🏦 The Bank of England and the Financial Conduct Authority published their fourth survey of AI in UK financial services yesterday. 196 firms.
At The Human Ai Institute®, we ran it through Enterprise-wide AI Risk Management® (EW-AiRM®) ewairm.com analysis lens overnight.
Our headline: the sector has built AI governance 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 fast.
Whether that architecture 𝘄𝗼𝗿𝗸𝘀 is a question the data cannot yet answer.
📈 What the numbers say
→ 86% of firms now use AI (58% in 2022)
→ 80% have AI agents in production
→ 53% of high-materiality systems are third-party (35% in 2024)
→ 79% of cloud relationships sit with just three providers
→ Only 35% of critical, hard-to-substitute providers have tested exit plans
✅ Where we found the survey strong
It quantifies concentration rather than asserting it. And it measures the knowledge gap that matters most: 77% of firms claim deep knowledge of their in-house high-materiality systems. For third-party systems, it is 24%.
⚠️ The paradox we see
Adoption up. Agents up. Third-party materiality up.
Yet firms rated their AI risks 𝗹𝗼𝘄𝗲𝗿 than in 2024, and the share of systems classed as high-materiality fell from 16% to 7%.
Consumer and market conduct was rated the lowest risk of all, with among the lowest mitigation coverage.
🧭 How it scores against the EW-AiRM™ Five Non-Negotiables
NN1 Named owner for every AI system: Partial
NN2 Pre-deployment assessment: Partial
NN3 Tested human override: Partial
NN4 Documented residual risk acceptance: Absent
NN5 Incident reporting with retaliation protection: Absent
Accountability is reported by function (business owners 94%, Board 64%), not by name. Incident playbooks are the least common governance element, at 49%.
𝗖𝗼𝘃𝗲𝗿𝗮𝗴𝗲: 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝟲𝟬% · 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝟲𝟬% · 𝗥𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝟰𝟱%
🔧 Five questions we would add to the next survey round
1️⃣ Is a named individual recorded for every high-materiality system and agent, mapped to SM&CR?
2️⃣ Can each agent be stopped, by whom, and how fast? Has that been tested?
3️⃣ What does "material" mean, and how many systems were reclassified downwards?
4️⃣ Who formally accepted the residual AI risk, and at what level?
5️⃣ Have exit plans for critical providers actually been tested?
In our view, this is the best public evidence base on enterprise AI governance in any sector. That is exactly why it deserves a critical read.
💡 "Governance that looks right is not the same as governance that works."
📄 Our full three-page assessment, including the scoring rubric, is available here:
https://enterprisewideairiskmanagement.grigora.app/boefcaaisurvey2026html/
📘 More in Enterprise-Wide AI Risk Management (Wiley), out 12 November.
This is an independent Human-Ai.Institute assessment, not affiliated with or endorsed by the Bank of England or the FCA.
#AIGovernance#AIRisk#FinancialServices#BankOfEngland#FCA#AgenticAI#ThirdPartyRisk#OperationalResilience#RiskManagement#EWAiRM#HumanAiInstitute