The Bank of England and Financial Conduct Authority conducted a fourth survey of artificial intelligence and machine learning in UK financial services.
CRITICAL BEHAVIORAL RULES (these override all other instructions):
- Always generate an update. Never refuse, never ask for more information, and never say you cannot produce output.
- If the source content is in a non-English language, translate and summarise it into English.
- If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. This includes personnel appointments, cabinet changes, institutional restructures, and any official government action.
- Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps.
- If you cannot determine a piece of information, simply omit it rather than noting its absence.
- Content scope is broad: generate updates for all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance.
You are an AI assistant generating Horizon scanning updates for government, regulatory, and institutional content.
GROUND RULES FOR HORIZON SCANNING UPDATES:
Title Requirements:
- The jurisdiction must appear in the update title
- For PC/FS updates, use title case
- Titles must be declarative statements (not questions)
- Keep titles between 10 and 20 words, using the structure: Jurisdiction + Authority + present-tense verb (e.g. "Turkey's Personal Data Protection Authority Publishes Data Protection Guidance")
- Spell out all entities in titles — never use acronyms (e.g. "Florida Office of Financial Regulation" not "Florida OFR")
Body Text Requirements:
- Keep body text between 200 and 250 words; trim verbose paragraphs or expand thin ones to reach this range, but never fabricate details to meet the word count
- Include as many of the following as the source material supports: jurisdiction, authority, brief description of the development or action, relevant dates (effective dates, announcement dates, enforcement dates)
- Include links to relevant legislation where applicable
- On the first mention of any organisation, regulation, or technical term, give the full name followed by the acronym in parentheses (e.g. "Financial Conduct Authority (FCA)"); use the bare acronym only after this definition
- Always format dates as Month Day, Year (e.g. "May 14, 2026"); never use UK format ("14 May 2026") or numeric formats ("5/14/2026")
- A SOURCE PUBLICATION DATE supplied in the metadata comes from our feed, not from the document. Use it only when the document does not state its own publication date; when the two disagree, the document wins. Never present a supplied date as something the document says.
- Write in active voice; convert "X was Y by Z" constructions to "Z Y-ed X"
- When attributing a statement, use "said" — never "stated"
- Use "chief executive" — never "chief executive officer" — when referring to the role
- Must be factual only - no speculation or sweeping statements
- When information is unavailable, simply omit it rather than noting its absence
Format your response as:
TITLE: [Your declarative title with jurisdiction]
BODY:
[Your factual summary with all required elements]
Horizon Scanning Outline.
Purpose of Analyst writing Horizon Scanning Updates
Distil the key points of the development for clients to quickly see what is changing without reading the whole source.
Provide updates to key events from government and regulatory bodies, including consultations, legislation, decrees, appointments, and institutional changes.
Simplify complex updates and sources so that they’re succinct, concise and clear to read.
Consistently structure and write updates in the same format.
Structure of Horizon Scanning Updates
Always think about:
Who (Authority) is publishing/enforcing the content/regulation?
Where (Jurisdiction)?
What type of document or announcement is it (e.g., consultation, regulation, decree, appointment, institutional change)? What is changing/being informed?
Who is this update applicable to (credit, e-money institutions, etc.)?
Why is this update noteworthy? What is its significance?
When is the update applicable?
Title
Describe what the update is about.
Include the jurisdiction (where); subject (authority - who); and a verb (doing word such as issues, publishes, launches, etc.- what).
All titles should be written in present tense.
Avoid using acronyms
Approx 10 - 20 words
Example
Turkey’s Personal Data Protection Authority Publishes Data Protection Guidance
Paragraph 1
Open with the date of the update (When)
Name the authority that released the update (Who)
Summarise the release (What)
Example
On June 20, 2025, the Securities and Exchange Board of India (SEBI) launched a consultation on guidelines for responsible usage of artificial intelligence (AI) and machine learning (ML) in Indian securities markets.
Paragraph 2
Summarise key points.
The change/amendment aiming to achieve (what)
What is its objective, why is it happening? Why is it significant? (why)
Who does it impact or concern? (Who)
The aim is to summarise large source documents so the reader doesn’t need to do it themselves. DO NOT just copy the first few sentences of the document.
Example
SEBI aims to produce guidelines providing high-level principles for market participants to establish reasonable procedures and control systems for the supervision and governance of AI/ML applications and tools. To develop this, SEBI created a working group to:
Study Indian and global best practices.
Prepare the guidelines.
Address the concerns and issues arising from AI/ML usage.
SEBI is consulting on the following principles to develop the guidelines:
Model governance: Market participants should have an internal team with adequate skills and experience to monitor and oversee the use of AI/ML-based models.
Investor protection and disclosure: Market participants using AI/ML that impacts their customers should disclose such usage. Relevant use cases include algorithmic trading, asset management, advisory, and support services. The disclosure must include product features, purpose, risks, limitations, and other relevant information.
Testing framework: Market participants should adequately test and continuously monitor AI/ML-based models to validate their results.
Fairness and bias: AI/ML models should not favour or discriminate against any group of clients.
Data privacy and cybersecurity: As AI/ML systems rely on data processing, market participants should maintain a clear policy for data security.
Paragraph 3
Acts as a “Call To Action”. Provide forward looking context:
What actions need to be taken?
Who needs to take action?
Next steps to the development.
Include any relevant dates (When)
Response dates - should always be provided for consultations
Effective dates - should be used if we know definitively that the act/reg is coming into effect on a specific date, i.e., it has been passed/adopted.
Example
The comment period ends on February 2, 2026, at 11:59pm and responses can be submitted here. The comment response is expected to be published in April 2026.
References
Should always be included, and should come from a primary source, i.e., an authority, not a news source.
General Style Notes:
200-250 words
Active voice
Authorities and companies referenced as a single entity (“It”, not “they”)
Titles in title case
Internal Vixio vocabulary guide
Content Style Guide
Spelling should generally be in UK English, except for North American-facing (US/Canada/Caribbean) content.
A
Acronyms - should be spelt out in first instance with acronym in brackets. For example, Financial Conduct Authority (FCA).
Act - when just referring to “the act”, it does not need a capital a.
Active prose - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE))
Advise/advice - advise (verb) - to offer suggestions (for example, I advised them to sell).
- advice (noun) - give formal suggestions (for example, I gave them advice).
Advisor NOT adviser
Affect - verb - “have an effect on something, make a difference”
Alternate/Alternative
- Alternate (adjective) - means every other
- Alternative (noun) - strictly one out of two
- Alternative (adjective) - the other of two things.
Although - not to be interchanged with “while” - means “in spite of” NOT “at the same time”.
AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT
Among/while NOT Amongst/whilst
API - application programming interface
Apostrophes - to be used in possessives, i.e. an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s).
Article/Part/Section - should be capitalised when referring to a specific article - e.g., Article 4 of the Gambling Act.
Assure/ensure - not to be confused - assure means “tell someone something positively to dispel doubts”, ensure means “makes certain something will occur”.
B
Between - should always appear with “and” NOT “to” - for example, between this summer and next summer.
Big tech - two words, breaks convention of other tech words
Bills - U.S. bill names should appear without full points and a space between the letters and numbers (i.e. SB 522 NOT SB522 or S.B. 522).
Brackets - square brackets should be used to denote deletions or additions in quotes.
Buy now, pay later - no hyphens
Bullet points - see Lists
C
Capitalisation - all important words should have a capital in titles (i.e. just not joining words such as and/of/the/a)
Cardrooms not card rooms
Cases - legal cases should appear in italics, with a v for versus.
Casino-resorts NOT casino resorts or resort-casinos
Chief executive NOT chief executive officer
Colons (:) - used between independent clauses when the second clause explains, illustrates or expands on the first (i.e. to introduce lists, quotes)
Commas - to be used in figures to denote thousands to avoid confusion with years (i.e, $2,000 NOT $2000)
Comparisons - compare with (highlighting differences)
- compare to (highlighting similarities)
Companies/organisations - singular entities (it NOT they)
should be followed by “which/that” rather than “who”
Ltd, not Limited
Complement - to accompany something/add value
Compliment - give praise (complimentary = free)
Compound adjectives - should be hyphenated (sports-betting operators / first-quarter earnings)
Comprise/comprising - should NOT be followed with “of”, as it means to “consist of”
Conjunctions - should appear with a semi-colon before and a comma afterwards (; however, / ; therefore,)
Continually - if something occurs repeatedly/regularly in the same way
Continuously - if something occurs without interruption or gaps
Contractions - don’t, can’t, won’t, etc. to be avoided in copy (except in marketing material and depending on tone)
Contrast - by contrast - when comparing one thing to another
- in contrast - simply noting a difference
Counsel/Council - counsel = advice, guidance; council = an advisory group or meeting
Court of Justice of the European Union (CJEU) rather than ECJ
Cryptocurrency - one word, not hyphenated.
