Key views on AI governance and control capability adoption across financial institutions:
- AI in Risk and Compliance 2026 report surveyed 300 senior risk and compliance professionals across six markets on which AI governance and control capabilities are currently in place
- Formal AI governance policy leads at 56%, yet only 33% maintain an AI inventory and just 14% have independent assurance in place
- The data points to a control environment that is policy-forward but operationally thin, leaving critical gaps in monitoring, inventory and assurance
AI in Risk and Compliance 2026 report surveyed 300 senior risk and compliance professionals across six markets on which AI governance and control capabilities are currently in place
The findings come from AI in Risk and Compliance 2026 report, produced by RegTech Analyst and Parker & Lawrence Research.
The study draws on 300 senior risk and compliance professionals across six markets, spanning financial institutions (56%) and FinTechs (44%).
Respondents represent a broad cross-section of seniority, from compliance managers through to chief risk officers and heads of FinCrime, and cover retail banking, payments, insurance, investment banking and asset management.
The chart captures which AI governance and control capabilities are currently in place across financial services firms.
Formal AI governance policy leads at 56%, yet only 33% maintain an AI inventory and just 14% have independent assurance in place
The results reveal a control environment that is strongest at the policy and oversight level but thins out considerably as requirements become more operational.
Multiple responses were permitted.
A formal AI governance policy is the most widely adopted control, in place at 56% of firms, and together with human oversight requirements at 53% and staff training at 48%, these top three controls tell a coherent story: firms have established intent, retained human accountability and begun preparing their people.
Audit trails and evidence capture at 46% and testing and validation at 42% round out the upper tier.
The drop that follows is striking.
An AI inventory and use-case register, the foundational tool for knowing what a firm is actually governing, is maintained by only 33% of respondents.
Risk classification stands at 31%, pre-deployment review and approval at 29%, and monitoring and performance management at just 27%.
These are not peripheral controls: without an inventory, a firm cannot establish scope; without monitoring, it cannot detect when a model drifts or changes its behaviour.
Vendor due diligence sits at 20%, incident management at 19%, and independent assurance or audit closes the list at 14%.
The report notes that high-control firms are 30 percentage points more likely to use specialist AI-enabled risk and compliance solutions than low-control firms, and that low-control firms are far more likely to report an inability to implement policies effectively, pointing to a progression curve where having a basic framework is only the first step, not the destination.
The data points to a control environment that is policy-forward but operationally thin, leaving critical gaps in monitoring, inventory and assurance
What the data exposes is a governance architecture that looks more complete on paper than it is in practice.
The controls that firms have prioritised, policies, oversight requirements and staff training, are the ones most visible to regulators and easiest to evidence.
The controls that are least commonly in place are precisely those that make a governance framework operational rather than merely declaratory.
Without an AI inventory, a firm cannot know what it is governing.
Without monitoring, it cannot identify when a model’s behaviour changes.
Without incident management, it cannot respond consistently when things go wrong.
Moreover without independent assurance, it cannot demonstrate to a regulator that its controls are working rather than simply existing.
The gap between the top and bottom of this chart is not just a maturity gap; it is a credibility gap.
Firms that have written policies but lack the operational infrastructure to back them up are exposed in ways they may not yet have fully reckoned with.
Keep up with all the latest RegTech news here
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
