●New: The Enterprise AI Evaluation Playbook (2026 edition) is out — download it free.
Qapitol
← All research

Qapitol Research · First edition

The State of AI Governance in BFSI 2026

A definitive briefing for risk, compliance, and technology executives on where the regulatory frontier sits, where governance structures are failing, and what priority actions will determine readiness before the August 2026 high-risk AI deadline.

June 2026·Designed PDF · 28 pages·Free with email
Download the report →

Executive summary

  • The BFSI sector has committed more to AI than any other industry — commanding 19.6% of global AI spending and deploying the technology at scale in fraud detection, credit decisioning, and compliance automation. Yet the gap between adoption and governance is stark and, as of 2026, is becoming a regulatory liability. Only 31% of financial services respondents report a comprehensive, actively enforced AI governance framework, and just 4 out of 50 analysed banks in 2025 had reported realised ROI from AI use cases — a signal that investment is running far ahead of the operational and oversight infrastructure needed to capture and protect value.
  • The regulatory environment is hardening simultaneously across jurisdictions. The EU AI Act's high-risk provisions — covering credit scoring, loan decisioning, and insurance pricing — take effect in August 2026, while the US is advancing a pro-innovation but enforcement-oriented posture and the UK is pressing firms to interpret Consumer Duty and SM&CR through an AI lens. The convergence of model governance requirements, third-party AI risk obligations under DORA and OCC 2023-17, and explainability mandates under ECOA means that compliance is no longer a single-framework exercise. Firms that treat AI risk as a subset of existing model risk and build integrated, multi-jurisdictional governance programmes will be positioned to act — those that do not face examiner-visible gaps, enforcement actions, and, as Equifax and Goldman Sachs have demonstrated, material fines.

Headline prediction

High-risk AI obligations under the EU AI Act take effect 2 August 2026, yet only 13% of global financial institutions are currently ready to implement trustworthy AI — making the next six months the most consequential governance window in a generation.

What this report covers

  • The EU AI Act's high-risk classification and its specific implications for credit scoring, loan approval, and insurance pricing in BFSI
  • The state of AI adoption and the governance maturity gap across banking, insurance, and capital markets
  • Board and executive accountability frameworks, the evolving CAIO role, and the prevalence of shadow AI deployments
  • Enforcement case studies: Equifax, Goldman Sachs, Two Sigma, and Credit Suisse as governance failure archetypes
  • Explainability obligations and the operationalisation of SHAP and LIME as regulatory compliance tools
  • Third-party and supply-chain AI risk under OCC 2023-17, DORA Chapter V, and SR 11-7
  • Cross-jurisdictional regulatory divergence and the priority actions firms must take before end-2026

Download the report

Get “The State of AI Governance in BFSI 2026” — designed PDF, 28 pages

Free with your details. We’ll send the PDF to your inbox and tailor what we share next to your role.

No spam. We’ll only send research relevant to your role. Unsubscribe anytime.

