight. Explain how you will watch the system and who can intervene.
• A willingness to share findings. The AI Live Testing description refers to this, so be ready for it.
• An exit plan. Decide what happens if the test fails or ends.

If you build all of this into the proof of concept from the start, you gain an evidence trail that is useful whether or not you ever apply to an FCA route. That is the real value of preparing: the artefacts are what a risk committee, an investor or a regulator will ask for.

Check the live status before you rely on any of this

The status of each route changes. The Regulatory Sandbox page we read was updated on 28 October 2026 and the AI Lab page on 3 July 2026, so both may have moved by the time you read this. Applications that were closed may have reopened, cohorts may have been announced and the FCA may have published the good and poor practice examples it promised for later in 2026.

Before you plan around a route, read the current FCA Regulatory Sandbox page and the AI Lab page, and check the eligibility criteria and any application windows. If you cannot tell whether your project is a regulated activity, take legal advice before you start testing with real customers.

Where Innovify fits

Innovify is a technology partner with deep expertise in banking, financial services, fintech and insurance, and we design compliance in from day one. We are not a regulated financial institution, and decisions about regulator engagement, authorisation and applications to the FCA belong to your firm and your advisers.

What we can do is help with the proof of concept. Innovify AI Labs lets enterprise teams run several proofs of concept in parallel, test with real users and finish with a business case ready for funding. Where the proof of concept needs engineering behind it, our AI / ML development team works on the build. Building records, monitoring and oversight in from the start means that if you later choose to engage the FCA, much of the evidence will already exist.

FAQ

Can a UK fintech test an AI product with the FCA before launch?

Possibly, depending on the stage and the route. The FCA's Regulatory Sandbox, which it showed as updated on 28 October 2026, supports live testing with real consumers, and its AI Lab groups several AI initiatives. Each has its own eligibility and timing, so check the FCA pages for current status.

Is the FCA Regulatory Sandbox a regulatory exemption?

No. According to the FCA's page, the sandbox is not a regulatory exemption, and firms carrying out regulated activities must be authorised or registered first. The FCA lists tools such as restricted authorisation, individual guidance and no-enforcement-action letters, and says firms remain responsible for their own compliance.

What is the FCA AI Lab?

The FCA AI Lab is a collection of initiatives for firms working with AI, including the Supercharged Sandbox, AI Live Testing and AI Spotlight. The FCA's page, last updated on 3 July 2026 when we read it, showed the first Supercharged Sandbox cohort complete and AI Live Testing applications closed, with AI Spotlight open.

Do I need to apply at a particular time of year?

For the Regulatory Sandbox, the FCA says there are no fixed intake windows and firms can apply at any time. AI Lab routes have had defined application windows, so check each one on the FCA website before you plan.

What should I prepare before approaching the FCA about an AI proof of concept?

Prepare a clear objective, the expected consumer impact, a description of the data, named accountability, a monitoring and oversight plan and an exit plan. If you are considering AI Live Testing, be ready to share findings with the FCA. None of this replaces compliance advice.

Conclusion

An AI proof of concept does not always need the regulator, but a team heading towards real consumers or regulated activity should know which routes exist and what they offer. The FCA's pages describe a Regulatory Sandbox that is open to applications all year, with real limits on what it can waive, and an AI Lab whose routes open and close by cohort. Match the route to the stage of your work, prepare the evidence a regulator would expect, and check the live pages before you rely on any status. Treat the proof of concept as the place where that evidence is built.

Related reading

• Test Before You Build: How Enterprise Teams Validate New Product Ideas With Real Users Before a Full Build Budget
• What the FCA's October AI Statement Means for Teams Building Financial Products: Good Practice, Poor Practice and Disclaimers on AI Advice
• How to Run an AI Proof of Concept Without an In-House Development Team

Explore next: Innovify AI Labs · Answers to common questions