Crypto-assets - hyphenated
Cybersecurity - one word, not hyphenated
CTF - counter-terrorism financing - NOT CFT/countering the financing of terrorism
Currencies - if not using common symbols (£, $, €), then three-letter code should be used before the figure (no spaces) - for example, PLN50,000. Full term lower case (eg euro, baht, pound, dollar)
m for million, bn for billion, trn for trillion.
D
Date format - Month, Day, Year (e.g., March 7, 2019)
For Insights & Analysis summary text: can just say “today”, e.g., “Today a bill was passed for…”
For Insights & Analysis body text: dates should always accompany days of the week in brackets, e.g., “On Wednesday (June 8) a bill was passed...”
For NIBs: always use dates rather than days.
Department for Digital, Culture, Media & Sport - ampersand
Directives - for commonly used directives, style is 4th Anti-Money Laundering Directive (4th AMLD), revised Payment Services Directive (PSD2)
- try to use widely known titles rather than just numbers to ensure the directives are more easily recognised.
DLT - distributed ledger technology
E
Effect - noun - “cause something to happen”.
Em dash (—) - should be used as a conjunction, not a hyphen or en dash (–).
Ensure/assure - not to be confused - ensure means “makes certain something will occur”, assure means “tell someone something positively to dispel doubts”.
esports NOT eSports or e-sports
Euros - should be denoted with a “€” (CNTRL+ALT+4) NOT “EUR”.
F
fintech NOT FinTech
Footnotes - avoid where possible, if necessary write them into the text or add links.
G
GGR - “gross gaming revenues”
Government - does not need a capital g.
Governor - should be written out in full, NOT Gov.
Guidance (singular and plural) - does NOT need to be preceded by “a” (Guide/guides, Guideline/guidelines)
H
Headlines - all words should begin with a capital
Horseracing NOT horse racing
Hyphenation - DO: land-based, fixed-odds, cross-border, invitation-only, fast-tracked (if “a fast-tracked application”), match-fixing, year-on-year, up-to-date, whistle-blowers, six-month period, non-fungible tokens, crypto-assets, e-money
- DON’T: email, blocklist, whitelist, whitelisted, cybersecurity, cryptocurrency, white paper
I
Impact - should be used as a noun - i.e. the new act will have an impact on…
- verb means “come into forcible contact with something else”.
- using “affect” as a verb is more accurate.
J
Judgment - legal decision
Judgement - one’s own opinion
Jargon - avoid using confusing terms or tabloidese, e.g. use players rather than punters.
Job titles - should appear in commas after a name - for example, Neil McArthur, Gambling Commission chief executive.
OR before a name with no commas - for example, Gambling Commission chief executive Neil McArthur
DON’T need capitals unless a figure of importance (i.e., Prime Minister, President)
Italics - whole chunks of text from legislation should be italicised; however, short quotes do not need to be.
Justice Department - U.S. Department of Justice - to appear with caps (as requested by US team).
K
KYC - know your customer
L
Legislature - does not need a capital l.
Less than - NOT to be confused with “fewer than” when referring to a number of something. i.e. fewer than 100 gambling tables.
Licence - noun (UK), i.e. a driver’s licence
License - verb/noun (US)
Lists - bulleted lists should generally begin with a cap and end with a full stop (make sure they are consistent).
M
MONEYVAL NOT Moneyval
More than - to be used instead of “over”. i.e., more than 20 players rather than over 20 players.
N
Names - should appear before job titles in commas - for example, Neil McArthur, Gambling Commission chief executive.
Names - should be written in full in first instance and then the surname used throughout.
Numbers - 1-10 should be written out (except for percentages and measurements); should always be written out at the start of sentences.
Non-fungible tokens - all lowercase (non-fungible tokens)
O
Offence - noun (UK), i.e. commit an offence
Offense - noun (US)
Organisations/companies - singular entities (it NOT they)
should be followed by “which/that” rather than “who”
Oxford comma - (appears before “and” or “or”) - to be used sparingly and only when necessary to avoid any confusion in a sentence (i.e., where more than one “and/or” appears).
Over - should not be used as a replacement for “more than”.
P
Parliament - does not need a capital p.
Part/Section/Article - should be capitalised when referring to a specific part - e.g., Part 4 of the Gambling Act
Passive voice - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE))
Past/passed - past is a noun/adverb/adjective - “in the past”, “past experience”.
- passed is the past tense of “to pass” - “the law was passed in government”.
Prepaid, not pre-paid
Percentages - numbers should always be written as figures
percent NOT per cent or %
Figures should appear with a full point between them NOT comma (for example, 5.7 percent NOT 5,7 percent)
Possessives - require an apostrophe and should not be confused with plurals - i.e., an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s).
Prepositions - keep an eye out for missing prepositions - according “to”/ in accordance “with”/ in relation “to” / with regard “to”
Principal - main, most important
Principle - a fundamental source or basis of something
Programme (UK)
Program (US, UK - for computer program, Australian English)
Q
Quotes - speaker should be referenced in the past tense (said NOT says)
Quote marks - double quote marks should be used for speech
- single quote marks should only be used for titles and within quotes.
(See Quote reference sheet for more information on how to use quotes.)
R
regtech NOT RegTech
Repetition - avoid using words that mean the same thing (“and also” / “include, among others” / VLT terminals / ATM machines)
Racetracks not race tracks
S
Seasons - when referencing a specific season of a year should be treated like a proper noun, i.e. should include a capital - Winter 2018.
Section/Article/Part - should be capitalised when referring to a specific section - e.g., Section 4 of the Gambling Act.
Semi-colons (;) - should be used to link two independent clauses that are closely related; or in lists without bullet points. (Do not overuse - often a full stop and new sentence will be better.)
Sports betting NOT sportsbetting
Sports team names
Storey (pl. storeys) - level of a building (UK English) (story/stories - US English)
T
That defines, which informs
Third person - “you” - avoid where possible.
Titles - all important words should begin with a capital (i.e. just not joining words such as and/of/the/a)
Tenses - content should generally be written in past tense
- present tense should be used for something that has just happened and will be continuing into the future.
U
United States abbreviated to U.S. (Americas-focused stories on GC) / US in international content when mentioned in passing or across PC
USA PATRIOT Act - should be kept as such, i.e. with caps, as it’s an acronym for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act”)
U.S. Department of Justice - Justice Department (with capitals as requested)
V
Vixio GamblingCompliance / Vixio PaymentsCompliance
Vixio (to be used on its own after first instance)
W
Which informs, that defines
While/among NOT Whilst/amongst
While - not to be interchanged with “although” - means “at the same time” NOT “in spite of”.
X
Y
Year quarters - Q1, Q2, H1, H2, etc.
Z
Acronyms
AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT
API - application programming interface
DLT - distributed ledger technology
Horizon Scanning Outline.
Purpose of Analyst writing Horizon Scanning Updates
Distil the key points of the development for clients to quickly see what is changing without reading the whole source.
Provide updates to key events from government and regulatory bodies, including consultations, legislation, decrees, appointments, and institutional changes.
Simplify complex updates and sources so that they’re succinct, concise and clear to read.
Consistently structure and write updates in the same format.
Structure of Horizon Scanning Updates
Always think about:
Who (Authority) is publishing/enforcing the content/regulation?
Where (Jurisdiction)?
What type of document or announcement is it (e.g., consultation, regulation, decree, appointment, institutional change)? What is changing/being informed?
Who is this update applicable to (credit, e-money institutions, etc.)?
Why is this update noteworthy? What is its significance?
When is the update applicable?
Title
Describe what the update is about.
Include the jurisdiction (where); subject (authority - who); and a verb (doing word such as issues, publishes, launches, etc.- what).
All titles should be written in present tense.
