Risk · R-119 · Conduct & Customer Outcomes

Unsuitable AI-generated advice or guidance

A system gives personalised recommendations in a regulated domain without the suitability process, permissions or accuracy that advice requires.

Severity
High
Audience
Heads-of · Practitioner
Frameworks
Article 13 · PRIN 2A.3 · PRIN 2A.5
Reviewed
2026-11-11

What it is

In finance, law, medicine and other regulated fields there is a line between giving information and giving advice to a particular person. Advice carries duties: understanding the person's circumstances, recommending only what is suitable, holding the right authorisation, and answering for the result. A conversational model crosses that line easily. Asked which product is best for someone who has just described their situation, it will answer. The organisation may have intended an information tool and find it is giving personal recommendations.

How it happens

  • The assistant is allowed to answer open questions about what a customer should do.
  • Customers volunteer personal details and the model tailors its reply.
  • Instructions not to advise are overridden by a persistent or rephrased question.
  • The boundary was never defined for the system's designers.

Why it matters

Unsuitable advice causes direct financial or personal harm. Giving regulated advice without permission, or without a suitability assessment, is a breach whoever or whatever gave it, and the customer may be entitled to redress.

Warning signs

  • Transcripts contain phrases such as "you should" or "the best option for you".
  • No test checks the system's behaviour at the advice boundary.
  • The intended-use statement does not say whether advice is in scope.
  • Customers cite the assistant as the reason for a decision.

Who owns it

The business owner of the channel is accountable for keeping it within its permissions. Compliance defines the boundary. Engineering enforces it and tests it.

In practice

A pensions assistant built to explain options is asked by a customer whether to take a lump sum now. Given the customer's age and the debts they mention, it recommends doing so. The same pattern generalises to any general assistant placed in front of customers who want to be told what to do.

Mitigating controls

Primary controls

Intended-use definition and use restrictions Directive
Defines whether the system may give advice at all, and within what limits. The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins.
Output validation and guardrails Preventive
Detects and declines requests that cross into advice. Every model output is validated against a schema and sanitised by deterministic code before any downstream system, tool or user interface acts on it.

Supporting controls

Human-in-the-loop review Preventive
A qualified person approves personalised recommendations. Consequential AI outputs and decisions are reviewed by a competent person, with the time, information and authority to change them, before they take effect.
Review of AI-generated communications Preventive
Reviews generated guidance for accuracy and balance. Customer communications produced by AI are checked against content standards before use, in full or by sampling according to risk, and required wording is enforced.

Framework and clause references

FrameworkClauseTitle
EU AI ActArticle 13Transparency and provision of information to deployers Intended purpose.
FCA Consumer Duty (PRIN 2A)PRIN 2A.3Products and services outcome Products and distribution fit for the target market.
FCA Consumer Duty (PRIN 2A)PRIN 2A.5Consumer understanding outcome Informed decisions.

Sources

EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text

How to cite

Axiom Verity (2026). Unsuitable AI-generated advice or guidance. Reference Library, R-119. https://axiom-verity.com/risks/unsuitable-ai-generated-advice. Reviewed 2026-11-11.