What this guide covers
This guide provides a practical framework for using AI in complaint handling operations. It is written for complaint operations teams, compliance officers, technology leads, and risk professionals at firms that are using or considering AI-assisted complaint analysis, triage, classification, or response drafting.
The use of AI in complaint handling is growing rapidly. Firms are deploying AI tools to categorise incoming complaints, identify root causes, flag priority cases, draft response letters, and generate management information from unstructured complaint text. These applications offer genuine operational benefits: faster triage, more consistent categorisation, reduced manual effort, and richer insight from complaint data.
But AI in complaint handling also creates risks that firms must manage. Bias in classification can lead to unfair treatment of certain customer groups. Lack of transparency can undermine consumer trust and regulatory confidence. Improper data handling can breach data protection obligations. And over-reliance on AI recommendations without adequate human oversight can compromise the quality and fairness of complaint outcomes.
This guide covers the current regulatory landscape, the specific risks that arise when AI is used in complaint processes, and the operational practices that firms should implement to use AI responsibly. It draws on the EU AI Act, FCA guidance on AI and machine learning, ICO guidance on AI and data protection, and the practical experience of firms that are already using AI in complaint operations.
AI in complaint analysis: current regulatory landscape
The regulatory landscape for AI in financial services is evolving rapidly, but it is not a blank canvas. Firms that use AI in complaint handling must comply with existing regulations that were not written specifically for AI but apply to its use. These include DISP (which governs how complaints are handled), GDPR and the UK Data Protection Act 2018 (which govern how personal data is processed), the Consumer Duty (which requires firms to deliver good outcomes), and the FCA's Senior Managers and Certification Regime (which requires clear accountability for decisions).
The EU AI Act, which entered into force in August 2024 with a phased implementation timeline, introduces a risk-based framework for AI regulation. AI systems are classified as prohibited, high-risk, limited-risk, or minimal-risk, with corresponding obligations. For complaint handling AI, the classification depends on the specific function the AI performs. AI systems that assess creditworthiness or access to financial services are classified as high-risk and subject to extensive requirements including conformity assessments, technical documentation, and human oversight. Complaint triage and analysis tools that assist human decision-making but do not make autonomous decisions are more likely to fall within the limited or minimal risk categories.
The FCA has published guidance on AI and machine learning through several channels, including Discussion Paper DP5/22 (jointly with the Bank of England and PRA), which explores how existing regulation applies to AI in financial services. The FCA's position is that firms using AI must comply with existing regulatory requirements, including fair treatment of customers, proper governance and oversight, and the ability to explain AI-driven decisions when required. The FCA has not created AI-specific complaint handling rules, but it has made clear that the use of AI does not reduce the firm's regulatory obligations.
The ICO's guidance on AI and data protection addresses the data protection implications of using AI to process personal data, including the requirements for lawful basis, data minimisation, data protection impact assessments, and transparency about automated decision-making. Firms using AI to analyse complaint text, which invariably contains personal data, must ensure compliance with this guidance.
- Conduct a regulatory mapping exercise to identify which existing regulations apply to your specific use of AI in complaint handling.
- Assess whether your AI complaint tools fall within a high-risk category under the EU AI Act and prepare accordingly.
- Ensure AI governance structures meet the FCA's expectations for accountability and oversight under SM&CR.
- Complete a Data Protection Impact Assessment (DPIA) for any AI system that processes complaint data containing personal information.
- Monitor evolving regulatory guidance from the FCA, ICO, and EU institutions for changes that affect AI use in complaints.
Bias and fairness risks in AI-assisted triage and classification
AI systems used in complaint triage and classification can introduce or amplify bias in ways that may not be immediately visible. Because these systems learn from historical data and pattern recognition, they can inherit the biases present in past complaint handling decisions. If the training data reflects past discriminatory practices, inconsistent categorisation, or systematic under-recording of certain complaint types, the AI system will reproduce and potentially amplify those patterns.
Classification bias is the most direct risk. If the AI system categorises complaints, it may systematically miscategorise complaints from certain customer groups. For example, complaints written in non-standard English, complaints from non-native speakers, or complaints that use cultural-specific phrasing may be classified less accurately than complaints written in standard business English. This can lead to certain customer groups receiving slower or less appropriate handling because their complaints are routed to the wrong category or priority level.
Outcome bias can occur when AI systems are used to recommend complaint outcomes or redress amounts. If the training data shows that certain types of customers historically received lower redress or were less likely to have complaints upheld, the AI system may learn to replicate those patterns, even if the historical outcomes were unfair. This is particularly concerning when the customer characteristics that correlate with different outcomes align with protected characteristics under the Equality Act 2010.
Priority bias can emerge when AI is used to flag high-priority or urgent cases. If the AI learns to associate certain language patterns with urgency, it may systematically deprioritise complaints from customers who express themselves differently, including vulnerable customers, customers with low literacy, and customers from different cultural backgrounds.