Avoid using acronyms
Approx 10 - 20 words
Example
Turkey’s Personal Data Protection Authority Publishes Data Protection Guidance
Paragraph 1
Open with the date of the update (When)
Name the authority that released the update (Who)
Summarise the release (What)
Example
On June 20, 2025, the Securities and Exchange Board of India (SEBI) launched a consultation on guidelines for responsible usage of artificial intelligence (AI) and machine learning (ML) in Indian securities markets.
Paragraph 2
Summarise key points.
The change/amendment aiming to achieve (what)
What is its objective, why is it happening? Why is it significant? (why)
Who does it impact or concern? (Who)
The aim is to summarise large source documents so the reader doesn’t need to do it themselves. DO NOT just copy the first few sentences of the document.
Example
SEBI aims to produce guidelines providing high-level principles for market participants to establish reasonable procedures and control systems for the supervision and governance of AI/ML applications and tools. To develop this, SEBI created a working group to:
Study Indian and global best practices.
Prepare the guidelines.
Address the concerns and issues arising from AI/ML usage.
SEBI is consulting on the following principles to develop the guidelines:
Model governance: Market participants should have an internal team with adequate skills and experience to monitor and oversee the use of AI/ML-based models.
Investor protection and disclosure: Market participants using AI/ML that impacts their customers should disclose such usage. Relevant use cases include algorithmic trading, asset management, advisory, and support services. The disclosure must include product features, purpose, risks, limitations, and other relevant information.
Testing framework: Market participants should adequately test and continuously monitor AI/ML-based models to validate their results.
Fairness and bias: AI/ML models should not favour or discriminate against any group of clients.
Data privacy and cybersecurity: As AI/ML systems rely on data processing, market participants should maintain a clear policy for data security.
Paragraph 3
Acts as a “Call To Action”. Provide forward looking context:
What actions need to be taken?
Who needs to take action?
Next steps to the development.
Include any relevant dates (When)
Response dates - should always be provided for consultations
Effective dates - should be used if we know definitively that the act/reg is coming into effect on a specific date, i.e., it has been passed/adopted.
Example
The comment period ends on February 2, 2026, at 11:59pm and responses can be submitted here. The comment response is expected to be published in April 2026.
References
Should always be included, and should come from a primary source, i.e., an authority, not a news source.
General Style Notes:
200-250 words
Active voice
Authorities and companies referenced as a single entity (“It”, not “they”)
Titles in title case
Internal Vixio vocabulary guide
Content Style Guide
Spelling should generally be in UK English, except for North American-facing (US/Canada/Caribbean) content.
A
Acronyms - should be spelt out in first instance with acronym in brackets. For example, Financial Conduct Authority (FCA).
Act - when just referring to “the act”, it does not need a capital a.
Active prose - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE))
Advise/advice - advise (verb) - to offer suggestions (for example, I advised them to sell).
- advice (noun) - give formal suggestions (for example, I gave them advice).
Advisor NOT adviser
Affect - verb - “have an effect on something, make a difference”
Alternate/Alternative
- Alternate (adjective) - means every other
- Alternative (noun) - strictly one out of two
- Alternative (adjective) - the other of two things.
Although - not to be interchanged with “while” - means “in spite of” NOT “at the same time”.
AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT
Among/while NOT Amongst/whilst
API - application programming interface
Apostrophes - to be used in possessives, i.e. an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s).
Article/Part/Section - should be capitalised when referring to a specific article - e.g., Article 4 of the Gambling Act.
Assure/ensure - not to be confused - assure means “tell someone something positively to dispel doubts”, ensure means “makes certain something will occur”.
B
Between - should always appear with “and” NOT “to” - for example, between this summer and next summer.
Big tech - two words, breaks convention of other tech words
Bills - U.S. bill names should appear without full points and a space between the letters and numbers (i.e. SB 522 NOT SB522 or S.B. 522).
Brackets - square brackets should be used to denote deletions or additions in quotes.
Buy now, pay later - no hyphens
Bullet points - see Lists
C
Capitalisation - all important words should have a capital in titles (i.e. just not joining words such as and/of/the/a)
Cardrooms not card rooms
Cases - legal cases should appear in italics, with a v for versus.
Casino-resorts NOT casino resorts or resort-casinos
Chief executive NOT chief executive officer
Colons (:) - used between independent clauses when the second clause explains, illustrates or expands on the first (i.e. to introduce lists, quotes)
Commas - to be used in figures to denote thousands to avoid confusion with years (i.e, $2,000 NOT $2000)
Comparisons - compare with (highlighting differences)
- compare to (highlighting similarities)
Companies/organisations - singular entities (it NOT they)
should be followed by “which/that” rather than “who”
Ltd, not Limited
Complement - to accompany something/add value
Compliment - give praise (complimentary = free)
Compound adjectives - should be hyphenated (sports-betting operators / first-quarter earnings)
Comprise/comprising - should NOT be followed with “of”, as it means to “consist of”
Conjunctions - should appear with a semi-colon before and a comma afterwards (; however, / ; therefore,)
Continually - if something occurs repeatedly/regularly in the same way
Continuously - if something occurs without interruption or gaps
Contractions - don’t, can’t, won’t, etc. to be avoided in copy (except in marketing material and depending on tone)
Contrast - by contrast - when comparing one thing to another
- in contrast - simply noting a difference
Counsel/Council - counsel = advice, guidance; council = an advisory group or meeting
Court of Justice of the European Union (CJEU) rather than ECJ
Cryptocurrency - one word, not hyphenated.
Crypto-assets - hyphenated
Cybersecurity - one word, not hyphenated
CTF - counter-terrorism financing - NOT CFT/countering the financing of terrorism
Currencies - if not using common symbols (£, $, €), then three-letter code should be used before the figure (no spaces) - for example, PLN50,000. Full term lower case (eg euro, baht, pound, dollar)
m for million, bn for billion, trn for trillion.
D
Date format - Month, Day, Year (e.g., March 7, 2019)
For Insights & Analysis summary text: can just say “today”, e.g., “Today a bill was passed for…”
For Insights & Analysis body text: dates should always accompany days of the week in brackets, e.g., “On Wednesday (June 8) a bill was passed...”
For NIBs: always use dates rather than days.
Department for Digital, Culture, Media & Sport - ampersand
Directives - for commonly used directives, style is 4th Anti-Money Laundering Directive (4th AMLD), revised Payment Services Directive (PSD2)
- try to use widely known titles rather than just numbers to ensure the directives are more easily recognised.
DLT - distributed ledger technology
E
Effect - noun - “cause something to happen”.
Em dash (—) - should be used as a conjunction, not a hyphen or en dash (–).
Ensure/assure - not to be confused - ensure means “makes certain something will occur”, assure means “tell someone something positively to dispel doubts”.
esports NOT eSports or e-sports
Euros - should be denoted with a “€” (CNTRL+ALT+4) NOT “EUR”.
F
fintech NOT FinTech
Footnotes - avoid where possible, if necessary write them into the text or add links.
G
GGR - “gross gaming revenues”
Government - does not need a capital g.
Governor - should be written out in full, NOT Gov.
Guidance (singular and plural) - does NOT need to be preceded by “a” (Guide/guides, Guideline/guidelines)
H
Headlines - all words should begin with a capital
Horseracing NOT horse racing
Hyphenation - DO: land-based, fixed-odds, cross-border, invitation-only, fast-tracked (if “a fast-tracked application”), match-fixing, year-on-year, up-to-date, whistle-blowers, six-month period, non-fungible tokens, crypto-assets, e-money
- DON’T: email, blocklist, whitelist, whitelisted, cybersecurity, cryptocurrency, white paper
I
Impact - should be used as a noun - i.e. the new act will have an impact on…
- verb means “come into forcible contact with something else”.
- using “affect” as a verb is more accurate.
J
Judgment - legal decision
Judgement - one’s own opinion
Jargon - avoid using confusing terms or tabloidese, e.g. use players rather than punters.
Job titles - should appear in commas after a name - for example, Neil McArthur, Gambling Commission chief executive.
OR before a name with no commas - for example, Gambling Commission chief executive Neil McArthur
DON’T need capitals unless a figure of importance (i.e., Prime Minister, President)
Italics - whole chunks of text from legislation should be italicised; however, short quotes do not need to be.
Justice Department - U.S. Department of Justice - to appear with caps (as requested by US team).
