Artificial intelligence is no longer something financial services firms can treat as a future consideration. In many organisations, it is already part of everyday operations.
Employees may be using generative AI to draft documents, analyse information or summarise meetings. Microsoft Copilot may be appearing across Microsoft 365. Existing software providers are adding AI to their platforms, while specialist tools increasingly use it for analysis, automation and customer interactions.
The latest figures show how quickly AI in financial services is developing. The Bank of England and Financial Conduct Authority’s 2026 survey found that 86% of respondents were already using AI, up from 75% in 2024, while generative AI represented 56% of reported AI systems.
For regulated firms, this changes the question.
Rather than simply asking“How can we use AI?”, firms also need to understand: where is AI already being used, what information can it access and do we have appropriate oversight of it?
That matters because the FCA does not currently plan to introduce a separate AI-specific regulatory framework. Instead, existing requirements around areas such as Consumer Duty, accountability and governance continue to apply when firms use AI.
AI may already be inside your firm
AI adoption does not always begin with a formal AI project.
It might start with an employee using a publicly available generative AI tool. Elsewhere, AI could arrive through Microsoft Copilot, a CRM platform, finance software, customer service technology or another third-party application.
This creates an important difference between AI adoption and AI visibility.
Third-party implementations accounted for 39% of reported AI systems in the 2026 Bank of England/FCA survey and 53% of systems respondents considered high materiality. Eighty per cent of respondents also reported having AI agents deployed, although most were providing decision support rather than independently making and executing decisions.
For firms, the important point is that AI risk does not stop with the tools they deploy themselves. AI introduced through existing suppliers needs the same visibility and consideration as technology adopted directly by the business.
An organisation therefore does not need a formal AI strategy to have AI exposure. A sensible starting point is knowing which tools are being used, what information they can access, where AI influences important processes and who is responsible for overseeing significant use cases.
Shadow AI adds another dimension, particularly where employees use unapproved tools with sensitive information. Alongside governance concerns, firms need to consider the wider cyber risks associated with AI in financial services, from data exposure to weaknesses introduced through third-party tools.
What does the FCA expect from firms using AI?
The FCA’s approach is principles-based rather than built around a separate AI rulebook.
Its work on AI makes clear that existing regulatory frameworks continue to apply, covering areas including safety and robustness, fairness, transparency, accountability, governance and operational resilience.
For firms adopting AI, three areas are particularly relevant.
Accountability and governance
Using AI does not remove existing management accountability.
For financial services firms, that makes visibility particularly important. Senior teams cannot effectively oversee AI use if the organisation does not know which tools are being used, what data they can access or where they influence important processes.
The FCA’s existing accountability framework, including the Senior Managers and Certification Regime (SM&CR), continues to apply as firms introduce AI. In practice, firms need clear ownership of significant AI use cases alongside appropriate monitoring and human oversight.
Consumer Duty
AI does not change a firm’s responsibility for customer outcomes. If it is used to generate communications, support customers or influence a customer-facing process, firms still need confidence that the resulting experience meets the standards expected of them.
This is where Consumer Duty becomes particularly relevant. The FCA has made clear that its existing regulatory framework continues to apply as firms introduce AI. The technology may change, but responsibility for the outcome remains with the firm.
Operational resilience
AI can create new dependencies too.
If an important process relies on an external AI platform or provider, firms need to consider what happens if that service becomes unavailable, changes unexpectedly or fails to perform as intended.
This brings AI into existing conversations around third-party risk, cyber security, business continuity and operational resilience.
Three AI risks financial services firms should understand
AI risk crosses compliance, data governance, cyber security and technology. Three areas deserve particular attention.
1. Model and decision risk
AI-generated information can appear convincing while still being inaccurate, incomplete or inappropriate.
That becomes more important when employees rely on AI-generated analysis or recommendations in significant business or customer processes.
The 2024 Bank of England/FCA survey found that 46% of respondents had only a partial understanding of the AI technologies they used, compared with 34% reporting complete understanding. The challenge was particularly associated with third-party models.
Firms therefore need to understand where AI contributes to important outputs or decisions, what level of human oversight is appropriate, how errors will be identified and where responsibility ultimately sits.
2. Data risk
In practice, many of the risks associated with AI begin with familiar IT problems rather than AI itself. Poorly managed permissions, weak information governance or inappropriate handling of sensitive data already create risk. AI can make those weaknesses more significant by making information easier to find, analyse and reuse.
An employee entering confidential client information into an inappropriate AI application is one example. Another is introducing enterprise AI into an environment where employees already have unnecessary access to sensitive information.
This is consistent with the Bank of England/FCA’s research, where privacy and protection, data quality, security, and bias and representativeness were among firms’ most significant perceived AI risks.
Before expanding AI use, firms therefore need to understand the information environment the technology is being introduced into, not just the AI tool itself.
The overlap between AI, data protection and cyber security means these areas should not be considered separately. Existing cyber security measures for financial services firms should extend to the AI tools, users, data and third-party services entering the technology environment.
3. Operational and third-party risk
AI can introduce new dependencies into the technology environment. If a critical business process relies on an external AI platform, the firm is also exposed to the availability, security and future changes of that service.
That makes AI part of the wider operational resilience conversation rather than a separate technology exercise. The Bank of England’s assessment of AI and financial stability similarly highlights the operational risks associated with growing reliance on AI service providers.