Feedback loop risk is a structural concern. If AI classification decisions influence how complaints are handled, and the outcomes of that handling become the training data for future AI improvements, the system can create a self-reinforcing cycle where initial biases become entrenched and increasingly difficult to detect.
- Conduct a bias audit of AI complaint classification outputs, segmented by customer demographics where available.
- Test AI performance across different language styles, literacy levels, and communication patterns.
- Compare AI-recommended outcomes against human-only outcomes to identify systematic differences.
- Monitor classification accuracy rates by customer group and investigate significant disparities.
- Ensure training data is reviewed for historical biases before being used to train or fine-tune AI models.
- Build a feedback mechanism where human handlers can flag and correct AI misclassifications to improve the model without reinforcing bias.
Transparency and explainability requirements
Transparency about AI involvement in complaint handling serves two distinct regulatory purposes. First, it supports the data protection rights of individuals under GDPR and the UK Data Protection Act 2018. Second, it supports the broader regulatory expectation that firms should be able to explain the basis for their complaint handling decisions.
Under GDPR Article 22 and the UK Data Protection Act 2018, individuals have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects. Where AI is used to make or significantly influence complaint outcomes, firms must consider whether GDPR Article 22 is engaged and, if so, ensure that appropriate safeguards are in place, including the right to human intervention, the right to express a point of view, and the right to contest the decision.
For most complaint handling implementations, the AI is used to assist rather than replace human decision-making. The AI may categorise the complaint, suggest relevant knowledge base articles, draft a response letter, or flag potential regulatory issues, but a human handler reviews the AI output and makes the final decision. In this human-in-the-loop model, GDPR Article 22 is generally not engaged because the decision is not solely automated. However, firms should ensure that the human review is genuine and substantive, not a rubber-stamping exercise.
Beyond data protection, the FCA expects firms to be able to explain the basis for their complaint handling decisions. If a complainant asks why their complaint was categorised in a particular way, or why a particular outcome was reached, the firm should be able to provide a meaningful explanation. This does not necessarily require disclosing the technical details of the AI model, but it does require the firm to articulate the factors that influenced the decision in terms the customer can understand.
The EU AI Act adds transparency obligations for certain AI systems, including the requirement to inform individuals that they are interacting with an AI system. For complaint handling, this may mean that firms should disclose to complainants that AI is used as part of the complaint analysis process. The specific disclosure requirements depend on the risk classification of the AI system.
- Assess whether GDPR Article 22 applies to your AI-assisted complaint handling process and implement safeguards if so.
- Ensure human review of AI outputs is genuine and documented, not a rubber-stamping formality.
- Prepare explanations for how AI contributed to complaint categorisation and analysis, in language customers can understand.
- Consider disclosing AI involvement in the complaint process to complainants, particularly if required under the EU AI Act.
- Document the AI decision-making logic, input data, and output recommendations for each complaint where AI was used.
- Train complaint handlers to articulate the basis for decisions that were informed by AI analysis.
Data handling and PII considerations
Complaint text is one of the most PII-rich data types in any financial services firm. Complaints routinely contain names, addresses, account numbers, transaction details, dates of birth, health information, financial circumstances, and other sensitive personal data. When this text is processed by an AI system, the data handling implications are significant and must be managed with care.
The primary data protection risk is that PII is transmitted to an external AI service provider without adequate safeguards. If the firm uses a cloud-based AI API to analyse complaint text, the complaint data leaves the firm's environment and is processed by a third party. This requires a lawful basis for processing, a data processing agreement that meets GDPR Article 28 requirements, appropriate technical and organisational security measures, and clear data retention and deletion policies.
PII masking or pseudonymisation before AI processing is the most effective risk mitigation. By replacing identifiable information (names, account numbers, dates of birth, addresses) with placeholders before the text is sent to the AI, the firm reduces the data protection risk without materially affecting the AI's ability to analyse the complaint substance. The AI can categorise the complaint, identify the regulatory issues, and suggest a response framework without needing to know the complainant's real name or account number.
Data minimisation is another key principle. The firm should send only the data that is necessary for the specific AI analysis being performed. If the AI is being used to categorise the complaint, it does not need the complainant's full address or date of birth. If the AI is drafting a response, it needs the complaint summary and investigation findings but not raw transaction records. Each data field sent to the AI should be justified against the specific purpose of the processing.
For firms that operate their own AI models (on-premises or in a private cloud), the data handling risks are different but not absent. Internal models must still comply with data protection principles, including purpose limitation (the model should only be used for the purpose it was designed for), storage limitation (complaint data used for training should not be retained longer than necessary), and security (the model and its training data must be protected against unauthorised access).
- Implement PII masking or pseudonymisation before complaint text is sent to any external AI service.
- Execute data processing agreements with AI service providers that meet GDPR Article 28 standards.
- Apply data minimisation: send only the data fields necessary for the specific AI analysis being performed.
- Conduct a DPIA that covers the end-to-end data flow from complaint intake to AI processing to output consumption.