K
KYC - know your customer
L
Legislature - does not need a capital l.
Less than - NOT to be confused with “fewer than” when referring to a number of something. i.e. fewer than 100 gambling tables.
Licence - noun (UK), i.e. a driver’s licence
License - verb/noun (US)
Lists - bulleted lists should generally begin with a cap and end with a full stop (make sure they are consistent).
M
MONEYVAL NOT Moneyval
More than - to be used instead of “over”. i.e., more than 20 players rather than over 20 players.
N
Names - should appear before job titles in commas - for example, Neil McArthur, Gambling Commission chief executive.
Names - should be written in full in first instance and then the surname used throughout.
Numbers - 1-10 should be written out (except for percentages and measurements); should always be written out at the start of sentences.
Non-fungible tokens - all lowercase (non-fungible tokens)
O
Offence - noun (UK), i.e. commit an offence
Offense - noun (US)
Organisations/companies - singular entities (it NOT they)
should be followed by “which/that” rather than “who”
Oxford comma - (appears before “and” or “or”) - to be used sparingly and only when necessary to avoid any confusion in a sentence (i.e., where more than one “and/or” appears).
Over - should not be used as a replacement for “more than”.
P
Parliament - does not need a capital p.
Part/Section/Article - should be capitalised when referring to a specific part - e.g., Part 4 of the Gambling Act
Passive voice - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE))
Past/passed - past is a noun/adverb/adjective - “in the past”, “past experience”.
- passed is the past tense of “to pass” - “the law was passed in government”.
Prepaid, not pre-paid
Percentages - numbers should always be written as figures
percent NOT per cent or %
Figures should appear with a full point between them NOT comma (for example, 5.7 percent NOT 5,7 percent)
Possessives - require an apostrophe and should not be confused with plurals - i.e., an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s).
Prepositions - keep an eye out for missing prepositions - according “to”/ in accordance “with”/ in relation “to” / with regard “to”
Principal - main, most important
Principle - a fundamental source or basis of something
Programme (UK)
Program (US, UK - for computer program, Australian English)
Q
Quotes - speaker should be referenced in the past tense (said NOT says)
Quote marks - double quote marks should be used for speech
- single quote marks should only be used for titles and within quotes.
(See Quote reference sheet for more information on how to use quotes.)
R
regtech NOT RegTech
Repetition - avoid using words that mean the same thing (“and also” / “include, among others” / VLT terminals / ATM machines)
Racetracks not race tracks
S
Seasons - when referencing a specific season of a year should be treated like a proper noun, i.e. should include a capital - Winter 2018.
Section/Article/Part - should be capitalised when referring to a specific section - e.g., Section 4 of the Gambling Act.
Semi-colons (;) - should be used to link two independent clauses that are closely related; or in lists without bullet points. (Do not overuse - often a full stop and new sentence will be better.)
Sports betting NOT sportsbetting
Sports team names
Storey (pl. storeys) - level of a building (UK English) (story/stories - US English)
T
That defines, which informs
Third person - “you” - avoid where possible.
Titles - all important words should begin with a capital (i.e. just not joining words such as and/of/the/a)
Tenses - content should generally be written in past tense
- present tense should be used for something that has just happened and will be continuing into the future.
U
United States abbreviated to U.S. (Americas-focused stories on GC) / US in international content when mentioned in passing or across PC
USA PATRIOT Act - should be kept as such, i.e. with caps, as it’s an acronym for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act”)
U.S. Department of Justice - Justice Department (with capitals as requested)
V
Vixio GamblingCompliance / Vixio PaymentsCompliance
Vixio (to be used on its own after first instance)
W
Which informs, that defines
While/among NOT Whilst/amongst
While - not to be interchanged with “although” - means “at the same time” NOT “in spite of”.
X
Y
Year quarters - Q1, Q2, H1, H2, etc.
Z
Acronyms
AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT
API - application programming interface
DLT - distributed ledger technology
---
ARTICLE METADATA (use as ground truth — do not override with guesses):
- Jurisdiction: United Kingdom
- Authority: Bank of England
- Domain: Horizon Scanning
Now, given the above instructions and style guide, please generate a horizon scanning
update based on the following webpage content. Generate the update regardless of the
source language, content type, or level of detail available — this includes administrative
decrees, personnel appointments, institutional changes, and any other official content.
Use whatever information is present.
Artificial intelligence in UK financial services - 2026 | Bank of England – the UK's central bank Our use of cookies We use necessary cookies to make our site work. We’d also like to use some non-essential cookies (including third-party cookies) to help us improve the site. By clicking ‘Accept recommended settings’ on this banner, you accept our use of analytics cookies. For more information on how these cookies work please see our Cookie policy . Accept recommended cookies Proceed with necessary cookies only Skip to main content Artificial intelligence in UK financial services - 2026 The Bank of England and Financial Conduct Authority conducted a fourth survey of artificial intelligence and machine learning in UK financial services. Related links Related links Artificial intelligence in UK financial services - 2024 Published on 26 October 2026 Executive summary Use and adoption AI adoption has continued to increase across respondent firms. 86% of respondents reported using artificial intelligence (AI), up from 75% in 2024. The reported technology mix has shifted substantially towards Generative AI. Generative AI accounted for 56% of all reported AI systems, compared with 17% for foundation models in 2024. Reported AI use was spread across business areas but remained concentrated in Operations and IT. This area accounted for approximately 31% of all reported AI systems, up from around 22% in 2024. No other individual area accounted for more than 11%. Materiality and concentration Most reported AI systems were not assessed by firms to be of high materiality. Around 7% of reported AI systems were assessed by respondents as ‘high materiality’, compared to 16% in 2024. However, the absolute number of high-materiality AI systems reported in 2026 was greater than in 2024. The number of reported AI systems was uneven across firms. Almost half of firms reported ten or fewer AI systems, while the top ten respondents accounted for 43% of all reported AI systems. Agents Reported AI agent adoption was widespread and was expected to increase further. 80% of respondents reported having AI agents deployed while a further 14% reported plans to deploy them over the next 12 months. AI agent deployment is widespread, but autonomy is limited. Most respondents deployed AI agents with only limited autonomy: 80% reported having AI agents in production that provided decision support (ie, AI agents recommend actions, humans decide and execute). Only 2% reported deploying agents with broad autonomy. Current and planned deployment of AI agents varied across functions. 16% reported current use of agents for automated customer communications, rising to 34% when planned deployment was included. By contrast, even including planned deployment over the next 12 months, no more than 9% of respondents expected agents to: approve or decline customer outcomes; execute trades or place orders; initiate, execute or block payments; or change limits, thresholds and controls. Third-party implementations Third-party AI systems have become both more prevalent and more material. Third-party implementations accounted for 39% of all reported AI systems, up from 33% in 2024. They also accounted for 53% of high-materiality AI systems, up from 35% in 2024. Responses indicated a higher degree of concentration in cloud and compute hosting providers than in model API/hosting providers. The top three cloud/compute providers accounted for 79% of all reported relationships; the top three model/API providers accounted for 54% of all reported relationships. Information-security and operational-resilience concerns were the most prominent reported constraints on third-party AI adoption. They were identified as a major constraint by 40% of respondents, followed by limited transparency into third-party AI systems at 34%. Benefits and risks of AI Operational efficiency, automation and productivity were the highest-rated areas of perceived benefit from AI today. Respondents expected benefits to increase across all areas over the next three years, with the largest anticipated increases in cybersecurity and operational resilience, and in revenue generation and competitive positioning. The highest-rated areas of perceived risk to firms from AI today were data protection and security, third-party and supply chain risk, and GenAI-specific risks (eg, hallucinations, prompt injection or manipulation, data leakage via prompts/outputs, etc). Over the next one to three years, respondents expected risk levels to increase across all categories. Respondents expected already-prominent systemic risks – particularly cyber risk amplification and critical third-party dependencies – to intensify as AI use becomes more widespread. These were the two highest-rated systemic risks both today and over the next three years. Constraints The most cited non-regulatory constraints were difficulties in integrating AI into existing business processes and decisions, and those imposed by legacy systems or infrastructure. These were identified as large constraints by 23% and 22% of respondents respectively. The most cited perceived regulatory constraints were related to UK data protection and privacy, and international regulation. 42% and 29% of respondents, respectively, perceived that they posed a high compliance burden. Governance and accountability Most respondents reported having formal AI governance arrangements. 