Financial Firms: 86% Use AI, But Oversight and Testing Lag Behind

86% of financial services firms are using AI, yet many lack formal testing and documented oversight, creating significant governance vulnerabilities that could draw regulatory scrutiny and operational risk Financial Times Reuters.

A new survey published June 2024 reveals that 86% of financial services firms have integrated AI technologies into their operations, spanning banking, asset management, and insurance sectors Financial Times. However, the majority of these firms admit to lacking formal AI testing protocols and documented oversight processes, with many relying on ad hoc or informal controls. This governance gap affects firms of all sizes, from global banks to regional institutions, and raises concerns about the sector’s preparedness for regulatory compliance and risk management Reuters.

The findings are particularly significant for enterprise AI in regulated industries, as financial services are subject to strict oversight from bodies like the SEC, OCC, and global equivalents. The absence of formal testing and governance processes directly contravenes emerging best practices outlined in the NIST AI Risk Management Framework and may fall short of expectations under the EU AI Act, which mandates robust risk management and documentation for high-risk AI systems NIST EU AI Act. For firms operating in the US, the SEC has signaled increased scrutiny of AI-driven decision-making, especially where consumer protection, market integrity, or anti-money laundering controls are implicated SEC.

CTOs, CISOs, and Compliance Officers should immediately review their AI governance structures, prioritizing the implementation of formal testing protocols and comprehensive documentation of oversight processes. Over the next 30-90 days, firms should conduct gap analyses against regulatory frameworks (NIST AI RMF, EU AI Act, SEC guidance) and prepare for potential audits or inquiries. Failure to address these governance gaps could result in regulatory penalties, reputational damage, and increased operational risk as regulators and stakeholders demand greater transparency and accountability in AI deployments Financial Times.

What This Means for Enterprise AI

Financial services firms must urgently align their AI governance with regulatory expectations. The EU AI Act requires documented risk assessments, human oversight, and incident reporting for high-risk AI systems, which include many financial applications such as credit scoring and fraud detection EU AI Act. Firms lacking these controls may face enforcement actions or be forced to suspend AI-driven services.

US regulators, including the SEC and OCC, are increasingly focused on AI’s impact on market fairness and consumer protection. The NIST AI Risk Management Framework provides a blueprint for establishing formal testing, validation, and monitoring processes—key steps for demonstrating compliance and managing third-party risk NIST. CTOs and CISOs should ensure that all AI models undergo regular, documented testing for bias, accuracy, and security vulnerabilities, and that oversight responsibilities are clearly assigned and auditable.

Action items: Conduct a rapid assessment of current AI oversight, prioritize the creation or enhancement of formal testing protocols, and document all governance processes. Engage legal and compliance teams to map these controls to applicable regulations, and prepare evidence for potential regulatory reviews. Proactive governance will not only mitigate risk but also position firms competitively as regulators and clients increasingly demand responsible AI practices Reuters.