Summary

• Across 196 participating financial organisations, 86% reported using AI; most detailed agent findings come from a separate group of 105 full-survey respondents.
• Among those answering detailed questions, 80% reported agents in production for decision support, while just 2% reported broadly autonomous agents.
• The three largest cloud and compute providers accounted for 79% of reported relationships, with many critical dependencies difficult to replace.

Artificial intelligence is now used by 86% of financial organisations responding to a new Bank of England and Financial Conduct Authority survey, although most firms retain human control over consequential decisions and increasingly depend on a concentrated group of external technology providers.

The regulators’ fourth survey of AI in UK financial services, published on 26 October, received responses from 196 organisations. The headline adoption figure compares with 75% in 2024 and 58% in 2022, but changes in the participating firms and survey questions mean those percentages should not be interpreted as a precise measure of sector-wide growth.

The findings reveal a substantial difference between the use of AI agents and the authority those systems are permitted to exercise. Among respondents to the detailed questionnaire, 80% reported agents deployed for decision support, while only 2% reported agents capable of acting with broad autonomy.

Those figures also require separate denominators. The 86% adoption rate combines answers from the full and shortened questionnaires, whereas most detailed findings about agents, suppliers and governance come from the 105 organisations completing the full survey. Individual percentages generally reflect valid responses to each question, excluding firms that did not answer.

Agents support decisions more often than execute them

The regulators distinguish between agents recommending actions for human approval, those permitted to operate within predetermined limits, and more autonomous systems capable of initiating activities with limited real-time supervision.

Among respondents to the full questionnaire, 80% reported decision-support agents in production. A further 46% reported agents with constrained execution capabilities, while 22% had deployed systems operating with conditional autonomy.

These categories overlap because a firm may operate several types of agent. They are not separate shares of the financial sector that can be added together.

Only 2% reported agents with broad autonomy, reflecting the limited use of software capable of initiating and executing actions without continuous human involvement.

The distinction becomes especially significant where an automated decision could affect a customer’s finances or an institution’s operational controls.

Even when planned deployments over the following year were included, no more than 9% of respondents expected agents to undertake functions such as approving or declining customer outcomes, executing trades, initiating payments or changing operational limits.

By comparison, 16% already reported agents used for automated customer communications, rising to 34% when planned deployments were included.

Financial organisations appear more willing to delegate preparatory and administrative work than grant software direct authority over consequential activities.

However, decision support also creates risks where employees rely on recommendations they cannot adequately explain or challenge. Effective human oversight depends on access to relevant evidence and sufficient understanding of the system’s limitations, rather than the mere presence of an approval step.

External technology becomes more consequential

Third-party implementations accounted for 39% of the AI systems reported in the full survey, compared with 33% in 2024.

The proportion was higher among systems firms classified as highly material. External implementations accounted for 53% of that group, up from 35% in the previous survey.

The changing figures suggest that externally supplied technology is becoming more deeply involved in important financial operations, rather than remaining limited to general productivity applications.

Cloud and computing infrastructure showed particularly pronounced concentration. The three largest providers accounted for 79% of reported relationships, compared with 54% for the three largest model API and hosting providers.

Those percentages measure reported provider relationships, not market shares based on revenue, installed computing capacity or the number of financial institutions in the UK.

The regulators also examined how difficult firms would find it to replace critical suppliers. Among 169 reported cloud and compute relationships, 37% were classified as both highly critical and difficult to substitute.

Only 35% of that particularly demanding group had tested exit plans, raising questions about how institutions would maintain services if a provider experienced a serious interruption.

Moving an application between suppliers can require changes to infrastructure, data arrangements, security controls and software integrations. Where AI systems depend on proprietary models or specialised computing services, a contractual right to terminate an agreement may provide little practical protection without a tested alternative.

The concentration findings also concern financial stability because an incident affecting a major technology provider could create disruption across institutions with otherwise unrelated business activities.

Governance procedures leave monitoring gaps

Most respondents reported formal AI governance arrangements, with 94% maintaining firmwide policies, principles or standards and 84% operating centralised governance forums.

Pre-deployment controls were also widespread. More than 90% reported practices including human approval, reviews before implementation and vendor due diligence.

Controls applied after deployment were less consistently reported, with ongoing monitoring, leakage testing and periodic reviews or recertification each used by approximately half of respondents.

This creates a potential weakness where models or the systems connected to them change after their initial assessment.

An AI application may continue operating while its underlying provider updates a model, while the data it processes or the decisions it influences also evolve. Initial testing cannot establish that every subsequent version will behave in the same way.

The distinction between internally developed and externally supplied systems becomes relevant here. Among respondents assessing highly material AI, 77% relied on deep knowledge of internally developed systems, compared with only 24% for third-party systems.

For external technology, 81% instead relied on supplier assurance and contractual arrangements.

Vendor information can help institutions understand how a product is governed, but it does not necessarily provide enough evidence to investigate unexpected behaviour or evaluate how an application will perform under disruption.

The most frequently identified governance challenge was applying model risk management principles to externally supplied AI, cited by 54% of respondents.

These findings indicate that organisations have made considerable progress in establishing formal responsibilities while continuing to face practical difficulties in monitoring and understanding systems they do not control.

Reported benefits remain moderate

The greatest current benefits identified by respondents concerned operational efficiency, automation and productivity, rather than the creation of entirely new financial products.

Operations and IT accounted for approximately 31% of all reported AI systems, making them the largest individual area of use. No other business area represented more than 11%.

Even so, respondents generally rated current benefits as moderate or below, while expecting gains to increase across multiple areas during the next three years.

The survey also demonstrates how uneven adoption remains between organisations. Almost half reported ten or fewer AI systems, while the ten largest users accounted for 43% of all systems reported.

Large financial institutions may operate complex portfolios of applications, while smaller firms can rely principally on general-purpose language models.

Among respondents completing the short questionnaire, 73% reported AI use, with 58% of those users predominantly employing large language models.

These differences limit the usefulness of treating financial services as a single market with consistent technical capabilities, operating arrangements or benefits.

Cyber risk and oversight remain linked

The survey identifies growing concern about cybersecurity, data protection and dependence on external suppliers.

Some 88% of respondents assessed the development of frontier AI cyber capabilities as likely to have a moderate or high effect on their own risk profile over the next two years.

Awareness of those capabilities had increased management attention to vulnerability management and patching among 64% of respondents.

However, the report is an assessment of what participating firms have disclosed, not independent verification that their cybersecurity controls operate effectively.

Nor does it establish that AI deployment has caused a particular financial or operational outcome. The regulators present the survey as descriptive evidence, with no new AI-specific requirements introduced through its publication.

The findings follow separate FCA observations concerning weaknesses in how organisations govern AI applications, as Techopia reported on 22 October.

The new data adds evidence about adoption, autonomy and supplier concentration, showing why formal governance policies must be supported by ongoing monitoring and realistic arrangements for dealing with external service failure.

As AI becomes more deeply integrated into financial operations, the test will be whether firms can retain effective oversight of systems and dependencies whose technical behaviour they may not fully control.