Only 18% of Financial Firms Say They Own Their AI
Only 18% of financial firms say they own their AI, while regulators are twice as likely to say they do. After the FCA flagged firms trusting untested vendor promises, banks face a hard question: who owns a decision nobody can explain?
Only 18% of Financial Firms Say They Own Their AI
On 19 October 2026, the UK's financial regulator, the FCA, published a review warning that some firms trust AI vendors' promises without testing them.
Why it matters:
A bank buys an AI tool based on a demo and a SOC 2 report. Months later, the tool turns down a loan applicant. The customer complains. Nobody at the bank can explain why. The bank still owns that decision. The FCA says firms stay responsible for AI they buy, and US bank regulators have said the same about outside vendors since 2023.
Catch up quick:
For years, buying AI followed a simple script: pitch deck, security questionnaire, SOC 2 badge, clean pilot, signature. The vendor's word counted as proof. But US guidance has long told banks to consider whether a SOC report even covers the work they are outsourcing.
By the numbers:
81%: financial services firms are already using AI in some form.
70%: financial firms that rank hallucinations and unreliable AI answers among their top risks.
38%: regulators who say the financial firm itself is mainly responsible for its AI. Only 18% of financial firms and 16% of vendors agree.
78% vs. 50%: regulators who say explaining AI decisions is critical or important, versus financial firms that use methods to explain them.
The big picture:
An untested promise can hide more than bad accuracy. The FCA warns that firms that skip testing may not know a model's limits, or whether their backup plans would work. In one case, a firm built a product on a single model with no backup. When that model was retired, the firm had to redesign the product.
Yes, but:
A human reviewer is not the safety net it seems. In one firm the FCA describes, reviewers drifted into approving AI recommendations without real scrutiny, and low-confidence results went through anyway.
Between the lines:
The FCA wrote no new rules, and says so. It did not need to. The review shows what the FCA has seen inside firms, and untested vendor promises are on the list.
The way through:
Accelerate AI scores both sides of the deal on one engine, and claims without evidence earn no score. For banks, a Buyer COTS Assessment evaluates a vendor's AI against the bank's own use case and data sensitivity. It produces a Trust Score and a prioritized risk plan with named owners. For vendors, a Vendor COTS Assessment means walking into the security review with a verified Trust Score, not a pitch deck.
Three questions a bank risk team should answer this quarter:
Has the bank tested each AI vendor's promises itself, or only collected them?
Who owns the outcome when a vendor's model makes a decision the bank cannot explain?
Can the bank show that its reviewers overrule AI recommendations, not just approve them?
The bottom line:
"Trust me" no longer closes deals, and "we trusted them" is no longer a defense. The vendors that get out of pilot purgatory will be the ones whose claims the bank has already tested.
Works Cited:
Board of Governors of the Federal Reserve System, et al. "Interagency Guidance on Third-Party Relationships: Risk Management." Federal Register, vol. 88, 9 June 2023, pp. 37920–37937, federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management.
Financial Conduct Authority. "AI in Financial Services: Good Practice and Areas for Improvement." FCA, 19 Oct. 2026, fca.org.uk/publications/good-poor-practice/ai-financial-services.
Garvey, Kieran, et al. "2026 Global AI in Financial Services Report: Adoption, Impact and Risks." Cambridge Centre for Alternative Finance, Apr. 2026, jbs.cam.ac.uk/faculty-research/centres/alternative-finance/publications/2026-global-ai-in-financial-services-report.
Related briefs
- Enterprise Risk Intel: 50% of Tested AI Fails in Production — In a survey of 157 enterprise leaders, 50% deployed an AI agent or feature that cleared internal evaluations, only to fail in front of a customer. Static testing evaluates AI tools in isolation, creating a dangerous false sense of readiness. Read why evaluating the tool and its operating environment together is essential for establishing production trust.
- Policy vs. Practice — 98% of surveyed senior AI decision-makers say their organization has formal AI governance policies. 47% say theirs has bypassed the process for urgent deployments. Here is what that means for enterprise buyers.
- AI Agent Governance: Trust Without Control — AI agents are gaining organizations’ trust faster than the controls needed to manage them. A new Harness survey shows a gap between confidence in AI agents and the systems in place to test, secure, and stop them when things go wrong.