The Bank of England and FCA's latest survey of Artificial Intelligence in UK Financial Services makes fascinating reading, not least because it highlights a familiar problem that has concerned regulators and supervisors for decades: the risk that a firm's business activities, technological innovation and increasing complexity develop faster than its governance, risk management and internal control capabilities.
During my time as a financial services supervisor, this was one of the issues that concerned me most, and it is something we continue to encounter through our consulting and training work today. The latest AI survey suggests that we may be seeing another manifestation of this longstanding problem, albeit with a technology whose capabilities and pace of development are unlike anything we have previously encountered.
Among the survey's findings, 86% of respondents now use AI, 94% report firmwide AI policies or standards, and 84% have centralised governance forums, yet only 34% routinely monitor AI risk metrics. These figures describe different aspects of governance and should not be interpreted as a single maturity measure, but their contrast raises important questions about whether the arrangements that firms have established are delivering effective oversight.
1. The Governance Gap – An Old Problem in New Clothing
During my time as a financial services supervisor, one of the issues that concerned me most was when a firm's business activities, complexity and pace of innovation developed faster than its governance, risk management and internal control capabilities, and it is a weakness we continue to encounter in consulting and training today. Businesses evolve, introduce new products and technologies and create new dependencies, while the arrangements intended to oversee and challenge them can remain rooted in an earlier, simpler organisation. The problem is not innovation itself, but the widening gap between what a firm does and what it can effectively understand, oversee and control. The survey reports widespread use of AI agents, albeit mostly with limited autonomy, making it all the more important that approval processes, accountability and monitoring evolve with the technology.
2. Policies, Committees and Frameworks – Necessary but Not Sufficient
Those familiar with my first Risk Heresy article will know that I am not advocating the abandonment of documentation, policies or governance arrangements. Indeed, one of our favourite mottos is that absence of evidence is evidence of absence: if a firm cannot demonstrate how risks were assessed, decisions challenged or controls tested, it will struggle to provide credible assurance that these activities occurred. However, documenting the completion of an activity is not the same as demonstrating its effectiveness. The important question is whether the evidence shows that risks are understood and controlled, not simply that a policy exists or a committee has met.
3. Do We Really Need Another Risk Management Universe?
AI introduces distinctive challenges, including hallucinations, explainability, bias, prompt injection, data leakage and increasingly autonomous decisions. Yet many underlying risk management challenges are familiar: change management, third-party oversight, data governance, control effectiveness, unclear accountability and resilience testing. Rather than creating another disconnected layer of governance, firms should ask whether their existing ORM frameworks, including RCSAs, KRIs, incident management, scenario analysis and TPRM, can be adapted and strengthened. Specialist AI expertise remains important, but it should complement rather than fragment the existing arrangements.
4. Third-Party AI – Outsourcing Technology Doesn't Outsource Accountability
The survey highlights the growing role of third-party AI in high-materiality systems and the reliance of many firms on vendor assurance and contractual arrangements. Of course, firms cannot reasonably be expected to understand every technical component of a sophisticated AI model, but they do need sufficient knowledge of the services, limitations, dependencies and controls on which their operations rely. Effective third-party risk management must continue throughout onboarding, ongoing service delivery and offboarding, supported by credible contingency arrangements and resilience testing. A contractual assurance is not the same as evidence that controls are effective.
5. AI – Moving from Managing the Data to Managing the Risk
Another of our favourite mottos is that we need to get away from managing the data to managing the risk. Operational risk functions have too often spent disproportionate time collecting, reconciling and formatting information for committees rather than interpreting what that information means and helping the business make better decisions. AI-powered GRC platforms could change this balance by analysing incidents, control assessments, KRIs, audit findings and external events, identifying relationships, inconsistencies and emerging vulnerabilities that conventional reporting may miss. The opportunity is not merely faster reporting, but better challenge, earlier intervention and more effective management of uncertainty, subject of course to appropriate validation, data quality and human oversight.
6. Everyone and Every System Is Fallible – Including AI and Its Supervisors!
A principle central to Karl Popper's critical rationalism is that everyone and every system is fallible. AI models can be wrong, but so can the managers, risk professionals, auditors and regulators who oversee them. The aim should not be to pretend that uncertainty can be eliminated or that perfect controls can be designed, but to make errors easier to identify, assumptions easier to challenge and weaknesses easier to correct. Meaningful risk information, independent challenge, testing and feedback are essential to governance that learns rather than merely asserts its own effectiveness.
7. Prevention Is Better Than Cure – Particularly When the Regulator Arrives!
We continue to see firms whose risk management arrangements have not kept pace with business growth, yet where improvements are deferred until an operational incident, internal audit finding or regulatory examination forces action. In more serious circumstances a skilled person review under section 166 of the Financial Services and Markets Act 2000 may add cost, management distraction and supervisory scrutiny; section 166 is a supervisory tool, not a punishment, but few firms would choose it as their starting point for improvement. Better to identify and address gaps proactively through effective assessment, challenge, testing and oversight before weaknesses become embedded in critical services.
8. The Real Heresy – Perhaps Innovation Isn't Moving Too Fast, but Risk Management Too Slowly?
The answer is not to slow innovation to the speed of existing governance, nor to build ever more committees and policies that add complexity without improving outcomes. It is to develop informed, adaptable and forward-looking governance, risk management and controls that can support innovation while maintaining effective oversight. AI offers an opportunity to improve the quality of risk analysis and intervention, but its own adoption must be subject to the same scrutiny and continuous improvement expected of other material activities. Perhaps the greatest AI governance risk is not that innovation is moving too quickly, but that our approach to managing risk has not evolved quickly enough to keep up with it.
We help financial services firms strengthen operational risk management, operational resilience, third-party risk management and governance through practical consulting and specialist training, moving beyond regulatory compliance towards demonstrably effective risk management.
Contact JADEtc AcademySource: Bank of England and FCA, Artificial Intelligence in UK Financial Services – 2026.