Financial Firms: 86% Use AI, Oversight and Testing Lag Behind

86% of financial services firms have adopted AI, but many lack formal testing and documented oversight, creating significant compliance and risk management gaps Financial Tech Insights.

A new industry survey published June 2024 finds that 86% of financial services firms are using AI technologies to enhance operations and decision-making, but a majority do not have formal testing protocols or documented oversight in place Financial Tech Insights. The survey, which polled compliance, technology, and risk leaders at over 200 global financial institutions, highlights that while AI adoption is nearly ubiquitous, governance frameworks are lagging. This affects banks, asset managers, insurers, and fintechs subject to regulatory scrutiny.

The findings are particularly significant for regulated enterprises because financial regulators—including the SEC, OCC, and global equivalents—are increasingly focused on AI risk management and model governance SEC, OCC. The lack of formal testing and oversight means many firms may be out of compliance with emerging requirements such as the EU AI Act’s mandatory risk assessments and documentation, as well as NIST’s AI Risk Management Framework, which calls for robust pre-deployment testing and continuous monitoring NIST AI RMF. Gaps in oversight also increase exposure to operational, reputational, and regulatory risks, especially as regulators begin to demand evidence of AI controls.

CTOs, CISOs, and Compliance Officers should immediately review their AI governance frameworks, prioritizing the implementation of formal testing protocols and comprehensive documentation for all AI systems. Over the next 30-90 days, firms should conduct gap assessments against regulatory expectations, update risk management playbooks, and prepare for increased regulator inquiries or audits focused on AI oversight. Failure to act could result in enforcement actions, fines, or reputational damage as regulators intensify scrutiny of AI deployments in financial services.

What This Means for Enterprise AI

Financial firms must align their AI governance with regulatory frameworks such as the EU AI Act, which requires documented risk assessments, transparency, and human oversight for high-risk AI systems EU AI Act. The absence of formal testing and oversight exposes firms to violations of existing rules on model risk management, such as the OCC’s SR 11-7 guidance, which mandates rigorous validation and documentation for all models—including those powered by AI OCC SR 11-7.

Operationally, this means CTOs and CISOs should implement standardized AI testing protocols before deployment, ensure ongoing monitoring, and maintain detailed records of AI system performance and decision-making logic. Compliance teams must be prepared to demonstrate these controls to regulators on demand. Firms should also map their AI inventory, classify systems by risk, and establish escalation procedures for AI-related incidents.

In the next quarter, expect regulators to increase requests for evidence of AI oversight, especially as global standards like the NIST AI RMF and EU AI Act become reference points for supervisory reviews. Proactive firms will use this window to close governance gaps, reduce risk exposure, and build trust with regulators and clients.