AI survey 2026: 86% of firms use AI, but monitoring after deployment lags
The Bank of England and FCA's fourth survey of AI in UK financial services finds adoption, agents and third-party AI all up. Controls before deployment are near-universal; ongoing monitoring is reported by around half of respondents.
What the survey found
The survey, published on 26 October 2026, had 196 respondents: 101 larger firms and 95 smaller firms 54. Among them:
- 86% reported using AI, up from 75% in 2024. Generative AI made up 56% of all reported AI systems.
- 80% reported having AI agents deployed, and a further 14% planned to deploy them within 12 months. Most agents support decisions rather than make them: only 2% reported agents with broad autonomy.
- Third-party implementations were 39% of all reported AI systems and 53% of high-materiality ones, up from 35% in 2024.
- 94% reported firmwide AI policies, principles or standards, and 84% reported centralised AI or model-risk governance fora.
- Human approval, pre-deployment review and vendor due diligence were each reported by more than 90%. Ongoing monitoring, leakage testing and periodic review or recertification were each reported by around half.
- For third-party high-materiality systems, 81% relied on vendor assurance and contractual arrangements; 24% reported deep knowledge of those systems, against 77% for systems built internally.
- 73% of small firms reported using AI.
What to do
- Keep an inventory of every AI system and agent you use, including the AI inside third-party software, with a materiality rating for each.
- Add controls after deployment: outcomes monitoring that can show whether any group of customers does worse because of a model (PRIN 2A.9.10R), leakage testing, and a date for each system's next review.
- For each third-party system, decide what you would need to know to explain an outcome to the FCA, and put it in the contract rather than relying on assurance alone.
- Name the senior manager responsible for each material system and record the steps they take (COCON 2.2.1R).
Our view
The gap the survey shows is not policy, which almost every respondent has, but evidence after go-live. A firm that can show its pre-deployment review but not how the system has behaved since is describing intent, not control. Monitoring is where the Consumer Duty and SM&CR questions will land.
How this was produced: drafted from the source and our Handbook mirror, and reviewed by Automated Compliance before publication.