Sources

  • EU AI Act Financial Services: Current-Law Planning — https://euaicompass.com/eu-ai-act-for-financial-services.html
  • Singapore vs EU AI Regulation: A Singapore Practitioner's Guide (2026) - Reg Intel — https://reg-intel.com/singapore-vs-eu-ai-regulation/
  • The EU AI Act – the current state of play | Travers Smith — https://www.traverssmith.com/knowledge/knowledge-container/the-eu-ai-act-the-current-state-of-play/
  • EU AI Act: What Financial Services Firms Need to Know Before August 2026 | financialregulations.eu — https://financialregulations.eu/blog/eu-ai-act-financial-services-guide
  • AI Act | Shaping Europe’s digital future — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
  • 2026 Global AI in Financial Services Report – Adoption, Impact and Risks - CCAF publications - Cambridge Judge Business School — https://www.jbs.cam.ac.uk/faculty-research/centres/alternative-finance/publications/2026-global-ai-in-financial-services-report/
  • AI Quarterly Pulse Survey — https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2026/ai-quarterly-pulse-survey-banking-q1-2026.pdf
  • AI in Finance Statistics: Key Data & Facts 2026 — https://aibusinessweekly.net/p/ai-in-finance-statistics
  • AI in Financial Services 2026: From Experimentation to Enterprise Scale | Blott — https://www.blott.com/reports/ai-use-cases-in-financial-services
  • State of AI in Finance & Banking 2026 — ToolGlance — https://toolglance.com/reports/state-of-ai-in-finance-banking-2026
  • Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  • Regulating AI in the financial sector: recent developments and main challenges — https://www.bis.org/fsi/publ/insights63.pdf
  • SR 11-7 Model Risk Management for AI — GLACIS — https://www.glacis.io/guide-sr-11-7
  • UK financial services AI | FCA & PRA guide, April 2026 — GLACIS — https://www.glacis.io/guide-uk-financial-services-ai
  • AI Governance for Financial Services: FCA & PRA 2026 - SureCloud — https://www.surecloud.com/blog-hub/ai-governance-financial-services-fca-pra
  • Chief AI Officer roles surge as firms harden AI governance | CAIO Weekly — https://caioweekly.co.uk/chief-ai-officer-roles-surge-governance
  • Equifax Inc. and Equifax Information Services LLC — https://files.consumerfinance.gov/f/documents/cfpb_equifax-inc-consent-order_2025-01.pdf
  • Order to Cease and Desist and Order of Assessment of a Civil Money Penalty Issued Upon Consent Pursuant to the Federal Deposit Insurance Act, as Amended — https://www.federalreserve.gov/newsevents/pressreleases/files/enf20230724a1.pdf
  • The Securities and Exchange Commission (“Commission”) deems it appropriate and in the public interest that public administrative and cease-and-desist proceedings be, and hereby are, instituted pursuant to Section 21C of the Securities Exchange Act of 1934 (“Exchange Act”) and Sections 203(e) and 203(k) of the Investment Advisers Act of 1940 (“Advisers Act”) against Two Sigma Investments, LP (“TSI”) and Two Sigma Advisers, LP (“TSA”) (collectively, “Two Sigma” or “Respondents”). — https://www.sec.gov/files/litigation/admin/2025/34-102207.pdf
  • Algorithmic Bias Risk: How Risk Managers Should Assess AI Fairness — https://riskpublishing.com/algorithmic-bias-risk-how-risk-managers/
  • Model Risk Management: Revised Guidance | OCC — https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
  • Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau — https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/
  • Federal Register, Volume 89 Issue 75 (Wednesday, April 17, 2024) — https://www.govinfo.gov/content/pkg/FR-2024-04-17/html/2024-08003.htm
  • CFPB Applies Adverse Action Notification Requirement to Artificial Intelligence Models | Insights | Skadden, Arps, Slate, Meagher & Flom LLP — https://www.skadden.com/insights/publications/2024/01/cfpb-applies-adverse-action-notification-requirement
  • 1. Introduction and Motivation — https://www.arxiv.org/pdf/2603.01235
  • Managing explanations: how regulators can address AI explainability — https://www.bis.org/fsi/fsipapers24.pdf
  • Case Study 14.1: SHAP in Practice — How a Bank Used... | AI Ethics | DataField.Dev — https://datafield.dev/ai-ethics/ch14-explainable-ai-techniques/case-study-01.html
  • Third-Party Relationships: Interagency Guidance on Risk Management | OCC — https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html
  • AI vendor diligence: the OCC 2023-17 and 2024-11 checklist — Zusman Partners — https://zusmanpartners.com/insights/vendor-diligence-occ-2023-17/
  • https://www.bafin.de/SharedDocs/Downloads/EN/Anlage/dl_2024_07_08_Aufsichtsmitteilung_Umsetzungshinweise_DORA_en.pdf%3F__blob%3DpublicationFile%26v%3D3
  • Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  • — https://ec.europa.eu/finance/docs/level-2-measures/dora-regulation-rts--2024-1531_en.pdf
  • SR 23-4 attachment: Interagency Guidance on Third-Party Relationships: Risk Management — https://www.federalreserve.gov/supervisionreg/srletters/sr2304a1.pdf
  • Only 13% of global FSI polled are ready to implement trustworthy AI, Deloitte report reveals — https://www.deloitte.com/southeast-asia/en/about/press-room/only-13-of-global-fsi-polled-are-ready-to-implement-trustworthy-ai-deloitte-report-reveals.html
  • Evident - Banking AI Index — https://evidentinsights.com/ai-index/
  • IIF-EY Annual Survey Report on AI/ML Use in Financial Services — https://www.iif.com/portals/0/Files/content/Innovation/2024%20IIF-EY%20Survey%20Report%20on%20AI_ML%20Use%20in%20Financial%20Services_Public%2001.08.25.pdf
  • AI Adoption in Financial Institutions: Balancing Growth and Governance — https://www.deloitte.com/dk/en/services/consulting/perspectives/ai-adoption-in-financial-institutions-balancing-growth-and-governance.html
  • AI Governance in Financial Services: Strong Foundations, Persistent Evidence Gaps — https://www.adr.org/news-and-insights/ai-governance-in-financial-services/
  • Retail banking AI readiness: the leading banks positioned to enable AI at scale - CB Insights Research — https://www.cbinsights.com/research/ai-readiness-index-retail-banking-2025/
  • 2025 AI Benchmarking Report — https://web.acaglobal.com/hubfs/2025%20AI%20Benchmarking%20Survey/ACA%20Group_AI%20Benchmarking%20Report.pdf
  • Use of Generative AI in Financial Services | Risk Snapshots | GARP — https://www.garp.org/risk-snapshots/use-of-generative-ai-in-financial-services
  • Artificial Intelligence in Banking and Risk Management — https://www.garp.org/white-paper/artificial-intelligence-in-banking-and-risk-management
  • https://www.mckinsey.com/~/media/mckinsey/business%20functions/quantumblack/our%20insights/the%20state%20of%20ai/2025/the-state-of-ai-how-organizations-are-rewiring-to-capture-value_final.pdf
  • How AI will transform banking | McKinsey — https://www.mckinsey.com.br/industries/financial-services/our-insights/extracting-value-from-ai-in-banking-rewiring-the-enterprise
  • Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report — https://www.fsb.org/uploads/P100626.pdf
  • Review into the long-term impact of AI on retail financial services (The Mills Review) | FCA — https://www.fca.org.uk/publications/calls-input/review-long-term-impact-ai-retail-financial-services-mills-review
  • AI in financial services: shaping our approach through industry engagement | FCA — https://www.fca.org.uk/news/blogs/ai-financial-services-approach
  • AI in financial services: Responses to the Committee’s First report — https://publications.parliament.uk/pa/cm5901/cmselect/cmtreasy/1791/report.html
  • https://www.bis.org/fsi/publ/insights63.pdf
  • Chairman Hill Statement on President Trump’s National AI Legislative Framework | U.S. House Committee on Financial Services — https://financialservices.house.gov/news/documentsingle.aspx?DocumentID=411063