BoE roundtables reveal AI adoption challenges for financial firms

Participants from regulated firms across challenger banks, global systemically important banks, and insurers broadly supported the PRA's principles-based regulatory framework for AI.

Supervisory Statement 1/23 on Model Risk Management was specifically highlighted as pragmatic, enabling responsible AI adoption without immediate need for detailed, AI-specific guidance or a dedicated sandbox.

However, second-line risk functions approach AI with caution, potentially delaying deployment.

Firms noted that traditional model risk management, focused on understanding internal workings, is unsustainable for complex generative AI and agentic systems.

The concept of 'human-in-the-loop' is also challenged.

Suggestions included evolving risk management to emphasize testing, monitoring, and setting guardrails around AI system outcomes, with value seen in sharing supervisory observations and industry best practices.

Firms operating across multiple jurisdictions face increased compliance costs and slowed AI adoption due to fragmented regulatory approaches, citing differences between the UK, US (SR11-7), and EU AI Act.

This fragmentation prevents scaling AI use cases internationally, prompting calls for global coordination.

Procurement and contract negotiations with third-party AI providers are also hampered by inconsistent familiarity with compliance requirements, suggesting a need for agreed minimum standards.

Data protection laws, including Data Protection Impact Assessments (DPIAs) and emerging data sovereignty regimes, further challenge AI deployment and scaling.

Data quality, particularly in areas like insurance with infrequent customer engagement, also acts as a barrier to advanced AI applications such as hyper-personalised products.