The article stresses that many firms still rely on policies, templates, or outsourced tools, but the FCA is increasingly focused on who is accountable and what evidence exists in production environments, not theoretical compliance. It argues that this marks a major regulatory shift from “principles-based governance” to “evidence-based supervision,” where firms must be able to show, not just say, how AI risks are managed in real time…