BoE/FCA AI survey 2026: adoption at 86% but third-party oversight and post-deployment monitoring are the weak points

Worth reviewing — all firms using or planning to use AI in regulated activities, risk management, or customer-facing processes.

The Bank of England and FCA published their fourth joint AI/ML survey on 26 October 2026, covering 196 respondent firms. AI adoption has risen to 86%, up from 75% in 2024 and 58% in 2022. The headline number matters less than what sits beneath it.

The technology mix has shifted dramatically. Generative AI now accounts for 56% of all reported AI systems, against 17% for foundation models in 2024. Operations and IT remains the most concentrated deployment area, at roughly 31% of all reported systems, up from 22% in 2024.

AI agents are already live at 80% of respondents. An AI agent recommends or takes actions rather than simply producing outputs. Of those deployments, 80% are decision-support only: the AI recommends and a human decides. Only 2% reported agents with broad autonomy, and fewer than 9% expected agents to approve or decline customer outcomes, execute trades, or initiate payments even including planned deployments over the next 12 months.

The structural concern is third-party dependency. Third-party AI implementations now account for 39% of all reported AI systems, up from 33% in 2024 and 17% in 2022, and 53% of high-materiality systems, up from 35% in 2024. The top three cloud and compute providers account for 79% of all reported infrastructure relationships. Firms know this is a problem: 54% cited applying model risk management principles to third-party models as a governance challenge, and 49% cited overseeing systems provided or materially influenced by third parties.

Pre-deployment controls are far more common than post-deployment monitoring. Human approval, pre-deployment review, and vendor due diligence were each reported by more than 90% of respondents. Ongoing monitoring and periodic recertification were each reported by around half. That gap is where the FCA's good and poor practice guidance, published on 19 October 2026, focuses its sharpest observations.

The FCA found that some firms deployed AI before establishing governance, then retrofitted frameworks after key decisions were made, producing oversight that worked on paper but not in practice. It also found that human reviewers increasingly accepted AI-generated recommendations without meaningful scrutiny, even where there were signs of error or uncertainty. A further finding: some firms excluded consumers with vulnerability indicators from AI services without providing an alternative route, meaning risk-averse measures themselves caused consumer harm.

The guidance does not create new requirements or prescribe a single governance model. It is relevant to any regulated firm that develops, buys, or uses AI, whether built in-house, embedded in a third-party system, or used by staff to support decisions.

For small firms, 73% reported using AI, with 58% of those predominantly using large language models (LLMs). Operations is the most common deployment domain. The governance expectations apply at any size.

The combined message from the survey and the FCA guidance is consistent: adoption is not the problem. The gap between pre-deployment controls and post-deployment monitoring, and between firms' reliance on third-party AI and their ability to oversee it, is where supervisory attention is heading.

Sources

• Artificial intelligence in uk financial services 2026bankofengland.co.uk
• Ai financial servicesfca.org.uk
• Ai adoption and regulation the latest FCA viewdeloitte.com
• Ai in financial services FCA good and poor practice and the road to agentic…freshfields.com