The most consequential banking AI may not be the chatbot customers can see. It may be the systems quietly changing how institutions monitor risk, investigate anomalies, test controls and prove to supervisors that their decisions can be trusted.
The popular image of artificial intelligence in banking is customer-facing: a virtual assistant answering questions, an algorithm pricing a loan, or an agent moving money. Yet some of the most important changes are happening much further from the customer. Compliance teams are testing AI to triage alerts and review documents. Risk functions are using it to detect weak signals across data sets that are too large for manual analysis. Internal auditors are experimenting with systems that can inspect evidence continuously rather than waiting for the next audit cycle.
This shift is already visible in the data. The Bank of England and Financial Conduct Authority survey of AI in UK financial services found that 75% of responding firms were using AI, with another 10% planning to use it within three years. Fraud detection, cybersecurity and internal process optimisation were among the leading applications, and firms expected a marked increase in AI use for regulatory compliance and reporting. The same survey found that risk and compliance had one of the highest shares of high-materiality AI use cases.
The implication is not that control functions are about to become autonomous. In the survey, only 2% of AI use cases involved fully autonomous decision-making. The more credible near-term transformation is subtler: people remain accountable, but the machinery around them becomes continuous, predictive and increasingly machine-assisted. That could change the operating model of the second and third lines of defence more profoundly than a wave of visible front-office automation.
The Revolution Begins in the Control Functions
Compliance, risk and audit are unusually fertile ground for AI because they are information-intensive disciplines. They depend on reading policies, reconciling transactions, comparing behaviour against expectations, testing evidence, spotting exceptions and explaining why something matters. Much of the work is repetitive, but the consequences of getting it wrong can be severe.
The European Central Bank has made the governance point explicit. In February 2026, ECB Banking Supervision said banks need clear accountability for AI-driven decisions, effective senior-management oversight and robust challenge mechanisms involving risk management, compliance and internal audit. The supervisor also warned that AI initiatives without a clear strategic anchor can lead to fragmented governance, inconsistent controls and hidden risks.
That framing matters. It suggests AI is not simply another efficiency tool to be owned by technology teams. Once an AI system influences suspicious-activity detection, control testing, credit limits, sanctions screening or regulatory reporting, it becomes part of the institution’s control environment. The question changes from “does the model work?” to “can the bank demonstrate that the entire decision process remains governed, challengeable and reproducible?”
Compliance Moves From Periodic Casework to Continuous Monitoring
Traditional compliance has often been organised around queues. Alerts are generated, documents are collected, cases are assigned and analysts work through them. AI can compress that sequence by identifying which alerts deserve attention, extracting information from unstructured documents, connecting related entities and generating preliminary case narratives for human review.
The attraction is obvious in financial crime. The Financial Action Task Force noted in February 2026 that some financial intelligence units and banks are already using machine-learning models on transaction data to detect anomalies associated with fraud and other forms of financial crime. FATF also highlighted the other side of the contest: criminals are using AI-enabled deepfakes, phishing and messaging tools to increase the scale and sophistication of fraud.
That creates a feedback loop. As fraud becomes more machine-generated, compliance becomes more machine-assisted. Static rules can still matter, but institutions increasingly need systems that learn from changing patterns, combine behavioural signals and prioritise cases dynamically. Inference follows from the direction of travel: the future compliance analyst is likely to spend less time gathering evidence and more time challenging the system’s conclusions, resolving ambiguity and making decisions that require legal or contextual judgement.
Regulatory change management may be next
A second opportunity sits in regulatory interpretation itself. Large banks operate across multiple jurisdictions, each producing consultations, rule changes, supervisory statements and enforcement lessons. Today, teams often map those changes manually into policies and controls. Generative AI can search the regulatory corpus, identify obligations that appear relevant to a business line and draft a first-pass impact assessment.
The gains could be substantial, but this is also where hallucination risk becomes dangerous. A system that confidently invents a reporting deadline or misreads an exemption can create a control failure faster than a human team can correct it. For that reason, the most defensible architecture is likely to be retrieval-based and evidence-linked: every machine-generated conclusion should point back to the authoritative text, with human sign-off where the interpretation is consequential.