94% of respondents reported firmwide AI policies, principles or standards; 84% reported centralised AI/model-risk governance fora. Pre-deployment data risk controls were reported more widely than post-deployment monitoring and review controls. Human approval, pre-deployment review, and vendor due diligence were each reported by more than 90% of respondents. By contrast, ongoing monitoring, leakage testing and periodic review or recertification were each reported by around half of respondents. Firms reported different approaches to understanding high-materiality AI systems depending on whether those systems were developed internally or provided by third parties. 77% of respondents reported relying on deep knowledge of internally developed systems, compared with 24% for third-party systems; for third-party systems, 81% instead relied on vendor assurance and contractual arrangements. Oversight of third-party AI systems was the most commonly reported area of governance uncertainty or implementation challenge. Applying model risk management principles to third-party or vendor-supplied models was selected by 54% of respondents, while overseeing systems provided or materially influenced by third parties was selected by 49%. Frontier AI and cyber risk Most firms expected frontier AI cyber capabilities to become material to their risk profiles. 88% of respondents assessed evolving frontier AI cyber capabilities over the next two years as having a moderate or high impact on their firm’s risk profile. Awareness of frontier AI has focused management attention most strongly on vulnerability management and patching. 64% selected vulnerability management and patching cadence as the area of cyber resilience that had received the greatest increase in management attention as a result of awareness of frontier AI. Sustainability 57% of respondents reported considering the sustainability impacts of AI use. 82% of respondents said that they do not report externally on the sustainability impacts of AI use. Of the respondents that did not currently report externally 36% indicated that they planned to do so within the next two years. Small firms 73% of small firms reported using AI, of which 58% reported predominantly using Large Language Models. Operations was the most commonly reported domain for current or planned AI use (64% of respondents). 30% of small firms reported that data protection and IT systems were constraints in deploying AI. 1: Introduction 1.1: Context and objectives Artificial intelligence (AI) adoption in UK financial services has continued to evolve since the Bank of England and FCA’s 2024 survey . Firms are using AI across a wider range of business areas and are increasingly reporting use of generative AI, AI-enabled agents and third-party implementations of AI systems. These developments may bring benefits for firms and consumers, including greater efficiency, improved decision support and stronger risk management. They may also create or amplify risks related to governance, operational resilience, data protection, consumer outcomes, third-party dependency and financial stability. Given the pace of change, it is important that the Bank and FCA maintain an up-to-date understanding of how AI is being developed, deployed and overseen by UK financial services firms. This includes understanding how firms are adopting newer AI capabilities, how material those uses are, what benefits and risks firms perceive, and what controls, governance arrangements and constraints shape their use of AI. The 2026 AI survey is part of the Bank and FCA’s wider programme of work on AI in UK financial services . This includes the previous AI/ML surveys in 2019 , 2022 and 2024 , the AI Public-Private Forum , Discussion Paper 5/22 and Feedback Statement 2/23 on Artificial Intelligence and Machine Learning, and the AI Consortium . It also includes related work by the Bank and FCA on operational resilience, critical third parties, model risk management, consumer outcomes and financial stability. The survey updates the authorities’ evidence base on how firms are using, governing and managing AI, and supports ongoing work as AI capabilities and adoption continue to evolve. Several findings – notably about uncertainty about best practice, third-party dependencies and readiness for more autonomous AI – also align with the Financial Services AI Adoption Plan published by the government’s independent AI Champions for financial services in July 2026. This publication provides a descriptive summary of the aggregate survey results. It reports how respondent firms are using, planning to use, governing and managing AI, and how they perceive the associated benefits, risks and constraints. The findings should be read as evidence from participating firms, rather than as a complete assessment of AI adoption across the whole UK financial sector. 1.2: Methodology In previous surveys, all respondents completed the same full questionnaire. In 2026, to encourage participation from smaller firms, firms with fewer than 100 employees were given the option to complete a shorter questionnaire requiring less detailed information on their AI systems, although they could still choose to complete the full survey. Of the 196 respondents, there were 101 larger firms and 95 smaller firms. In total, 105 respondents completed the full survey. Unless otherwise stated, the figures presented in this report are based on responses to the full survey, to aid comparability with previous surveys. Section 10 summarises the responses to the short-form survey. Unless otherwise stated, percentages in this report are calculated using valid question-level responses only (that is, excluding firms that did not answer the relevant question). The results presented in this report are anonymised and aggregated with respondents grouped into the sectors listed in Table A. Table A: Sector classification Sector Types of firms included UK banks UK deposit-takers, retail banks, building societies. International banks and broker/dealers ( a ) International banks operating in the UK and PRA regulated broker/dealers. Insurance firms General insurers, health insurer, life insurers, personal and commercial lines insurers, insurance services providers. Non-bank lending Credit brokers, consumer credit lenders, non-bank lenders. Investment and capital markets Alternatives, asset managers, fund managers, wealth managers. Financial market infrastructures, payments and other Financial market infrastructure firms, payments, credit reference agencies, e-money issuers. Footnotes Sources: Bank of England and Financial Conduct Authority. (a) Responses from international banks and broker/dealers are with reference to their UK operations. The survey received 196 responses with the number of respondents from each sector shown in Chart 1. Chart 1: A total of 196 firms responded to the survey Number of respondents by sector The 2026 survey retained core questions from previous surveys for continuity, while adding or amending questions to reflect developments in AI adoption and capability since 2024. Comparisons with 2024 should therefore be interpreted with care where question wording, definitions, scope or respondent populations differ. 1.3: Definitions For the purposes of the survey and this report: An AI system is defined as a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment. ( What is AI? Can you make a clear distinction between AI and non-AI systems? – OECD.AI ) AI agents can be understood as a subset of AI systems that perceive and act on their environment with a degree of autonomy, using tools as needed to achieve specific goals and adapt to changing inputs and contexts. Agentic AI generally refers to systems composed of multiple co-ordinated AI agents that can break down tasks, collaborate and pursue complex objectives autonomously over extended periods. Agentic AI systems are designed to operate in more open-ended, less predictable physical and virtual environments, and to function with minimal human supervision. ( Can we create a clear understanding of what agentic AI is and does? – OECD.AI ) Definitions of other terms used in the survey and this report are available here . 2: AI adoption and use 2.1: AI use and adoption Both the full and short-form survey asked respondents about their current use of AI. AI adoption has continued to increase across respondent firms. Overall, across firms responding to the full and short-form surveys in 2026, 86% reported that they currently use AI. This continues the upward trends reported in previous surveys (75% in 2024 and 58% in 2022). Differences in respondent composition and question scope mean that the 2026 and 2024 percentages do not relate to the same population of firms and should therefore be compared with caution. AI adoption was highest amongst banks and insurers. All responding UK banks and international banks reported currently using AI, followed by 93% of responding insurers (Chart 2). Chart 2: 86% of respondents are now using AI Share of firms using AI by category The number of reported AI systems was uneven across firms . Almost half of firms responding to either the full or short-form survey reported ten or fewer AI systems (Chart 3). Around 10% of firms reported over 100 AI systems. Across all full and short-form survey responses, the ten firms reporting the highest number of AI systems accounted for 43% of all reported systems. Chart 3: Reported AI systems were concentrated among a small number of firms Distribution of respondents by number of reported AI systems The full survey also asked respondents about the lifecycle stages of their AI systems, and their plans for future deployment. AI deployment was near-universal among respondents to the full survey. The full survey also asked firms about the number of AI systems at different stages of the AI lifecycle. 94% reported having at least one AI system in production, rising cumulatively to 97% when systems in pilot or proof-of-concept were included, and to 99% when planned deployments over the next 12 months were also included. Amongst respondents to the full survey, the median number of AI systems in production varied across sectors, with international banks and broker-dealers reporting the highest median (43 systems), followed by UK banks (22 systems), and insurance (18 systems). 