- Establish clear data retention and deletion policies for complaint data processed by AI systems.
- Ensure AI service providers meet appropriate security standards and that data transfer mechanisms comply with GDPR cross-border transfer rules.
Regulatory acceptance of AI-assisted complaint outcomes
A fundamental question for firms using AI in complaint handling is whether regulators will accept complaint outcomes that were influenced by AI analysis. The answer, as of March 2026, is nuanced. Neither the FCA nor EU regulators have prohibited AI-assisted complaint outcomes, but they have made clear that the firm remains fully responsible for every outcome, regardless of whether AI was involved.
The FCA's position is that the use of AI does not change the regulatory standard that applies to complaint outcomes. A complaint must be investigated fairly, the outcome must be reasonable, the response must be clear, and the complainant's rights must be preserved, whether the analysis was performed by a human, an AI, or a combination of both. The firm cannot defend a poor outcome by arguing that the AI recommended it. The human handler who approves the outcome bears responsibility, and the senior manager accountable under SM&CR bears ultimate responsibility.
The Financial Ombudsman Service has not issued specific guidance on AI-assisted complaint handling, but its approach to assessing complaint outcomes is outcome-focused. The FOS looks at whether the firm's investigation was adequate, whether the outcome was fair and reasonable in the circumstances, and whether the response met the DISP content requirements. If an AI-assisted process produces a thorough investigation, a fair outcome, and a clear response, the FOS is unlikely to object to the method. If the AI-assisted process produces a superficial investigation, a formulaic outcome, or a generic response, the FOS will criticise the process regardless of whether AI was involved.
For firms operating in the EU, the EU AI Act requires that high-risk AI systems include human oversight mechanisms that allow humans to understand the AI's capabilities and limitations, interpret the AI's output, and override or disregard the AI's output when necessary. Even for AI systems that are not classified as high-risk, these principles represent good practice for complaint handling.
The practical implication is clear: AI should be used to enhance complaint handling, not to replace the judgment of trained complaint handlers. The AI can accelerate analysis, surface relevant information, identify regulatory issues, and draft response content. But the human handler must review the AI's output, apply their own judgment, and take ownership of the final decision.
- Maintain human oversight and final decision authority for all complaint outcomes where AI was involved.
- Do not allow AI to autonomously close complaints or issue final responses without human review.
- Document the AI's contribution and the human handler's review and decision for each complaint.
- Ensure SM&CR accountability is clear: a named senior manager is responsible for complaint outcomes including those assisted by AI.
- Brief FOS case handlers, when a complaint is referred, on how AI was used in the analysis to support the firm's position transparently.
- Monitor FOS decisions on cases where AI was used to identify any emerging expectations or concerns.
Building responsible AI complaint processes
Building a responsible AI complaint handling capability is not a one-time implementation project. It requires ongoing governance, monitoring, testing, and improvement. The following practices represent the operational minimum for firms that are using or planning to use AI in complaint handling.
Governance starts with clear ownership. A named individual, ideally at senior management level, should be accountable for the firm's use of AI in complaint handling. This person should understand the AI systems in use, the risks they create, and the controls that mitigate those risks. Under the FCA's SM&CR framework, this accountability should be documented in the relevant senior manager's statement of responsibilities.
Model monitoring is essential. AI systems do not remain static after deployment. Their performance can drift over time as complaint patterns change, new products are launched, and customer behaviour evolves. Firms should implement ongoing monitoring of AI classification accuracy, recommendation quality, and fairness metrics. Performance thresholds should be defined, and breach of those thresholds should trigger a review and potential retraining of the model.
Testing should include both technical performance testing (accuracy, precision, recall) and fairness testing (performance across different customer groups, language styles, and complaint types). Testing should be conducted at deployment and on a recurring basis, at least quarterly for systems that are used at scale.
Change management is critical. Any change to the AI system, whether a model update, a training data refresh, or a configuration change, should go through a structured change management process that includes impact assessment, testing, approval, and post-deployment monitoring. Uncontrolled changes to AI systems can introduce unexpected behaviour that affects complaint handling quality.
Consumer feedback should be incorporated into the AI improvement cycle. If complainants report that they feel their complaint was not properly understood, or that the response did not address their actual concern, this may indicate that the AI analysis missed something. These signals should be captured and fed back into model improvement.
- Assign senior management accountability for AI use in complaint handling under SM&CR.
- Implement ongoing monitoring of AI accuracy, recommendation quality, and fairness metrics.
- Conduct recurring fairness testing segmented by customer demographics and complaint types.
- Apply structured change management to all AI model updates and configuration changes.
- Feed consumer feedback into the AI improvement cycle to address gaps identified through complaint experience.
- Document the AI governance framework, including policies, monitoring reports, and testing results, for regulatory examination.
Checklist: responsible AI in complaint handling
Use this table as a quick reference for the key considerations when implementing or operating AI in complaint handling.