UK survey finds 86% of responding financial firms use AI

The Bank of England and FCA’s Artificial intelligence in UK financial services 2026, published on 26 October 2026, says 86% of responding firms currently use AI. The full questionnaire also examined how firms use AI agents and how much autonomy they permit. The authorities describe the report as a summary of participating firms’ responses.

The survey received responses from 196 firms. In total, 105 respondents completed the full questionnaire. The 86% adoption figure combines full and short-form responses, while most detailed findings come from the full survey. Percentages generally use valid responses to each question, so their denominators vary. The authorities present the results as evidence from participating firms, not an estimate of AI adoption across every UK financial institution.

Third-party AI is becoming more important

Third-party implementations accounted for 39% of all reported AI systems, compared with 33% in 2024. They represented 53% of reported high-materiality systems, up from 35%. The report cautions that comparisons with 2024 should be treated carefully because questions, definitions and respondent populations differed.

The distinction matters. A vendor-supplied tool may account for a relatively small share of a firm’s AI estate while supporting a critical process. In the survey, 37% of 169 reported cloud and compute relationships were considered both highly critical and hard to substitute. Only 35% of that group had tested exit plans. The three largest cloud and compute providers accounted for 79% of reported cloud and compute relationships, while the three largest model API or hosting providers accounted for 54%.

The reported concentration makes service continuity and supplier oversight relevant to firms’ AI risk assessments. The survey found that information security and operational resilience were the most frequently reported major constraints on adopting third-party AI, cited by 40% of respondents. Limited transparency into training data, model design and failure modes followed at 34%.

The governance gap is clearest in how firms understand high-materiality systems. For internally developed AI, 77% reported relying on deep knowledge of the system. For third-party AI, only 24% reported that approach, while 81% relied on vendor assurance and contractual arrangements. Contracts and vendor attestations may be useful controls, but their value depends on whether they provide evidence that is sufficiently specific to the firm’s use, risk profile and operating environment.

Agents are widespread, but mostly assistive

The full questionnaire asked firms about agents in production by business area and level of autonomy. Only 2% of respondents reported agents with broad autonomy, in which agents can initiate and execute actions with limited real-time human involvement. This is a share of respondents, not a proportion of individual agents. The autonomy categories describe reported deployment, not a regulatory classification.

Agents were most commonly used in enterprise and coding applications. Sixteen per cent reported current use for automated customer communications, rising to 34% when planned deployment over the next 12 months was included. By contrast, including planned use, no more than 9% expected agents to approve or decline customer outcomes, execute trades or place orders, initiate, execute or block payments, or change limits, thresholds and controls.

That pattern limits the immediate evidence of fully autonomous decision-making, but does not remove the need for control over lower-level actions. An agent that drafts communications, updates records or executes within predefined limits can still affect customers, records, operational resilience and compliance evidence. Firms should therefore be able to connect agent permissions to accountable owners, approval routes and post-deployment review, even where a human remains formally responsible for the final decision.

The survey found that 94% of respondents had firm-wide AI policies, principles or standards, and 84% had centralised AI or model-risk governance forums. More than 90% reported human approval, pre-deployment review and vendor due diligence. By contrast, ongoing monitoring, leakage testing and periodic review or recertification were each reported by around half of respondents. These are different controls, reported through separate questions. The results do not show that the same firms have the stronger pre-deployment controls and weaker monitoring, or that one caused the other.

The risk signal is shifting from adoption to resilience

Respondents rated data protection and security, third-party and supply-chain risk, and risks specific to generative AI as the most significant current firm-level risks. They expected every listed risk category to increase over the next one to three years. At systemic level, 57% rated cyber-risk amplification as high or severe today, rising to 80% over that period. Critical third-party dependencies rose from 40% to 63%.

The Financial Stability Board’s final sound practices provide international context. Its 12 practices address board oversight, materiality, data governance, human oversight, cyber risk and third-party dependencies. The FSB encourages financial institutions to use the practices in their governance and risk management frameworks.

The practical test for firms is whether governance remains effective when models change, suppliers fail or agents move beyond advice into action.