Artificial intelligence

Artificial intelligence adoption in financial services is accelerating at a rapid pace. Surveys by regulatory authorities in 2026 report AI use at the large majority of institutions, with adoption of up to 90% or more in several jurisdictions and the highest uptake among banks, insurers and larger firms. Generative AI accounts for most of the latest increase, and agentic systems that plan and execute multi-step workflows with limited human involvement are entering early deployment. Use remains concentrated in lower-risk applications, however. Most reported use cases are internal — drafting, summarisation, translation, coding support, internal search and adviser or call-centre support — while customer-facing, investment and core decisioning applications remain limited, more tightly controlled and subject to human validation. A large share of generative AI use cases are still at proof-of-concept stage, and agentic deployments are confined to bounded tasks with approval checkpoints for consequential actions. The constraints on scaling are consistent across surveys: business value that is difficult to evidence, data quality and legacy integration, dependence on a small number of external model and cloud providers, uncertainty over cross-border data use, and shortages of staff combining AI, risk and regulatory expertise.

Authorities’ attention has concentrated on the potential of AI to increase the speed, scale, interconnectedness and opacity of risk transmission across the financial system. Four supervisory points dominate at present. The first is cyber risk. Frontier models can now discover and exploit software vulnerabilities autonomously, shortening the time between a weakness becoming known and its exploitation and lowering the cost and skill required for sophisticated attacks. Global bodies and national supervisors have raised their assessments of systemic cyber risk accordingly. The second is fraud. Generative AI makes scams more persuasive, personalised and scalable: deepfakes, synthetic identities and conversational bots can impersonate trusted people and institutions and sustain convincing interactions at volume. Exposure is growing on the consumer side as well, as more people take financial information from general-purpose AI tools that carry none of the protections of regulated advice. The third is concentration. A small number of model, cloud and software providers support critical functions across many institutions, creating shared points of failure and leaving firms with limited visibility into subcontractors, training data and hosting locations. Where the leading providers sit outside the home jurisdiction, authorities increasingly treat this as a strategic dependency. The fourth is financial stability. Common models could synchronise trading and redemption behaviour under stress, and the AI investment boom now features as a correction scenario in stress tests alongside credit and market shocks: capital expenditure is projected to exceed USD 4 trillion by 2029, funding is shifting towards bonds, private credit and securitisation, and circular investment and supply relationships among AI firms obscure underlying demand and provide channels for shocks to spread.

The policy and supervisory response is starting to converge. On regulatory architecture, most authorities apply existing governance, model risk, outsourcing, operational resilience and conduct frameworks to AI and clarify how they apply, rather than creating AI-specific regimes. The EU, where horizontal AI legislation applies alongside financial regulation, and several Asian jurisdictions with dedicated financial-sector AI guidelines are the main exceptions. On supervisory expectations, a common core has emerged across jurisdictions: visibility of AI use, risk tiering by materiality and autonomy, lifecycle controls, human accountability and third-party assurance, with more demanding requirements where AI affects customers, markets or critical operations. On generative and agentic AI, new risks are being translated into concrete controls, from records of prompts and configurations and limits on autonomous execution to runtime safeguards and AI-specific cyber testing. Agentic systems are the focus of the next wave of guidance, with several authorities planning consultations in 2027. On supervisory practice, authorities are institutionalising oversight through controlled testing environments, practical implementation toolkits, capacity building and public-private dialogue.

Evidence on the economic impact remains partial. Productivity gains are measurable for specific tasks and among adopting firms, but intensive use is rare and aggregate effects are not yet visible in the data. Labour-market effects are selective rather than systemic. Total employment has so far been little affected, while hiring of young and entry-level workers has slowed in the occupations most exposed to generative AI. The clearest macroeconomic effect to date is on investment. AI-related capital expenditure has increased substantially, driven by data centres, semiconductors and related infrastructure, and is increasingly financed through debt and capital markets rather than internal cash flow. Research points to a risk of overinvestment if productivity gains fall short of expectations. AI production remains concentrated in a small number of firms and economies, with most countries dependent on cross-border access to computing power, models and other inputs.

Guidance has firmed up at global and national level in October. The Financial Stability Board (FSB) finalised its 12 sound practices for responsible AI adoption in mid-October, which set out proportionate, non-binding expectations for organisation-wide AI governance and for risk management across the AI lifecycle, and in its latest letter to G20 finance ministers and central bank governors Chair Andrew Bailey pointed to further work on AI-related risks, including the cyber risks posed by frontier models, in 2027. Across Asia, the Monetary Authority of Singapore issued its final Guidelines on AI Risk Management in early October, with effect from October 2027, and announced plans for a consultation focused on agentic AI systems in 2027. This was followed by the release of the Accountability, Resilience and Trust (ART) framework by the Hong Kong Monetary Authority, which combines updated supervisory guidance with a shared training-data platform and a planned governance framework for AI agents built around intent-anchored accountability, a registry of material AI agents and effective intervention mechanisms.

Supervisory follow-up on the cyber risks posed by frontier AI has shifted from an initial wave of warnings to more specific action points. Banks supervised by the European Central Bank (ECB) must submit their AI cyber-risk action plans by 31 October. Sweden’s Finansinspektionen has opened on-site reviews of how firms prevent, detect and manage AI-enabled attacks. Thailand’s Office of Insurance Commission ran two sector-wide cyber exercises with 67 insurers in late September, built around AI-related threats and failures at external providers.

The financing of the AI build-out has moved to the centre of financial stability assessments. The International Monetary Fund’s (IMF) Global Financial Stability Report, released against the backdrop of the Annual Meetings in Bangkok, names a correction in AI-related assets as one of three near-term triggers for market turmoil, and its global stress test finds that banks holding 22% of global banking assets would fall below a 7% CET1 ratio under a scenario combining an energy shock with an AI-led correction. An IMF technical note projects AI capital expenditure above USD 4 trillion by 2029, nearly three quarters of it by hyperscalers, and documents 14 circular financing deals in which about USD 300 billion of equity supported USD 1.4 trillion of future revenue commitments. A Bank for International Settlements bulletin finds that other AI firms account for 55% of investment into AI firms, almost half of it by value between firms that are also each other’s suppliers. Opening the annual conference of the European Systemic Risk Board, which she chairs, ECB President Christine Lagarde called for macroprudential monitoring of three AI threats: autonomous agents in trading, AI-enabled attacks spreading through shared technology, and geopolitical restrictions on access to frontier models.