Key views on FI procurement methods for AI in risk and compliance environments:
- The AI in Risk and Compliance 2026 report surveyed 300 senior risk and compliance professionals across six markets on how financial institutions access and procure AI
- General access to foundation models leads FI procurement at 55%, with firms combining multiple routes rather than settling on one
- The data points to a sector still assembling its AI stack, where governance and oversight matter as much as the procurement route itself
AI in Risk and Compliance 2026 surveyed 300 senior risk and compliance professionals across six markets on how financial institutions access and procure AI
The findings come from AI in Risk and Compliance 2026 report, produced by RegTech Analyst and Parker & Lawrence Research.
The study draws on 300 senior risk and compliance professionals across six markets, spanning financial institutions (56%) and FinTechs (44%).
Respondents represent a broad cross-section of seniority, from compliance managers through to chief risk officers and heads of FinCrime, and cover retail banking, payments, insurance, investment banking and asset management.
The chart examines how financial institutions specifically are accessing and procuring AI in their risk and compliance environments.
General access to foundation models leads FI procurement at 55%, with firms combining multiple routes rather than settling on one
The results reveal a sector pursuing multiple procurement routes simultaneously rather than converging on a single approach.
Multiple responses were permitted.
General access to foundation models is the most widely used method, cited by 55% of respondents, suggesting that many firms are granting employees direct access to large language models as an approved and sanctioned route.
AI embedded in enterprise software follows closely at 52%, reflecting the extent to which AI capabilities are being delivered through existing vendor relationships rather than standalone deployments.
Specialist AI-enabled risk and compliance solutions stand at 47%, pointing to meaningful demand for domain-specific tooling built for the regulatory context.
Custom applications on third-party AI platforms follow at 41%, and in-house or open-source model development closes the list at 36%, the least common route despite the falling cost of building initial prototypes.
The data points to a sector still assembling its AI stack, where governance and oversight matter as much as the procurement route itself
The breadth of procurement methods in use is itself the most telling finding.
Rather than consolidating around one approach, firms are layering general-purpose, enterprise and specialist AI in parallel, a pattern that reflects both the immaturity of the market and the different problems each method is best suited to solve.
The prevalence of general foundation model access at the top of the list is worth examining closely.
It can serve as an effective way to reduce unsanctioned shadow AI by giving employees an approved channel, but it also transfers more responsibility to identity management, data classification and user judgement than many compliance teams may have fully accounted for.
The relatively modest take-up of in-house development, despite lower barriers to entry, reinforces a familiar lesson from broader RegTech adoption: building a proof of concept has become easier, but the burden of production engineering, validation, data governance and regulatory evidence has not.
Specialist vendors and enterprise providers can spread those obligations across their client base in a way that most institutions cannot replicate internally.
Keep up with all the latest RegTech news here
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
