Banks, insurers and asset managers are adopting AI faster than many other parts of the economy, but regulators are not treating that shift as a routine technology upgrade. The concern is not only whether AI can improve productivity, but whether it could introduce new forms of consumer harm, operational fragility and systemic risk into a sector where trust, resilience and accountability are essential. That is why supervisors are paying close attention as financial institutions move from narrow machine learning models toward generative and agentic AI.
AI in finance is scaling faster than supervision can comfortably absorb
One reason regulators are uneasy is the speed of adoption. A UK parliamentary report published in January 2026 said financial services now substantially outpace other sectors in AI adoption, with around 75 percent of UK financial services firms already using AI. At the same time, the OECD noted in early 2026 that generative AI and agentic AI are beginning to reshape finance, creating new supervisory challenges around how existing rules are interpreted and enforced in practice.
For regulators, rapid deployment creates a timing problem. Financial rules were largely built for human-led processes and more traditional models, whereas advanced AI systems can evolve dynamically, produce complex outputs and act with greater autonomy than earlier technologies. The Bank of England has warned that these features make predictability, explainability and transparency harder to manage, especially as AI becomes more embedded in the financial system.
The biggest fear is not efficiency, but loss of control
Supervisors are not worried simply because firms are automating tasks. They are worried because AI can make important decisions harder to trace and challenge. The OECD identifies model risk management, validation, explainability, transparency, fairness, governance and data management as core supervisory concerns in finance. The UK parliamentary inquiry similarly found that AI could create significant risks to consumers and financial stability if regulators and firms fail to keep pace.
This matters more in financial services than in many other sectors. An error in a retail chatbot may be inconvenient. An error in a lending, fraud, onboarding or trading context can create customer harm, compliance failures or broader market disruption. Regulators therefore want firms to show not only that AI works, but that they can explain how it works, monitor it continuously and intervene when it fails.
Data quality, bias and explainability remain major weak points
AI systems are only as strong as the data and controls around them, and this is another source of regulatory concern. In a BIS paper published in 2026, supervisors highlighted data quality, privacy and security as the most pressing AI data-related risks as generative AI becomes more integrated into financial services. The same paper cited IIF-EY research showing that 79 percent of financial institutions see data quality as a major barrier to putting AI into production.
Poor or fragmented data can lead to inaccurate outputs, biased decisions and weak oversight. The Bank of England has also flagged the integrity of data as a key challenge because advanced AI models rely on very large datasets and can behave in ways that are difficult to interpret. For regulators, this creates a serious question: if a bank cannot fully explain the data and logic behind an AI-assisted decision, can that decision really be trusted in a regulated environment?
Concentration risk is becoming part of the AI debate
Regulators are also looking beyond individual firms to the structure of the market itself. The Bank of England has pointed to concentration in AI-related services, including vendor-provided models, as a potential challenge. That concern is growing because many financial institutions are expected to rely on a relatively small group of cloud providers and frontier model developers for critical AI capabilities.
This introduces a familiar but increasingly important question in financial supervision: what happens when many institutions depend on the same technology stack? If a small number of external providers become essential to customer service, risk modelling, fraud systems or operational workflows, AI could amplify third-party dependency risk rather than reduce it. That is one reason policymakers are treating AI as a resilience issue, not just an innovation story.
The regulatory framework is still evolving, but expectations are rising fast
Another reason for regulatory nervousness is that the rulebook is still being built while adoption continues. In the UK, authorities currently rely on the existing financial regulatory framework rather than AI-specific financial legislation. In the EU, the AI Act is being phased in, with prohibited practices already applicable from February 2025, GPAI obligations in force from August 2025, and key rules for high-risk AI systems applying from August 2026 and, for some regulated-product cases, August 2027. The Act requires measures such as risk management, high-quality datasets, logging, human oversight, robustness and accuracy for high-risk systems.
That means banks are entering a period where regulatory expectations are becoming clearer, even if supervision is not fully standardised across jurisdictions. The OECD says most member countries believe they already have appropriate regulations in place, but practical challenges remain in implementation, interpretation and supervisory capacity. In other words, regulators are nervous partly because they know the rules exist, but enforcing them against fast-moving AI models is much harder than writing them down.
Why this matters now
The nervousness around AI in finance is ultimately about trust. Financial services depend on reliable decisions, resilient infrastructure and clear accountability. AI can improve all three, but it can also weaken them if institutions deploy it faster than they can govern it.
That is why regulators are asking tougher questions about explainability, model validation, data governance, third-party concentration and human oversight. The institutions that succeed with AI will probably not be the ones that move fastest, but the ones that can prove they remain in control as the technology scales. This last point is an inference from the supervisory themes repeated across BIS, OECD, UK and EU sources.
What this means for the industry
- AI adoption in finance is moving quickly, but supervision is still catching up.
- Regulators are focused less on headline innovation and more on explainability, governance, data quality and resilience.
- Dependence on a small number of AI and cloud providers could become a bigger supervisory issue over time.
- The EU AI Act and similar frameworks are pushing financial institutions toward stronger documentation, human oversight and risk controls.
- Banks that treat AI as a governance challenge, not just a productivity tool, are likely to be better positioned for the next phase of regulation.
