DP5/22 is the joint Bank of England, PRA and FCA discussion paper published on 11 October 2022 that asked whether the UK's existing financial regulation is sufficient for AI and machine learning. It set out how current rules — the Senior Managers regime, model risk management, operational resilience, outsourcing, data protection and conduct rules — already apply to AI, and asked whether a regulatory definition of AI or new AI-specific requirements were needed. Responses closed on 10 February 2023 and were summarised in FS2/23.
| Document | DP5/22 — Discussion Paper 5/22: Artificial Intelligence and Machine Learning |
| Issued by | Bank of England, Prudential Regulation Authority, and Financial Conduct Authority |
| Type | Consultation |
| Status | Final |
| Published | Oct 11, 2022 |
| Comment deadline | Feb 10, 2023 |
| Applies to | All PRA- and FCA-regulated firms, including banks, building societies, investment firms and insurers (a discussion paper, not a rule) |
| Official source | bankofengland.co.uk ↗ |
| Use cases | AI governance (general) · Model risk management · Fair lending & discrimination · Third-party & vendor AI · Data & privacy |
What are the key points of DP5/22?
- Joint BoE/PRA/FCA paper following the AI Public-Private Forum's February 2022 final report.
- Maps AI use to existing frameworks: SM&CR accountability, model risk management, operational resilience, third-party/outsourcing rules, Consumer Duty and conduct rules, and UK GDPR.
- Asks whether a regulatory definition of AI would help; respondents later said no.
- Raises data risks (bias, fairness, protected characteristics), model risks (explainability, robustness) and governance risks as the three main risk clusters.
- Explicitly technology-agnostic: considers whether AI-specific regulation is needed rather than proposing it.
- Comment period closed 10 February 2023; 54 responses received.
What did DP5/22 change for banks?
DP5/22 is the origin of the UK's current posture. It framed AI as a question of whether existing rules suffice, and the answer that came back through FS2/23 — that they largely do — has anchored the BoE, PRA and FCA's technology-agnostic approach ever since. For banks it remains the clearest official map of which UK rulebooks an AI system falls under.
Did DP5/22 propose new AI rules for UK banks?
No. It was a discussion paper asking whether existing regulation was sufficient and how it might evolve; it made no policy proposals.
Which UK rules did DP5/22 say already apply to AI?
The Senior Managers and Certification Regime, model risk management expectations, operational resilience and outsourcing rules, conduct rules including the Consumer Duty, and UK data protection law.
| Date | Document | Status |
|---|---|---|
| Jul 14, 2026 | HM Treasury Financial Services AI Adoption Plan (Jul 2026) — Financial Services AI Adoption Plan | Final |
| Jun 5, 2026 | 2026 BoE/FCA AI survey — The Bank of England and FCA's 2026 AI Survey | Final |
| May 15, 2026 | BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience | In force |
| Apr 1, 2026 | BoE response to Treasury Committee AI inquiry (Apr 2026) — Response to TSC inquiry report on AI in financial services | Final |
| Apr 1, 2026 | BoE/PRA plan for safe AI innovation (Apr 2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation | Final |
| Jan 28, 2026 | DSIT/DBT strategic letters to regulators (Jan 2026) — How will regulators enable safe AI-powered innovation: joint letter from DSIT Secretary of State and DBT Secretary of State | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →