The governance of artificial intelligence (AI) within the financial services sector has emerged as one of the most consequential regulatory challenges of recent years. As AI adoption accelerates across banking, insurance, asset management, and capital markets, regulators across the United Kingdom and the European Union are grappling with how best to balance the transformative potential of the technology against the risks it poses to consumers, market integrity, and the stability of the financial system as a whole. This article examines the macro-level regulatory landscape and identifies the broader lessons for compliance professionals, boards, and policymakers.
The Scale of Adoption
The scale of AI adoption in financial services is now substantial and growing rapidly. A periodic survey conducted by the Bank of England revealed that 75% of firms surveyed are using some form of AI in their operations, including all of the large UK and international banks, insurers, and asset managers. Some 41% of respondents are using AI to optimise internal processes, while 26% are using AI to enhance customer support. Notably, 16% of firms are using AI for credit risk assessment (with a further 19% planning to do so), 11% are using it for algorithmic trading, and many firms are deploying AI to mitigate external risks from cyberattack (37%), fraud (33%), and money laundering (20%).
The Treasury Committee's inquiry into AI in financial services, which received 84 written submissions and correspondence from six major AI and cloud providers, further highlighted the widespread deployment of AI across various sectors within financial services, including retail banking and investment banking. The use cases have multiplied over the last year, spanning transcription, summarisation, triage, information extraction, coding of internal processes, and workflow management across sectors and departments. Customer-facing applications are also increasing, with AI chatbots handling queries and providing information, and more personalised services using customer data on the horizon.
The UK Regulatory Framework: Technology-Agnostic but Attentive
At the macro level, the UK's approach to governing AI in financial services has been characterised by a deliberate choice to work within existing regulatory frameworks rather than creating a separate, AI-specific regime. The Financial Conduct Authority (FCA) has concluded that its existing rules and guidance provide a sufficient framework for managing risk and is therefore not planning to introduce new regulations specific to AI at present. The FCA believes this is the best way to support UK growth and competitiveness.
The Bank of England (BoE) and the Prudential Regulation Authority (PRA) have similarly adopted a "technology-agnostic" approach to supervision and regulation of AI and machine learning, meaning that their core principles, rules, and regulations do not usually mandate or prohibit specific technologies. However, both regulators acknowledge that risks may arise from the use of specific technologies such as AI that could have an adverse impact on their statutory objectives, and they actively work to understand and address these risks, issuing guidance or other policy tools where needed to clarify how existing rules and regulatory expectations apply.
The PRA and BoE have identified four key areas where further clarification on the regulatory framework could be beneficial and which are relevant to AI and machine learning: data management, model risk management, governance, and operational resilience and third-party risks. In 2023, the BoE issued new Model Risk Management Principles for banks, which are technology-agnostic and outcomes-focused but deliberately included factors relevant to the use of AI models. The PRA has also highlighted AI adoption in its 2026 supervisory priorities, meaning AI will be a key topic of exploration and scrutiny in its supervisory dialogues with firms.
The FCA's own 2024 AI Update set out how the regulatory framework applies to financial services firms' use of AI, specifically referencing the Consumer Duty and the Senior Managers and Certification Regime. The Government's five principles to guide the regulation of AI — safety, transparency, fairness, accountability, and contestability — have been broadly welcomed by the BoE and the PRA as consistent with their existing approach.
Financial Stability: The Macroprudential Dimension
One of the most important macro-level considerations is the potential for AI to create or amplify systemic risks to financial stability. In a keynote speech at the HKMA-BIS Joint Conference, the BoE's Deputy Governor for Financial Stability, Sarah Breeden, explored the novel features of generative AI and how regulators can uphold financial stability whilst harnessing its benefits for economic growth. She identified two issues for regulators to keep a "watchful eye" on: at the microprudential level, whether technology-agnostic regulatory frameworks are sufficient to mitigate financial stability risks as AI models become more powerful and adoption increases; and at the macroprudential level, the possible need for intervention to support the stability of the financial system as a whole, with regulatory perimeters kept under review should the financial system become more dependent on shared AI technology and infrastructure systems.
The Treasury Committee's report highlighted that stakeholders raised concerns about the heightened risks of cybersecurity vulnerabilities, the UK's over-reliance on overseas AI and cloud services (which could threaten operational resilience), and the potential for AI-driven trading to amplify herd behaviour that could risk financial stability or, in a worst-case scenario, cause a financial crisis. The BoE is pursuing work on simulation methods with international counterparts to better understand the conditions under which AI agents trading in financial markets could demonstrate correlated behaviour or "herding" and so potentially exacerbate procyclical dynamics to amplify a stress scenario.
Jonathan Hall, an external member of the Financial Policy Committee, stated in a speech that AI in general, and deep learning in particular, has the potential to be incredibly powerful, and that regulators should try to reduce the downside risk whilst allowing the positive possibilities. Only a third of respondents to an earlier BoE Discussion Paper described themselves as having a complete understanding of the AI technologies they had implemented, a striking finding given the increasing use of AI in higher-impact areas such as credit risk assessment, capital management, and algorithmic trading.
Enforcement Risk and Governance Expectations
Given the technology-agnostic UK regime, the potential for intervention or enforcement is likely to arise from failures to meet existing regulatory obligations rather than from AI-specific rules. The key areas where enforcement risk may materialise include governance and oversight failures, consumer protection concerns, financial crime and market integrity, and operational resilience.
The FCA expects firms to have robust governance arrangements encompassing effective oversight at board and senior management level and the implementation of effective systems and controls, including in relation to the deployment and use of AI tools. If AI systems result in unfair outcomes for consumers, firms may face enforcement action, particularly under the Consumer Duty. The FCA has highlighted that the use of algorithms, including machine learning or AI, that embed or amplify bias could lead to worse outcomes for some groups of customers. The FCA has been carrying out its own research in the area of AI bias to deepen its understanding of AI and its potential impact on financial services.
From the perspective of operational resilience, there has been increasing focus by financial services regulators, and a willingness to take enforcement action where firms fail to manage operational risks, particularly when such failures result in customer harm or market disruption. The Treasury Committee recommended that HM Treasury designate the major AI and cloud providers as Critical Third Parties by the end of 2026, and HMT confirmed it is in the process of gathering evidence to support designation decisions.
Innovation Infrastructure: Sandboxes and Sprints
UK regulators have also sought to support innovation through practical infrastructure. The FCA has been showcasing real-world solutions in its AI Spotlight, facilitating testing of models during the product development phase in its AI Lab, and supporting the development of proofs of concept by supercharging its Digital Sandbox with more data, computing power, and tooling. The FCA's 2026/27 work programme confirmed the expansion of the supercharged sandbox to a new cohort of firms, giving them access to high-quality synthetic data so innovative, AI-driven financial products can be safely tested. The BoE launched an AI Consortium to further understanding of AI's potential benefits and the different approaches firms are taking to manage risks that could threaten financial stability.
The FCA has also launched the Mills Review, led by Sheldon Mills, to examine how rapid advances in AI are reshaping retail financial services, with a focus on how AI could evolve (including the development of more autonomous and agentic systems), how these developments could affect markets and firms, the impact on consumers, and how regulators may need to evolve. The FCA's own 2026/27 work programme also confirmed the integration of AI into regulatory workflows, the use of generative AI to review documents received from firms, and the deployment of a new sandbox environment to test automated data feeds between the FCA and firms.
ESG and AI Governance: An Emerging Intersection
A further dimension of macro-level governance is the intersection between AI and ESG compliance. The increasing use of AI for ESG data management and analysis introduces new governance risks that compliance teams must address, including ensuring the accuracy and auditability of AI-calculated metrics, monitoring for algorithmic bias in social-pillar assessments, and demonstrating that the organisation's AI infrastructure aligns with its own ESG commitments. Organisations are encouraged to build and maintain a comprehensive inventory of all AI systems in use, integrate AI governance into the broader enterprise risk management framework, and assess and disclose the environmental footprint of their own AI infrastructure.
Broader Lessons
Several broader lessons emerge from this rapidly evolving landscape. First, the technology-agnostic approach adopted by UK regulators places the burden squarely on firms to demonstrate that their use of AI is consistent with existing regulatory expectations for governance, risk management, consumer protection, and operational resilience. This demands a sophisticated understanding of both the technology and the regulatory framework.