Risk Management Shifts From Periodic Reporting to Continuous Sensing
Risk management has historically been cyclical. Committees meet, dashboards are produced, limit reports are reviewed and stress tests are run at defined intervals. AI can make parts of that architecture more continuous by monitoring large volumes of transactions, communications, system events and market data for weak signals that conventional dashboards may miss.
The European Banking Authority’s June 2026 risk assessment warned that AI creates operational, bias, data-quality, market, conduct, legal, third-party and cyber risks, while also increasing concentration and interconnectedness. It argued for a risk-sensitive and transparent approach to AI deployment, stronger governance, data and cybersecurity controls, and regular penetration testing. The message is important because it rejects a simplistic “AI reduces risk” narrative: the same technology can improve detection while introducing new failure modes.
Operational risk is a good example. AI can identify abnormal process behaviour, predict service degradation or scan incident logs for recurring causes. But if the AI itself sits inside a critical process, its failure becomes an operational-risk event. The Basel Committee’s 2026 work on ICT risk management reinforces the broader point that digital resilience depends on disciplined management of technology dependencies and non-malicious ICT failures as well as cyber attacks.
This is likely to change the job of risk committees. Rather than receiving only periodic snapshots, senior management may increasingly receive live indicators and AI-generated scenario summaries. The benefit is earlier detection. The danger is false precision: a dashboard that updates every minute can create the appearance of control even when the underlying model is poorly specified or the data are incomplete.
Model Risk Becomes the Control Function’s Control Problem
As AI enters compliance and risk, model risk management becomes central. In April 2026, the Federal Reserve, OCC and FDIC issued revised U.S. model risk management guidance, replacing guidance that dated back to 2011. The revision emphasises a risk-based approach tailored to a bank’s model profile and reflects major advances in modelling practices.
The timing is significant. Banks are no longer only validating relatively stable scorecards or statistical models. They are dealing with foundation models, third-party models, retrieval systems, prompts, model chains and agentic components whose behaviour may change when context changes. A “model inventory” therefore risks becoming too narrow if it records only a named algorithm but not the surrounding data, prompts, tools and dependencies that influence the output.
The Bank of England/FCA survey highlights the governance challenge. A third of reported AI use cases were third-party implementations, and third-party usage was especially high in risk and compliance. Only 34% of firms said they had a complete understanding of the AI technologies they used, while 46% reported only partial understanding. That is not proof of unsafe practice, but it is evidence that accountability can extend further than technical visibility.
The emerging response is “AI assurance”: independent testing of performance, fairness, robustness, security, explainability and change control. The BIS Innovation Hub’s Project Noor is experimenting with explainable-AI techniques that could help supervisors evaluate model transparency, fairness and robustness. Its premise is revealing: supervision is beginning to need tools capable of interrogating the same class of models that banks use.
Internal Audit Could Move Beyond Sampling
Internal audit has traditionally relied heavily on samples because the full population of transactions, controls and evidence is too large to inspect manually. AI can change that economics. It can scan whole data sets for exceptions, compare process evidence against policy requirements and identify unusual combinations of events for auditors to investigate.
That does not eliminate sampling in a statistical sense, nor does it remove the need for professional judgement. It changes where auditors spend their time. Instead of manually selecting and reviewing large numbers of routine records, they can focus on the exceptions, on whether management’s controls are designed appropriately, and on whether the AI-based monitoring itself is trustworthy.
The professional foundation is also evolving. The Institute of Internal Auditors’ Global Internal Audit Standards became effective in January 2025 and place renewed emphasis on strategy, governance, performance and evidence. In an AI-enabled bank, those principles point toward a more technically capable audit function: auditors need to understand model governance, data lineage, third-party dependencies and the difference between a plausible AI explanation and reproducible evidence.