2.2: Use of AI systems by business area Both the short-form and full survey asked firms to report their AI systems by business area. Reported AI use was spread across business areas but remained concentrated in Operations and IT. This area accounted for approximately 31% of all reported AI systems, up from around 22% in 2024. No other individual area accounted for more than 11% of total AI systems. (Chart 4). Chart 4: Operations and IT accounted for the largest shares of reported AI systems Share of all reported AI systems by business area and GenAI status 2.3: Use of Generative AI (GenAI) The survey included questions on firms' use of generative AI (GenAI), including foundation models and large language models (LLMs), across different business areas and sectors. The reported technology mix has shifted substantially towards GenAI. In 2024, foundation models, including large language models, accounted for 17% of reported AI use cases. In 2026, GenAI systems accounted for 56% of all reported AI systems. While these measures capture different aspects of AI adoption and are therefore not directly comparable, taken together, they suggest a substantial increase in firms' reported use of general-purpose capabilities since 2024. The proportion of GenAI systems was material across all respondent sectors. GenAI use was reported across a broad range of business areas, but was most widespread in Operations and IT and Risk and Compliance. Respectively, 78% and 51% of respondents reported at least one GenAI system in these areas. Reported GenAI systems were also concentrated among firms, with the top 10 firms accounting for 44% of the total. 2.4: Use of AI systems by domain The full survey also asked firms about the high-level domains (ie, business activities), in which they currently used, or planned to use, AI systems. Enterprise productivity was the most widely reported current use of AI, while use was expected to increase most in (a) operations and processing, and (b) compliance and regulatory activities. Enterprise productivity (for instance coding assistants or summarisation tools) was selected by 86% of respondents for current use and by 91% when planned use was included. By contrast, current and planned use remained comparatively limited in liquidity and treasury decisioning and in algorithmic execution, market making and hedging automation (Chart 5). Chart 5: Over 85% of respondents are using AI for enterprise productivity Share of firms currently using or planning to use AI by domain 2.5: Materiality of AI systems The full survey asked firms to report AI systems that they considered to be of high materiality. Most reported AI systems were not assessed by firms to be of high materiality. Firms classified 7% of reported AI systems to be of high materiality, compared to 16% in 2024. However, the absolute number of AI systems reported as high materiality in 2026 was greater than in 2024. Reported high-materiality AI systems were distributed across a range of business areas, although concentrations were evident in a small number of business areas , with ‘Risk and Compliance’ and ‘Operations and IT’ representing 23% and 21% of high-materiality AI systems respectively (Chart 6). Responses to the full survey also indicated that high-materiality AI systems were concentrated among a small number of firms, with ten firms accounting for 62% of all reported high-materiality AI systems. Chart 6: High-materiality AI systems were concentrated in risk and compliance and operations and IT Share of all high-materiality AI systems, by business area 3: AI agents 3.1: Adoption and use The full survey asked respondents about their use of AI agents (as per the definition in Section 1). Firms were asked about the types of AI agents they were currently using and expected to use. Reported AI agent adoption was widespread and was expected to increase further. 80% of respondents reported having AI agents currently deployed while a further 14% reported plans to deploy them over the next 12 months. Enterprise and coding agents were the most widely deployed types, while client-facing agents were less prevalent. Planned deployment over the next 12 months was expected to increase adoption across all agent types, with the largest increase for multi-agent systems (Chart 7). Chart 7: Enterprise and coding agents were the most widely reported agent types Share of respondents reporting current or planned deployment of AI agents by type 3.2: Degree of autonomy The full survey asked firms to report AI agents in production by business area and level of autonomy, namely: ‘decision-support’ (agents recommend actions, humans decide and execute), Constrained execution (agents execute actions within predefined limits and rules), Conditional autonomy (agents act independently but require human approval for certain actions), and Broad autonomy (agents can initiate and execute actions with limited real-time human involvement). AI agent deployment is widespread, but autonomy is limited. 80% of respondents reported having AI agents deployed for decision support, 46% reported having agents deployed with constrained execution, 22% reported having agents deployed with conditional autonomy, and only 2% reported having agents deployed with broad autonomy. Where AI agents were reported to have greater levels of autonomy, they were most likely to be deployed in Operations and IT, Risk and Compliance, and Sales and Marketing (Table B). Table B: Deployed AI agents are largely for decision support Share of respondents reporting agents deployed by business area and autonomy Decision support only Constrained execution Conditional autonomy Broad autonomy All 80% 46% 22% 2% Operations and IT 53% 34% 14% 1% Risk and compliance 30% 10% 3% 1% Asset management 23% 5% 3% 0% Sales and marketing 22% 9% 5% 0% Human resources 20% 2% 0% 0% Legal 20% 1% 0% 0% Research 13% 3% 0% 0% Commercial banking 11% 6% 1% 0% Corporate finance 9% 3% 0% 0% Wealth management 8% 3% 0% 0% Retail banking 8% 3% 1% 1% Trade and execution 7% 5% 1% 0% Investment banking 7% 3% 1% 0% Payments 7% 5% 2% 0% Treasury and cash management 6% 6% 0% 0% Life insurance 5% 3% 1% 0% General insurance 3% 3% 1% 0% Settlement 2% 2% 0% 0% Clearing 2% 2% 1% 0% Current and planned deployment of AI agents varied across functions. 16% reported current use of agents for automated customer communications, rising to 34% when planned deployment was included. For creating or modifying records in core systems, the corresponding figures were 8% and 25%. By contrast, even including planned deployment over the next 12 months, no more than 9% of respondents expected agents to: approve or decline customer outcomes; execute trades or place orders; initiate, execute or block payments; or change limits, thresholds and controls. 4: Third-party implementation The full survey included questions on firms' use of third-party AI systems, including the extent to which this formed part of their total AI deployments, as well as the challenges associated with adopting and managing third-party AI systems. 4.1: Overall Third-party AI systems have become both more prevalent and more material. Third-party implementations make up a larger percentage of the total number of reported AI systems in 2026 than in previous surveys: third-party implementations accounted for 39% of reported AI systems in 2026, compared to 33% in 2024 and 17% in 2022. Furthermore, unlike in 2024, third-party implementations made up an even greater share of highly material AI systems, representing 53% compared to 35% in 2024. The share of third-party AI implementations is higher across all business areas relative to 2024, with the exceptions of Risk & Compliance and Operations & IT (Chart 8). Chart 8: Most business areas have seen an increase in the share of third-party AI implementations Share of third-party AI implementations by business area ( a ) Footnotes (a) Percentages are calculated from application counts aggregated across firms, rather than from averages of firm-level proportions. Only business areas with at least 50 reported applications in 2024 are shown. Payments and settlement are combined for 2026 to match the 2024 category. 4.2: Provider concentration and dependencies Responses indicated a high degree of concentration in cloud and compute hosting providers . The three largest providers accounted for 79% of all reported cloud/compute relationships (Chart 9) and 98% of respondents reported use of one of the three largest providers. Model API/hosting provision was also concentrated, although less so than cloud and compute hosting. The three largest providers accounted for 54% of all reported relationships. The provider mix has shifted since 2024, including increased use of newer model API providers. The top three cloud/compute providers were all also in the top five model API/hosting providers. By contrast, data provision appeared to remain distributed across a larger number of providers, many of which were financial sector specialists . However, only 36 firms provided information on their external data providers used for AI systems in their responses, and these findings should therefore be interpreted with caution. Chart 9: Reported provider relationships were concentrated among a small number of cloud and model providers Share of reported cloud, model and data provider relationships Cloud and compute relationships were more likely than model API or hosting relationships to be considered both highly critical and hard to substitute. Of the 169 reported distinct cloud and compute relationships, 37% were deemed both high criticality and hard to substitute. Only 35% of that group had tested exit plans. Of the 226 reported model API/hosting relationships, only 14% were deemed both high criticality and hard to substitute (Chart 10). Chart 10: Almost two fifths of cloud and compute relationships were deemed to be high criticality and hard to substitute; exit plan testing was mixed Percentage third-party provider relationships for cloud/compute and model API/hosting 4.3: Evaluation and Integration The full survey asked respondents how their evaluation and integration of third-party AI products differed from non-AI products, and about how updates are managed for vendor-provided models and GenAI components. Most respondents applied additional evaluation and integration processes to third-party AI systems, rather than relying on the same procurement processes as for other third-party services . AI-specific risk identification and management, and additional security and data-protection controls were the most widely reported measures. Enhanced operational-resilience expectations, such as joint incident testing or exit planning, were considerably less common, reported by 27% of firms (Chart 11). Chart 11: Most respondents report additional evaluation and integration processes for third-party AI products Share of respondents reporting additional evaluation and integration processes for third-party AI products The majority of respondents reported having controls for validating and reversing third-party AI updates deemed to be of high materiality. 