AI in financial services: UK regulators reflect on industry use and best practice amid growing operational resilience concerns

The Bank of England and the Financial Conduct Authority have published two significant updates on AI in UK financial services. A survey of the industry reflects a sharp rise in the use of AI agents and mounting concerns around oversight of third-party risks. New FCA guidance underlines the supervisory focus on consumer outcomes, effective governance and operational resilience, including how firms are responding to the cyber capabilities of frontier AI.

Survey of AI in UK financial services

The Bank of England and FCA have shared the results from their fourth survey of AI and machine learning in the UK financial services industry. The report indicates how the 196 firms that responded to the survey use AI and how they perceive the associated benefits and risks.

According to the report:

• AI deployment is now near universal in the sector and there has been a substantial increase in firms’ reported use of general-purpose capabilities since the last BoE-FCA survey in 2024.

• AI agents were not mentioned in the 2024 report; now AI agent adoption is widespread and expected to increase further. For the time being, the degree of AI agents’ autonomy is relatively limited with most being used to support human decision-making.

• Third-party AI systems have become more prevalent and more material. As was the case for the previous survey, firms’ most prominent concerns when adopting third-party AI relate to information security and operational resilience.

• The benefits and risks of AI will increase over the next few years, according to respondents. Notably, firms anticipate systemic risks, such as cyber risk and critical third-party dependencies, intensifying as AI usage becomes more widespread. The greatest governance uncertainty and implementation challenge is reportedly oversight of third-party AI systems.

• Frontier AI has been shown to enable faster exploitation of software vulnerabilities. 88% of respondents consider that frontier AI cyber capabilities over the next two years will have a moderate or high impact on their firm’s risk profile.

• Incident-management and response playbooks are in place at fewer than half of respondents. Looking ahead, this may change as firms implement new incident reporting requirements. In new guidance (covered below), the FCA presents having a playbook of how to identify and handle AI-related incidents as an example of good practice.

• Constraints to further AI adoption include unclear best practice for how to meet the UK regulators’ expectations. This is not new: respondents to the first survey in 2019 made the same point, as did a January 2026 Treasury Committee report which asked the FCA to provide such guidance by the end of the year (and which it has now done – see below).

FCA: Good practice and areas for improvement for AI in financial services

The FCA has shared examples of good and poor practice for AI adoption. The guidance covers three areas: (i) Consumer Duty and consumers in vulnerable circumstances; (ii) governance and accountability; and (iii) operational resilience.

Consumer Duty and consumers in vulnerable circumstances

• Under the Duty, firms must act to deliver good outcomes for retail customers. In its examples of good practice, the FCA emphasises the importance of testing consumer-facing AI tools to manage bias, support inclusive design and consumer understanding. The FCA notes that some firms placed too much confidence in AI’s ability to identify indicators of vulnerability.

Governance and accountability

• The FCA expects senior managers to be accountable for AI systems and take reasonable steps to mitigate risks, although they are not expected to be technical specialists. Good practice includes having formal processes to test, challenge and approve AI use cases according to board-set risk appetite and ensuring that senior management receives appropriate information and oversight so they can understand key risks and make informed decisions.

• The FCA encourages firms to design a suitable governance structure before deploying AI agents, with compliance controls that maintain human oversight across complex workflows. That said, the FCA also warns against excessive reliance on human-in-the-loop controls, either where human review masks weaknesses in the model or becomes a box-ticking exercise rather than meaningful oversight.

Operational resilience

• The FCA expects firms to consider their use of AI and dependence on AI models when reviewing their operational resilience. This includes piloting lower-risk use cases to identify issues, stress-testing tools before deployment to refine guardrails and designing AI services to not be dependent on a single underlying model.

• An example of best practice is keeping clear records of AI use cases and providers. According to the BoE-FCA survey, 68% of firms reported maintaining a central inventory of AI systems. Firms should also develop contingency plans in case of unexpected disruption and take steps to prevent the risk of overreliance on hard-to-replace AI providers.

While not introducing new AI-specific regulation, the FCA’s guidance is an important new reference for firms to use to gauge their current governance and compliance processes.