Second, the EU's more prescriptive approach under the AI Act offers greater certainty but also greater compliance costs, particularly for firms whose AI systems fall into the high-risk category. The potential for regulatory divergence between the UK and the EU presents challenges for firms operating across both jurisdictions.
Third, the macroprudential dimension — particularly the risks of concentration in AI and cloud providers, herding behaviour driven by AI-enabled trading, and systemic cyber vulnerabilities — requires a system-wide response that goes beyond the supervision of individual firms.
Fourth, effective AI governance requires cross-functional collaboration within firms, bringing together compliance, legal, IT, risk, and product teams from the outset, rather than treating AI governance as a standalone or siloed exercise.
Finally, as the use cases for AI in financial services continue to develop — from agentic AI systems to personalised consumer advice — regulators and firms alike will need to remain adaptive, with governance frameworks that evolve alongside the technology. The regulators' own adoption of AI for supervisory tasks underscores that this is a transformation that touches every part of the financial ecosystem.
AI and Legal Professional Privilege
A further governance consideration that is increasingly relevant to financial services firms is the interaction between AI and legal professional privilege. The rapid adoption of AI, particularly generative AI, is transforming how professional services and financial services firms operate, but it also raises novel questions about the protection of privileged communications.
These issues are of particular significance for regulated firms, given that confidential communications between external or internal legal counsel and members of audit or compliance teams for the purposes of seeking or giving legal advice may be legally privileged and protected from disclosure. However, the protection afforded to privileged communications may be lost in certain circumstances, such as where they are circulated too widely, which means that firms must think carefully about who is included in communications and be particularly alive to the risks of forwarding emails or inputting privileged material into AI tools. As firms increasingly deploy AI across their operations, including in compliance, investigations, and legal advisory functions, the risk that privileged information may inadvertently be disclosed to third-party AI providers, or processed in ways that compromise the confidentiality necessary to sustain privilege, is one that boards and heads of legal must actively manage.
Practical Steps for Boards and Heads of Legal
In light of the regulatory developments outlined above, boards and heads of legal at financial institutions should consider taking a number of practical steps to ensure effective governance of AI within their organisations.
First, boards should ensure that AI governance is integrated into the firm's existing governance framework, rather than treated as a separate or siloed workstream. This means establishing clear lines of accountability under the Senior Managers and Certification Regime, so that responsibility for AI-related risks is allocated to identified senior individuals who can be held to account.
Second, firms should develop and maintain a comprehensive inventory of all AI systems deployed across the organisation, covering front-office, middle-office, back-office, and customer-facing applications. Without a clear picture of where AI is being used, it is impossible to assess and manage the associated risks effectively.
Third, heads of legal should work closely with compliance, IT, and risk functions to map AI use cases against the applicable regulatory requirements, including the Consumer Duty, model risk management expectations, operational resilience obligations, and — for firms with EU operations — the high-risk classification requirements under the EU AI Act.
Fourth, boards should satisfy themselves that robust validation and human oversight processes are in place for AI outputs, particularly in areas with a direct impact on consumers or financial stability, such as credit risk assessment, algorithmic trading, and insurance pricing. Firms should be able to explain to regulators how their AI models work, what data they are trained on, and what controls are in place to prevent bias and error.
Fifth, firms should review their third-party and outsourcing arrangements in light of the growing regulatory focus on concentration risk in AI and cloud providers. Contracts with AI vendors should include robust provisions on liability, audit rights, impact assessments, and early notification obligations.
Sixth, boards should ensure that staff at all levels receive appropriate training on the responsible use of AI, including AI ethics, data governance, and the firm's internal policies and procedures. Governance policies should be actively embedded across the organisation, not merely published and filed.
Finally, firms should engage proactively with the regulatory initiatives that are shaping the future landscape, including the FCA's Mills Review, the BoE's AI Consortium, and, where relevant, the evolving supervisory expectations under the EU AI Act. Staying close to the direction of travel will enable firms to anticipate changes and adapt their governance frameworks before new expectations crystallise into formal requirements.
Copyright & permissions