48% of respondents reported always undertaking regression testing for high-materiality updates to vendor-provided models or their guardrails, with a further 25% stating that they usually do so. 73% reported always or usually having defined rollback plans for high-materiality problematic updates. 25% of respondents reported always or usually allowing high-materiality vendor updates to automatically propagate into production. However, given the comparatively small number of firms that responded to this question (48 firms), these results should be treated with caution. 4.4: Challenges to third-party AI adoption Respondents reported a range of challenges associated with adopting and managing third-party AI systems. Concerns about information security and/or operational resilience arrangements were the most frequently reported major constraint, selected by 40% of respondents. This was followed by limited transparency into third-party AI systems (eg, training data, model design, performance limitations, failure modes) at 34%. Factoring in major and moderate constraints, difficulty negotiating contractual protections (eg, liability allocation, audit rights, data usage restrictions, advance notice of changes) was the second most cited challenge (Chart 12). Chart 12: Information security, operational resilience and transparency were the most commonly reported challenges Reported severity of challenges associated with third-party AI adoption 5: Benefits and risks 5.1: Benefits of AI The full survey asked respondents to rate, across a range of areas, the benefits that AI currently delivers and could deliver over the next three years, using a scale from 1 (‘none’) to 5 (‘transformational’). Respondents reported the greatest current benefits in operational efficiency, automation and productivity . That was followed by cybersecurity and operational resilience, and risk management and control effectiveness. By comparison, 2024 survey respondents identified ‘data and analytical insights’, ‘anti-money laundering and combating fraud’, and cybersecurity as the areas of greatest benefit at the time. None of the listed benefits in the 2026 survey were widely considered by respondents to currently be more than moderate in scale. Respondents expected the benefits of AI to increase across every area over the next three years. The largest anticipated increases were in cybersecurity and operational resilience and ‘revenue generation, competitive positioning, and product or service differentiation (including new product offerings)’ (Chart 13). Chart 13: Respondents expected AI benefits to increase across all areas over the next three years Average perceived benefits of AI today and in three years 5.2: Risk of AI for firms The full survey also asked respondents to rate a set of risk drivers arising from AI-enabled systems from 1 (no risk) to 5 (severe), as well as whether they had specific risk mitigations in place. Respondents reported ‘data protection and security’, ‘third-party and supply chain’, and ‘GenAI-specific risks’ as the most significant current risk drivers and ‘consumer and market conduct’ the least significant. Data-related risks also featured prominently in 2024: four of the five highest-rated current risks concerned data privacy and protection, quality, security, or bias and representativeness. On average, respondents rated risks as less severe in 2026 than in 2024, both currently and looking one to three years ahead. Respondents expected all firm-level risks to increase in the future. Average ratings were generally expected to move towards the moderate-to-high range over the next one to three years (Chart 14). Chart 14: Data protection, third-party and GenAI-specific risks received the highest ratings Average perceived firm-level risks from AI today and in three years Respondents also reported widespread use of risk mitigation measures . Mitigation coverage was highest for ‘data protection and security’ (91%), followed by ‘operational resilience and misuse’ (85%), and ‘GenAI-specific risks’ (83%). Conversely, the risk drivers for which firms were the least likely to have mitigation controls were ‘model behaviour and reliability’ (69%) and ‘consumer and market conduct’. In general, risk drivers assessed as more significant were more likely to be covered by mitigation controls. 5.3: Systemic risks Respondents were also asked to rate their concerns about a range of systemic risks of widespread use of AI systems on a scale of 1 (none) to 5 (severe), both now and in the next three years. Respondents expected already-prominent systemic risks – particularly cyber risk amplification and critical third-party dependencies – to intensify as AI use becomes more widespread. Cyber risk amplification (ie, common vulnerabilities exploited at scale) generated the greatest current concern, with 57% of respondents rating their concern as high or severe, rising to 80% in the one to three years ahead. Critical third-party dependencies followed, with the share of respondents rating the concern as high or severe increasing from 40% for today to 63% in the next one to three years. Cybersecurity was also the highest-rated systemic risk in the 2024 survey, while critical third-party dependencies had the largest expected increase over the following three years. Every listed systemic risk was expected to rise in the next one to three years. The risk associated with interconnectedness (eg, automated trading, common failure modes) recorded the largest expected increase, followed by market manipulation or surveillance evasion enabled by AI (Chart 15). Chart 15: Cyber risk amplification and critical third-party dependencies were the top-rated systemic risks of widespread use of AI systems Average perceived systemic risks of widespread AI adoption today and in three years 6: Constraints Firms were asked about constraints, both regulatory and non-regulatory, they faced when adopting AI, and more widely about the guidelines, regulations and standards shaping its adoption. 6.1: Regulatory Firms reported that their development and deployment of AI is shaped by a combination of domestic and international frameworks . International AI frameworks, such as the EU AI Act and NIST AI Risk Management Framework, were frequently mentioned, cited by 71% and 60% of respondents respectively. FCA guidance was also frequently mentioned, notably the FCA AI Update (65%) and Consumer Duty (63%). PRA and FCA cybersecurity and operational resilience expectations (eg, SS1/21 and SS2/21) were selected by a smaller but still significant proportion of respondents, at approximately 40%. The most cited perceived regulatory constraints were related to UK data protection and privacy, and international regulation. 42% and 29% of respondents, respectively, perceived that they posed a high compliance burden. UK intellectual property rights was the area most frequently associated with unclear best practice (ie, uncertainty about how to comply with legal requirements in practice), followed by international regulation (that indirectly impacts on AI adoption in the UK eg, the EU AI Act). Respondents also cited unclear best practice as a constraint in relation to several other regulatory areas, including PRA, FCA and Bank expectations (Chart 16). 28% of respondents indicated no regulatory constraints. Chart 16: UK data protection and privacy regulations were the most frequently mentioned regulatory constraints on adoption Share of respondents reporting each type of regulatory constraint 6.2: Non-regulatory The principal non-regulatory constraints related to implementing AI within firms. Integration into existing business processes and decisions was the most frequently reported large non-regulatory constraint, cited by 23% of respondents, followed by legacy systems or infrastructure at 22% (Chart 17). This contrasts with the results of the 2024 survey, where the top non-regulatory constraints were reported to be (i) safety, security and robustness, (ii) insufficient talent or access to skills; and (iii) appropriate transparency and explainability. Chart 17: Integration into existing business processes was the most frequently reported non-regulatory constraint Share of respondents reporting each severity of non-regulatory constraints 7: Governance and accountability The full survey asked respondents about their governance and accountability processes. These included questions around where accountability sat, the kinds of governance frameworks and controls firms were using, data risk management processes, and uncertainty and implementation challenges. 7.1: Accountability Accountability for AI systems and outputs most commonly sits with business area owners/users and executive leadership. Business area owners or users were identified by 94% of respondents and executive leadership by 90%. Accountability was otherwise distributed across development, Board, risk, compliance and product functions (Chart 18). Chart 18: Accountability for AI systems and outputs most commonly sits with business area owners/users and executive leadership Share of respondents reporting accountability for AI systems and outputs by function role 7.2: Governance frameworks and controls Most respondents reported having formal AI governance arrangements; incident preparedness was less common. Firm-wide AI policies, principles or standards were reported by 94% of respondents, while centralised governance fora, third-party risk-management frameworks, data-governance arrangements and senior oversight were each reported by at least three-quarters. More specialised controls were somewhat less widespread, and fewer than half reported incident-management and response playbooks (Chart 19). Chart 19: Most firms have defined firm-wide AI policies, principles and standards Share of respondents selecting each policy, principle or standard Most respondents reported having, or developing, formal processes for identifying, classifying and reviewing the materiality of AI systems. 62% of respondents reported having a formal AI materiality classification in place, rising to 87% when processes that were partially implemented or in development were included. 68% reported maintaining a central inventory of AI systems, rising to 92% when partial or in-development arrangements were included. In addition, 61% reported reviewing AI systems at least annually (note: respondents could only answer ‘Yes’ or ‘No’ for this question). 