Continuous assurance is attractive, but independence is non-negotiable
There is a governance trap here. If first-line operations, second-line risk and third-line audit all use the same model provider, the same data pipeline or even the same internal AI platform, common-mode failure becomes possible. The technology that creates consistency can also create correlated blind spots.
That is why audit independence will increasingly have a technical dimension. An audit team may need separate prompts, independent validation data, alternative analytical methods or its own controlled tooling rather than simply accepting outputs generated by the systems it is auditing. The stronger the automation in the first two lines, the more important it becomes that the third line can challenge the assumptions and evidence independently.
AI Will Blur the Boundaries Between the Three Lines
The familiar “three lines” model separates ownership of risk, oversight of risk and independent assurance. AI does not abolish that logic, but it can blur the operating boundaries. A first-line system may continuously test its own controls. A second-line model may monitor the first line in real time. Internal audit may receive the same telemetry and run separate tests almost simultaneously.
The result could be a more responsive control environment, but also a more confusing one. If an automated compliance control fails, who owns the failure: the business user, the model owner, the technology team, the compliance function or the third-party provider? The answer cannot be “the AI”. Regulators increasingly expect accountability to remain human and organisational even when execution is automated.
This is why the ECB’s focus on clear accountability is more than governance language. It is an operating-model requirement. Banks need to map AI systems to accountable executives, documented control owners, validation responsibilities, escalation thresholds and clear override rights. Without that map, faster automation can simply accelerate ambiguity.
Supervisors Are Starting to Use the Same Tools
The transformation is not confined to banks. Supervisors are experimenting with AI to process the enormous volume of information that regulated institutions produce. The BIS Innovation Hub’s Project AISE is testing AI-enabled supervisory analytics for retail payments using synthetic data. Its design explicitly examines unsupported outputs, prompt injection, retrieval manipulation, weak reproducibility and unclear accountability.
That creates the possibility of a new supervisory dynamic: AI-assisted banks producing evidence for AI-assisted supervisors. Machine-readable regulatory reporting, structured control evidence and traceable model outputs could make supervision faster and more targeted. But it also raises a new systemic question. If supervisors and firms rely on similar models or shared providers, do they become more efficient at detecting risk, or more likely to share the same blind spots? The evidence is not yet sufficient to answer that question; it is a risk scenario that deserves explicit testing.
Regulation Is Moving From Principles to Operational Expectations
The regulatory landscape in August 2026 is more concrete than it was even a year ago. The EU AI Act became generally applicable on 2 August 2026, with transparency requirements now in force and the AI Office and national authorities beginning enforcement. The high-risk rules for certain sensitive uses have been extended to 2 December 2027 under the AI Omnibus, while rules for AI embedded in regulated products apply from August 2028.
For banks, the immediate lesson is that AI compliance cannot be treated as a one-off legal project. The Commission’s July 2026 transparency guidance adds practical detail to disclosure obligations, while sector rules such as operational-resilience, data-protection, conduct and prudential requirements continue to apply. The intersection matters more than any single rulebook.
The UK is pursuing a different route. The FCA has said it does not plan a separate AI-specific rulebook for financial firms, relying instead on existing frameworks such as the Consumer Duty, the Senior Managers and Certification Regime, and governance and controls expectations. In the United States, the 2026 model-risk update similarly shows how existing supervisory frameworks are being revised rather than discarded.
Across jurisdictions, the common direction is clearer than the legal details: institutions remain responsible for outcomes. Automation can change how a control is performed; it does not remove the obligation to understand, validate and govern the control.
The Counterargument: AI Can Make Control Environments Worse
There is a strong case that AI can reduce false positives, surface hidden patterns and lower the cost of routine assurance. There is an equally strong reason not to assume that more automation equals better control. A poorly designed AI system can generate persuasive but unsupported explanations, amplify biased historical decisions, leak confidential data, or create a flood of low-quality alerts that consumes the very human capacity it was meant to save.
Automation bias is particularly dangerous in control functions because the output often carries an aura of technical authority. An analyst may be less willing to challenge a machine-generated risk score than a colleague’s judgement, especially when the model is complex and the organisation has invested heavily in it. The answer is not to keep humans “in the loop” as a ceremonial step. Human review must be capable of changing the outcome and supported by enough information to challenge it intelligently.
