The Bank of England and Financial Conduct Authority have published their latest survey of AI adoption in UK financial services. The survey is based on responses from 196 UK firms and provides a view of how they are using AI, where regulators see potential risks, and which governance challenges are becoming most pressing. It follows the FCA's review of good and bad practice with AI in financial services firms.
AI adoption is accelerating rapidly
AI adoption is continuing to grow rapidly. 86% of respondents reported using AI, up from 75% in 2024 and 58% in 2022. Most respondents had at least one AI system in production.
The most significant change since the previous survey is the rise of generative AI. Generative AI now accounts for 56% of reported AI systems, compared with foundation-model use accounting for 17% of reported AI use cases in 2024. AI is being used across a wide range of business areas, but remains concentrated in operations and IT, which accounts for around 31% of reported deployments.
The survey also suggests that the largest firms are moving fastest. The top ten respondents accounted for 43% of all reported AI systems and 62% of all reported high-materiality AI systems.
Agentic AI is being used but autonomy remains limited
Much of the recent discussion around AI has focused on autonomous AI agents. 80% of survey respondents reported that they were already deploying AI agents, with a further 14% planning deployment within the next year. However, despite widespread experimentation, firms remain cautious about delegating significant authority to AI systems. Most deployed agents operate in decision-support roles, recommending actions while humans retain responsibility for decisions and execution. Only 2% of respondents reported deploying agents with broad autonomy.
The survey suggests firms are willing to deploy agents for internal productivity, coding assistance and customer communications, but remain reluctant to allow autonomous systems to make high-impact decisions such as approving customer outcomes, executing trades or initiating payments. Even when planned deployments are considered, fewer than 10% of respondents expected agents to perform these activities.
Third-party AI dependency is becoming a key concern
One of the most important findings for lawyers and risk professionals relates to third-party AI services. Third-party implementations now account for 39% of reported AI systems and 53% of high-materiality AI systems, both significant increases from 2024.
The survey also found a growing concentration in cloud infrastructure and model providers. The three largest cloud and compute providers accounted for 79% of reported provider relationships, while the three largest model API providers accounted for 54%. This raises operational resilience concerns. Many cloud relationships were classified by firms as both highly critical and difficult to replace. However, only a minority had tested exit plans.
When it comes to negotiating AI contracts, the survey highlights increasing focus on:
- audit and oversight rights;
- transparency regarding training data, model behaviour and limitations;
- data use and confidentiality protections;
- incident management and operational resilience;
- change management and model updates; and
- liability allocation and contractual remedies.
The findings align closely with broader UK regulatory concerns around critical third parties and operational resilience.
Governance is maturing, but significant gaps remain
The survey suggests that AI governance frameworks are becoming more formalised. 94% of respondents reported having firm-wide AI policies, principles or standards, while 84% reported centralised governance or model-risk forums. Most firms also reported formal accountability structures, with business leaders and executive management typically carrying responsibility for AI systems and outputs.
However, governance maturity is uneven. The survey found stronger controls before deployment than after deployment. Human approval, pre-deployment review and vendor due diligence were widely reported, but ongoing monitoring, leakage testing and periodic review were significantly less common.
Notably, firms reported far greater understanding of internally developed AI systems than third-party systems. 77% relied on deep technical understanding for internally developed systems, compared with only 24% for third-party systems. Most firms instead relied on vendor assurances and contractual protections when using externally supplied AI. This raises the question of when firms increasingly depend on third-party foundation models, how much visibility into those systems is realistically necessary to satisfy governance, risk-management and regulatory expectations?
The regulatory challenge is no longer AI regulation
Another noteworthy finding is that firms do not view AI-specific regulation as their primary challenge. The largest perceived regulatory burden came from existing UK data protection and privacy requirements, followed by international regulation such as the EU AI Act. Respondents also reported uncertainty regarding intellectual property compliance and emerging international AI frameworks.
Cyber risk is moving up the agenda
The survey also reveals growing concern about the cyber implications of advanced AI. 80% of respondents believe frontier AI cyber capabilities will have a moderate or high impact on their risk profile within the next two years. Firms identified cyber-risk amplification and critical third-party dependencies as the most significant systemic risks associated with widespread AI adoption. Management attention is increasingly focused on vulnerability management and patching, while many firms expect to deploy AI-driven security tools across security operations, vulnerability identification and incident response activities.
What does this mean for me?
Financial services firms should treat AI as an immediate governance and operational-resilience issue. Priorities should include mapping AI use and third-party dependencies, strengthening supplier terms and exit plans, and ensuring that monitoring and testing continue throughout the AI lifecycle, particularly for higher-impact and agentic systems.