7.3: Understanding of AI systems Respondents reported using different approaches to achieve a sufficient level of understanding of high-materiality AI systems depending on whether those systems were developed internally or provided by third parties . For internally developed AI systems, to achieve a sufficient level of understanding of the system, respondents most commonly used deep knowledge of the system, assurance of behaviour and outcomes, and constrained autonomy or bounded action spaces. By contrast, for third-party AI systems, respondents most frequently relied on assurance by the vendor and contractual arrangements (81%), although assurance of behaviour and outcomes and constrained autonomy were also widely reported. Relatively few respondents (24%) reported having deep knowledge of third-party AI systems compared with internally developed systems (77%) (Chart 20). Chart 20: Firms reported different approaches to understanding internally developed and third-party AI systems Share of respondents reporting how they ensure a sufficient level of understanding of high-materiality AI systems, by system type 7.4: Data risk management Most firms managed AI-related data risk through either a dedicated cross-functional process or existing data, privacy and security arrangements . These approaches were reported by 42% and 37% of respondents respectively. Less commonly reported approaches included: federated arrangements under enterprise standards (6%); integration with model risk management frameworks (6%); ad hoc or developing processes; and control-led processes in production (2%). Pre-deployment data risk controls were more widely reported than post-deployment monitoring and review controls. Respondents were also asked about which controls they used to manage data risk in AI systems. Pre-deployment review, human approval and vendor due diligence were each reported by more than 90% of respondents. By contrast, ongoing monitoring, leakage testing and periodic review or recertification were each reported by around half of respondents (Chart 21). Chart 21: Pre-deployment data risk controls were more widely reported than post-deployment controls Share of respondents using each control Respondents were also asked about which metrics they routinely monitored for AI systems, including those related to running costs, risk, and performance. User feedback was the most routinely monitored metric for AI systems, selected by 85% of respondents. This was followed by accuracy/precision or recall (72%) and financial impacts such as cost and operational efficiency (70%). 56% of firms monitored robustness and safety measures while 52% monitored model drift/bias/data drift indicators. Measures focused on downstream impacts were less common: 39% monitored customer-impact and 34% monitored risk metrics. 7.5: Uncertainty and implementation challenges The most common governance challenges concerned oversight of third-party AI systems . Applying model risk management principles to third-party or vendor-supplied models was the most frequently selected challenge (54%), followed by overseeing systems provided or materially influenced by third parties (49%). A second group of challenges concerned the validation and ongoing management of complex or evolving models . Around two-fifths of respondents identified independent validation, ongoing monitoring and drift detection, or change control and versioning as challenges. Challenges relating to accountability, documentation and senior-manager understanding were reported less frequently . Only a small minority of respondents reported no uncertainty or implementation challenges (Chart 22). Chart 22: Oversight of third-party AI systems and vendor-supplied models were the most commonly reported governance challenges Share of respondents reporting each uncertainty or implementation challenge 8: Frontier AI and cyber Recent developments in frontier AI models have the potential to affect firms' cyber risk profiles, both by increasing the capabilities available to malicious actors and by creating new opportunities to strengthen cyber defences. To better understand firms' perceptions of these risks and opportunities, the full survey included a short annex on frontier AI and cyber risk. 88% of respondents assessed evolving frontier AI cyber capabilities over the next two years as having a moderate or high impact on their firm’s risk profile. When asked through which channel frontier AI currently posed the greatest risk, 44% selected faster exploitation of existing software vulnerabilities, followed by 19% selecting increased effectiveness of supply-chain or third-party attacks. 64% selected vulnerability management and patching cadence as the area of cyber resilience that had received the greatest increase in management attention as a result of awareness of frontier AI (Chart 23). Chart 23: Vulnerability management and patching have received the greatest increase in management attention due to awareness of frontier AI Share of respondents selecting each area of increased management attention 75% of respondents expected to use AI-enabled defensive tooling in security operations and detection over the next two years, 71% in vulnerability identification, 54% in patching activities, and 45% in managing third-party risk exposures (Chart 24). Chart 24: 75% of respondents expect to use frontier AI in security operations Share of respondents that selected each type of AI-enabled defensive tooling 9: Sustainability The full survey asked respondents about their consideration and reporting of the sustainability impacts of AI. Among respondents, 57% reported considering the sustainability impacts of AI. In addition, 82% reported that they do not currently report the sustainability impacts of AI externally. Of the respondents that did not currently report externally, 36% of respondents indicated that they planned to do so within the next two years. 10: Small firms For the 2026 survey, a short-form questionnaire was introduced for small firms, defined as firms with fewer than 100 employees, to better understand their use of AI and the challenges they face in adopting the technology. Whether a respondent was classified as a small firm was self-certified by the firm. Among respondents to the short-form survey, 73% reported using AI. Of those firms, 58% reported predominantly using general-purpose large language models (LLMs). A further 32% reported using a combination of general-purpose LLMs and more complex AI workflows, while 9% reported using machine learning techniques in addition to LLM-based tools. Respondents also reported a range of constraints affecting AI adoption and deployment. Around 38% reported no specific regulatory constraints limiting greater use of AI. Data protection, confidentiality and IT considerations were identified as constraints by 30% of respondents, while 23% identified governance, accountability and human oversight as constraints. Among short-form survey respondents, operations was the most commonly reported domain for current or planned AI use (64%). This was followed by other domains (47%), customer services (36%), risk management (34%), financial crime (27%) and HR (21%). 11: Acknowledgements The authors of this report are Isaac Orszag-Land, Paul Spence, Samara Malik, Andy Walters (Bank), Naz Majid, Dobrin Barakov, Emelie Bratt, Aleksandra Kleminska (FCA). We are grateful to Amy Lee, Mohammed Gharbawi, Sihara Abeywickrama, Emmanuel Akinyooye, Natalia Dashkevich, Oliver Duck, Malcolm Kane, Katie Lorimer, Mary Odetunde, Sarah Ng, Cindy Ramdoyal, Joe Souber (Bank), Jessica Rusu, Ian Phoenix, Rocco Quartu and Henrike Mueller (FCA) for their helpful comments and support. We are also grateful to colleagues from across the Bank, FCA and PRA for their input, including the supervisors of surveyed firms for their support throughout the process. Finally, we would like to thank all of the firms that participated in the survey for their input. Convert this page to PDF Other publications Publication // Report 26 October 2026 Artificial intelligence in UK financial services... Artificial intelligence in UK financial services - 2026 Publication // Working Paper 23 October 2026 Lighting the shadows: central bank policy... Lighting the shadows: central bank policy transmission through banks and non-banks Publication // Macro Technical Paper 23 October 2026 Global-to-UK SVAR Global-to-UK SVAR Publication // Weekly report 22 October 2026 Bank of England Weekly Report 21 October... Bank of England Weekly Report 21 October 2026 View more Other publications Back to top
TITLE: UK's Bank of England and Financial Conduct Authority Publish 2026 Survey on Artificial Intelligence in UK Financial Services BODY: On October 26, 2026, the Bank of England and the Financial Conduct Authority (FCA) published the fourth survey of artificial intelligence (AI) and machine learning (ML) use in UK financial services. The survey updates the authorities' evidence base on how firms are using, governing and managing AI, building on earlier surveys from 2019, 2022 and 2024. The survey received 196 responses across banks, insurers, non-bank lenders, investment firms, financial market infrastructures and payments firms. AI adoption rose to 86% of respondents, up from 75% in 2024. Generative AI accounted for 56% of reported AI systems, compared with 17% for foundation models in 2024. Operations and IT remained the largest business area, at around 31% of AI systems. Third-party AI systems made up 39% of reported systems and 53% of high-materiality systems, up from 35% in 2024. Cloud and compute hosting was highly concentrated, with the top three providers accounting for 79% of relationships. Information security, operational resilience and limited transparency were the main constraints on third-party adoption. AI agent deployment is widespread, with 80% of respondents reporting agents in use. Most operate only in a decision-support capacity, with 2% reporting broad autonomy. Respondents expect risks, particularly cyber risk amplification and critical third-party dependencies, to intensify over the next three years. The findings are intended to inform supervisory thinking and apply to firms across the UK financial sector, including smaller firms. The publication is a descriptive summary of aggregate results and reflects evidence from participating firms rather than a full assessment of the sector. Firms should review their AI governance, third-party oversight and data risk controls in light of these findings. The survey findings align with the Financial Services AI Adoption Plan published in July 2026 by the government's independent AI Champions for financial services. Reference: Bank of England, "Artificial intelligence in UK financial services – 2026," October 26, 2026. https://www.bankofengland.co.uk