AI policies and the checks behind them
At a Glance
UK finance: 94% of detailed-survey respondents reported firm-wide AI policies, but around half reported ongoing data-risk monitoring and review controls. Source
UK pensions: New guidance explains existing trustee duties for AI use, including by service providers. Source
Global: BIS survey finds uneven capacity to monitor compliance among participating central banks, despite widespread AI guidance. Source
The Week’s Key Development
Bank of England and FCA publish fourth survey of AI in UK financial services
What happened. The Bank of England and the Financial Conduct Authority (FCA) published their 2026 AI survey on 26 October. Of 196 respondents, 105 completed the detailed questionnaire. Smaller firms, with under 100 employees, could answer a shorter version.
What it says.
Among detailed-survey respondents, 94% reported firm-wide AI policies, principles, or standards. Around half reported each of three controls for managing data risk after deployment: ongoing monitoring, leakage testing and periodic review or recertification. Fewer than half reported incident-management and response playbooks.
Third-party implementations accounted for 53% of reported high-materiality AI systems.
Of the firms surveyed, 80% have AI agents in use. Only 2% let them act with broad autonomy.
Business area owners or users were identified as accountable for AI systems and outputs by 94%, executive leadership by 90% and the Board by 64%.
What it means. Naming an accountable owner does not guarantee access to the evidence needed for oversight. For high-materiality third-party AI, respondents most often relied on vendor assurance and contractual arrangements to understand the technology. Monitoring and review of data risk were also reported less often than firm-wide policies.
For Risk and Internal Audit, the concern is whether the evidence supporting oversight can be independently examined and challenged, particularly when systems are externally supplied.
Boards were identified as accountable by 64% of respondents, versus 94% for business area owners or users and 90% for executive leadership. A lower figure does not necessarily indicate weaker board oversight. What matters is whether significant AI risks, supplier dependencies, and incidents reach directors with enough information to question management’s assessments and decisions. The survey does not establish how effectively that happens.
What’s next. The Bank and FCA say the findings will inform their continuing work. The report specifies no new regulatory steps.
Most relevant to: Board · Risk · Internal Audit · AI Governance
Source: Bank of England and FCA, Artificial intelligence in UK financial services – 2026 (26 October)
Also that week
UK pensions: Trustees remain accountable when AI is outsourced
What it says. The Pensions Regulator published guidance built around seven AI principles on 29 October. In its announcement, Executive Director of Market Oversight Ben Gunnee said: “Trustees don’t need to be AI experts, but they are accountable.”
The guidance explains how existing duties apply to AI used by schemes and providers; it creates no new requirements.
What it means. Outsourcing does not remove trustees’ accountability for scheme governance. Challenging AI-informed decisions depends partly on understanding providers’ use of AI and the evidence behind their outputs.
Most relevant to: Board · Compliance · AI Governance
Sources: TPR guidance · TPR announcement (29 October)
Global: BIS survey finds uneven capacity to monitor AI safeguards
What it says. The Irving Fisher Committee’s report, published by the BIS on 28 October, distinguishes “perceived readiness” from “actual readiness”. Most surveyed central banks had AI-use recommendations or were developing them.
Capacity to monitor compliance with their AI-use guidelines was rated moderate by 54%, developing by 27% and limited by 15%.
What it means. Policies and the ability to verify adherence measure different aspects of readiness. The figures describe monitoring capacity, not breaches. The views are the authors’ own.
Most relevant to: Board · Risk · Information Security
Source: BIS, IFC Report 19: AI readiness in central banks (28 October)
Worth Watching
US: CFTC chairman raises questions about liability for AI trading agents
What it says.At the CFTC’s Frontier Forum on 28 October, Chairman Michael S. Selig asked: “Who is liable if the agent goes rogue?” He also asked whether an agent’s developer would have to register, and whether a “know-your-agent” approach could identify whom agents trade for.
What it means. Identifying an agent’s client does not necessarily resolve questions of registration or liability. Selig raised questions rather than proposing new requirements, noting that his views did not necessarily reflect those of the Commission.
Most relevant to: Legal · Compliance · Risk
Source: CFTC, Remarks at Frontier Forum on Super Intelligence (28 October)
Coming Up
20 November: ICO call for evidence on agentic AI closes.
25–26 November: FCA Supercharged Sandbox second-cohort showcase.
AI GRC Network
AI GRC Network briefs and connects the executives accountable for AI in financial services. Subscribe to our free weekly newsletter at aigrcnetwork.com and follow us on LinkedIn.
Know someone who should be reading this?
Disclaimer: this newsletter is designed to provide general analysis, and it is not legal, regulatory or financial advice.