This matters when third parties already account for 53% of high-materiality AI systems reported by respondents in the 2026 Bank of England/FCA survey. Firms therefore need to understand not only which AI suppliers they rely on, but what would happen to important services if those dependencies failed.
Why your IT environment matters to AI governance
AI governance can easily become framed as a policy or compliance issue.
But policies alone cannot determine what an AI system can access.
The underlying IT environment controls identity, authentication, permissions, information access, application connections, device security and monitoring.
A policy might state that confidential client information should only be accessible to authorised employees. The technology environment has to enforce that policy.
Similarly, if Microsoft 365 permissions are unnecessarily broad, introducing AI can make an existing information-governance weakness more significant.
This is why AI readiness should be considered as part of the wider technology environment rather than as a standalone project. Reviewing data readiness, permissions, security, infrastructure and use cases before implementation can expose weaknesses before AI adoption magnifies them.
For organisations unsure where to start, an AI readiness assessment can provide a structured way to review these foundations and identify practical priorities before wider implementation.
Microsoft Copilot: is your environment ready?
Microsoft 365 Copilot is a good example of why AI readiness begins before deployment.
The question is not simply what Copilot can do. It is whether the Microsoft 365 environment is ready for it.
Before deploying Copilot more widely, financial services firms should review existing Microsoft 365 permissions, understand where sensitive information is held and establish clear acceptable-use guidance. Appropriate logging and monitoring should also be considered, while employees need to understand when AI-generated information requires human review.
These controls matter because AI can make it easier for employees to discover and use information they already have permission to access. Poor permission hygiene can therefore become more consequential once employees can interrogate information more easily.
The issue will continue developing as Microsoft expands Copilot’s capabilities. Understanding the latest Microsoft Copilot features can help firms consider new functionality alongside the permissions, data and security implications of enabling it.
What does good AI governance look like in practice?
Effective AI governance does not necessarily require building an entirely new compliance framework. For many firms, it begins with applying established governance disciplines to a new type of technology.
A practical approach should include:
- Creating an AI inventory: identify approved tools, AI embedded within existing applications and standalone services being used by employees.
- Understanding data: establish where confidential, personal and regulated information is held and how it is classified.
- Reviewing access: remove unnecessary permissions and apply least-privilege principles, particularly within environments such as Microsoft 365.
- Establishing ownership: ensure significant AI use cases have clear responsibility across technology, compliance, security and relevant business teams.
- Defining acceptable use: give employees practical guidance covering approved tools, sensitive information, checking outputs and when concerns should be escalated.
- Considering auditability: understand what records would be needed to investigate an unexpected outcome or understand how a significant AI-supported process operated.
- Assessing third parties: include AI embedded within externally supplied software and platforms within wider supplier and technology oversight.
These controls also need regular review.
AI adoption among respondents to the Bank of England/FCA survey increased from 75% in 2024 to 86% in 2026, alongside rapid growth in generative AI and AI agents.
Governance needs to evolve alongside the technology.
Where managed IT fits into AI readiness
Responsible AI adoption depends on technology disciplines firms already need to manage effectively.
Identity, access controls, Microsoft 365 governance, cyber security, monitoring, business continuity and the wider IT environment all influence how safely AI can operate.
And these are not one-off considerations at the point of deployment. Permissions change, employees join and leave, information accumulates, new applications are introduced and AI products gain new functionality.
Maintaining those foundations is an ongoing responsibility. Effective managed IT for financial services can help firms maintain oversight of areas such as identity, permissions, Microsoft 365, security, infrastructure and business continuity as their use of AI develops. Managed IT for Financial Services: What FCA-Regulated Firms Actually Need specifically covers preparing the underlying IT environment for AI, including identities, permissions and information access.
Where AI forms part of wider technological or organisational change, IT consultancy can help connect new initiatives with existing data, infrastructure and business priorities rather than allowing individual projects to develop in isolation
AI readiness starts with knowing where you stand
AI in financial services is no longer hypothetical. The challenge is ensuring visibility, controls and accountability keep pace with adoption.
For FCA-regulated firms, that means understanding which AI systems are operating within the organisation, what information they can access, where they influence important processes and how their use fits within existing regulatory responsibilities.
Before expanding AI adoption, firms should be able to answer:
- Can we identify the AI systems currently being used?
- Do we know what information they can access?
- Are existing permissions appropriate?
- Do we understand where AI influences important outputs or decisions?
- Is human oversight appropriate to the use case?
- Have we considered third-party dependencies?
- Can relevant activity be monitored or investigated?
- Is responsibility for significant AI use clear?
If those answers are unclear, strengthening the underlying foundations is a sensible step before adoption expands further.
Preparing your financial services firm for AI
AI offers significant opportunities for financial services firms, but successful adoption depends on more than choosing the right tools.
Data, access, cyber security, Microsoft 365, infrastructure and employee awareness all influence how securely and effectively AI can be introduced.
Akita supports organisations looking to understand these foundations and move towards practical AI adoption. Through AI consultancy services, Akita provides support across AI readiness, strategy and implementation, alongside Microsoft Copilot services covering readiness, deployment and adoption
Speak to Akita’s financial services team about AI readiness.
Contact Us
