The Bank of England and the Financial Conduct Authority have published their fourth survey of artificial intelligence (AI) in UK financial services, finding wider adoption and greater reliance on external providers alongside gaps in ongoing monitoring and oversight. Across 196 respondents, 86% reported using AI, compared with 75% in 2024, although differences in respondent populations and question scope limit comparability. Generative AI accounted for 56% of reported systems. Most detailed findings came from 105 firms completing the full questionnaire. Among respondents to that questionnaire, 80% reported deploying AI agents, but only 2% reported agents with broad autonomy. Third-party implementations accounted for 39% of reported AI systems, up from 33% in 2024. Their share of systems assessed by firms as highly material increased to 53% from 35%. Dependencies were concentrated: the three largest cloud and compute providers accounted for 79% of reported provider relationships. Of all reported cloud and compute relationships, 37% were considered both highly critical and hard to substitute, and only 35% of that group had tested exit plans. Understanding of external systems was also limited, with 24% of respondents reporting deep knowledge of highly material third-party systems, compared with 77% for internally developed systems. Formal governance arrangements were widespread, with 94% reporting firmwide AI policies, principles or standards, but controls after deployment were less common than initial checks. Human approval, reviews before deployment and vendor due diligence were each reported by more than 90% of respondents. Ongoing monitoring, leakage testing and periodic review or recertification were each reported by around half. Cyber risk amplification and critical third-party dependencies were the highest-rated systemic risks, with respondents expecting both to intensify over the next one to three years. Separately, 88% expected evolving frontier AI cyber capabilities to have a moderate or high impact on their firm’s risk profile over the next two years.
Bank of England and UK Financial Conduct Authority survey finds AI use at 86% and gaps in ongoing monitoring
The Bank of England and the Financial Conduct Authority’s fourth AI survey found that 86% of respondents use the technology, while agents with broad autonomy remain rare. External providers supplied 53% of systems assessed as highly material, but ongoing data risk monitoring and review controls were each reported by only around half of respondents. Cyber risk amplification and dependencies on critical third parties were the leading systemic concerns and were expected to intensify over the next one to three years.