Third-party concentration adds another concern. The Bank of England/FCA survey found that the top three providers accounted for 73% of named cloud providers and 44% of named model providers. The more control functions converge on a small set of external technologies, the more operational resilience, vendor lock-in and correlated model behaviour become governance issues rather than procurement details.
What Is Evidence, and What Is Still Inference?
The evidence is already substantial that AI adoption is widespread, that risk and compliance are important use cases, that third-party dependencies are growing, and that regulators are tightening expectations around governance, explainability and accountability. Supervisors in Europe, the United States, the United Kingdom and elsewhere are actively updating frameworks and experimenting with supervisory AI.
The inference is about the organisational end-state. It is plausible that compliance becomes more continuous, risk management more predictive and audit more population-based. It is also plausible that smaller teams become capable of supervising much larger volumes of activity. But there is not yet sufficient evidence to conclude that AI will reduce total control costs, reduce regulatory findings, or allow major banks to shrink risk and compliance functions materially. In many institutions, the near-term effect may be the opposite: new AI governance, testing and validation obligations add work before they remove it.
What This Means for Banks, Fintechs, Regulators and Investors
For banks, the strategic task is to redesign controls around the strengths and weaknesses of AI rather than bolt models onto legacy workflows. High-volume evidence gathering, anomaly detection and document analysis are natural candidates for automation. Judgement-heavy decisions, legal interpretation, customer harm assessment and material risk acceptance need stronger human ownership. The winning architecture is likely to separate machine assistance from accountable decision rights.
For fintechs and RegTech providers, the opportunity is large but the bar is rising. Buyers increasingly need evidence of model performance, data provenance, access controls, change management, resilience and auditability. A technically impressive product that cannot support a bank’s validation and supervisory obligations may struggle to move from pilot to production.
For regulators, the challenge is proportionality. Overly prescriptive rules can freeze today’s technology into tomorrow’s compliance architecture. Too little guidance can leave firms guessing about what “good governance” means. Projects such as Noor and AISE show one promising direction: build supervisory capability that can test and understand AI systems directly rather than relying only on policies and vendor assertions.
For investors, AI should change how operating leverage is assessed. The headline opportunity is lower unit cost in control functions and faster risk detection. The hidden liability is a new layer of model, cyber and third-party risk. Banks that can demonstrate cleaner data, disciplined AI inventories, strong validation and resilient vendor strategies may deserve a governance premium over institutions that report AI adoption without showing how the control environment has evolved.
Conclusion: The Quiet Transformation May Be the Most Important One
AI in banking will continue to attract attention when it talks to customers or makes visible financial decisions. But the deeper institutional transformation may happen where few customers ever look: inside the systems that decide which transaction deserves investigation, which control has failed, which risk is rising and which evidence an auditor should examine.
If managed well, that could make compliance less reactive, risk management less periodic and audit less dependent on small samples. If managed badly, it could create opaque control systems that are faster, more complex and harder to challenge. The decisive issue is therefore not whether banks automate their control functions. It is whether they can automate without losing accountability.
That is the quiet redesign now under way. AI is not simply entering compliance, audit and risk management as another tool. It is beginning to change the rhythm, evidence base and operating model of the functions that decide whether a bank remains in control of itself.
References
1. Artificial intelligence in UK financial services - 2024
2. Technology is neutral, governance is not: AI adoption in the banking sector
3. SR 26-2: Revised Guidance on Model Risk Management
4. Risk Assessment Report - June 2026
5. AI Act
6. Guidelines on transparency obligations for providers and deployers of AI systems
7. AI in financial services: shaping our approach through industry engagement
9. Complete Global Internal Audit Standards
10. Project AISE: AI-enabled supervisory analytics for retail payments supervision
11. Project Noor: explaining AI models for financial supervision
12. Basel Committee report on information and communication technology risk management
13. Regulation and supervision of the financial sector in the age of artificial intelligence