BoE and FCA Survey Shows Generative AI Surge in UK Finance

The Bank of England and the Financial Conduct Authority said on October 26 that generative AI now makes up 56% of the AI systems reported by UK financial firms, and that 86% of respondents use AI, in their fourth joint survey.

The generative AI financial services survey drew responses from 196 firms, 101 larger and 95 smaller. It shows a sharp shift from 2024, when foundation models accounted for 17% of reported systems. For compliance and risk teams, the more pressing number may be who builds the systems: third parties supply 53% of those rated high materiality, up from 35% in 2024.

Generative AI financial services survey: the headline numbers

Adoption stands at 86% of respondents, up from 75% in 2024 and 58% in 2022. The regulators caution that the figures are not like-for-like across years.

Every responding UK and international bank uses AI, as do 93% of insurers. Among small firms, 73% use it, and 58% of those mainly use large language models.

Operations and IT is the largest area of use, at about 31% of reported systems, up from about 22% in 2024. No other business area exceeds 11%. Of the 196 respondents, 105 completed the full survey, and the main-body figures are based on that group.

Almost half of firms report 10 or fewer systems. The top ten respondents account for 43% of all systems, so the aggregate picture is weighted toward the largest users.

About 7% of systems are rated high materiality, down from 16% in 2024. The regulators note that the absolute number of such systems is higher, because the total has grown.

AI agents are widespread, but autonomy is rare

The survey asked for the first time in this form about AI agents. It found 80% of firms have agents deployed, and a further 14% plan to deploy them within 12 months.

Most of that use is supervised. The same 80% use agents for decision support only, and 2% report agents with broad autonomy.

Automated customer communications are the most common customer-facing use, at 16% today and 34% once planned deployments are counted. Approving or declining customer outcomes, executing trades, initiating payments and changing limits each draw no more than 9% of firms, even including planned use.

Third-party models carry the high-materiality systems

Third-party implementations make up 39% of all systems, up from 33% in 2024. For high-materiality systems the share is 53%, against 35% two years earlier.

Concentration is high in the supply chain. The top three cloud and compute providers account for 79% of relationships, and the top three model and API providers account for 54%.

The regulators also asked about constraints. Information security and operational resilience are a major constraint for 40% of respondents, and limited transparency is one for 34%.

These findings bear directly on third-party risk management and AI, where boards are asked to oversee suppliers whose models they cannot inspect. Teams assessing vendor-supplied models can compare tools in a list of third-party risk management software platforms.

Governance is in place, oversight of vendors lags

Formal structures are common. In the generative AI financial services survey, 94% of firms have firmwide AI policies and 84% have centralized AI or model-risk forums.

More than 90% of firms report human approval, pre-deployment review and vendor due diligence. Only about half report ongoing monitoring, leakage testing and periodic review.

The gap widens for third-party systems. For high-materiality systems, 77% of firms rely on deep knowledge of their internal systems, but only 24% do so for third-party systems. For third-party systems, 81% rely on vendor assurance and contracts.

Oversight is the top challenge the firms name. Some 54% cite applying model risk management to vendor models, and 49% cite overseeing systems that third parties provide or influence.

The firms rate data protection and security, third-party and supply chain risk, and generative AI-specific risks such as hallucinations and prompt injection as their highest current risks. Over the next three years, they rank cyber risk amplification and critical third-party dependencies highest as systemic risks.

What the regulators signal for firms

The survey report does not set new rules or announce supervisory action. It describes itself as supporting ongoing work and links to the government’s Financial Services AI Adoption Plan, published in July 2026.

Operational resilience, critical third parties, model risk management and consumer outcomes appear in the report as areas of related Bank and FCA work. The report does not discuss the Senior Managers and Certification Regime or the Consumer Duty, and it lists no specific follow-up steps.

The Bank has separately published a response to the Treasury Committee’s inquiry report on AI in financial services.

Regulatory burden features in the findings. Some 42% of firms cite UK data protection and privacy rules as a high compliance burden, and 29% cite international regulation. Among non-regulatory constraints, 23% name integrating AI into processes as a large constraint and 22% name legacy systems.

UK firms with EU operations face a parallel set of supplier rules under the Digital Operational Resilience Act, which also puts third-party ICT providers under scrutiny. The concentration figures in the UK survey show why supervisors on both sides of the Channel focus on that exposure.

Cyber risk and what the figures mean for controls

Some 88% of firms rate the evolving cyber capabilities of frontier AI as a moderate or high impact over the next two years. Another 64% say vulnerability management and patching cadence received the most added management attention.

Sustainability is a smaller concern. Some 57% of firms consider AI’s sustainability impacts, but 82% do not report them externally. Of those that do not report, 36% plan to do so within two years.

For risk and compliance teams, the generative AI financial services survey puts numbers on a control question that firms already face. Supplier assurance and contract terms carry most of the weight for the systems that matter most, while firms report that their own monitoring and testing are less consistent.

Practical guidance on containing supplier exposure is set out in five strategies to contain third-party risk, and the survey shows how much of it applies to AI models.

The figures also affect board reporting. A board told that 94% of peers have an AI policy can ask whether the policy reaches vendor-built models, which are now more than half of the systems rated high materiality.

The Bank and the FCA have not set a date for the next survey. The full report, including the short-form survey results, is on the Bank of England website.