The adoption curve is steep
Cambridge’s 2026 global financial-services report found genAI adoption among 71% of industry respondents and agentic AI adoption among 52%. Yet only 23% reported agentic AI at scaling or transforming maturity, showing a large middle ground between experimentation and mature operation (CCAF, 2026).
At the same time, surveyed regulators were less mature overall: 48% were still exploring AI or not engaged, 33% were piloting and 18% were scaling. That asymmetry increases the importance of institutions building internal assurance capability rather than waiting for external supervision to define every control.
The risk surface is broadening
The EBA’s June 2026 Risk Assessment Report describes AI as both an opportunity and a risk amplifier for EU/EEA banks, highlighting operational failure, bias, data quality, legal and conduct risk, third-party concentration, cyber risk and the implications of highly capable models for vulnerability discovery (EBA, 2026).
The CCAF report also notes concern over loss of human oversight and adversarial AI. These are system-level risks: they emerge from the interaction between models, generated code, data, third-party services and operational processes.
- 01AI adoption
- 02Expanded attack / decision surface
- 03Control capability
- 04Runtime evidence
- 05Scaled deployment
Scaling is safe only when control capability grows with deployment complexity.
Oversight must become evidence-producing
Governance cannot rely on periodic committees reviewing static model inventories. Control functions need evidence from the operating system: evaluations, incidents, data lineage, access logs, tool calls, model/version changes and escalation behaviour.
The FSB’s 2026 consultation proposes 12 sound practices covering organisation-wide AI governance and lifecycle management. The practical implication is that responsible adoption must be embedded in operating mechanisms, not added after deployment (FSB, 2026).
Arvec view: scale control capability with autonomy
The right control intensity should follow the consequence and autonomy of the system. An internal summariser and an autonomous client-facing decision workflow should not share the same assurance burden.
AIF7™ treats governance, engineering, data and operating model as connected capabilities. If deployment maturity rises while those control capabilities remain weak, the organisation is not scaling AI—it is scaling exposure.
Key implications
- 01
Track the maturity of control capability alongside the maturity of AI deployment.
- 02
Treat cyber, third-party and human-oversight risks as part of AI architecture.
- 03
Require runtime evidence for high-autonomy workflows.
- 04
Use risk-sensitive governance rather than one uniform approval process.
Related AIF7™ capabilities
AI Governance & Trust
Provides the control architecture for regulated deployment.
AI Engineering & Delivery
Creates evaluation, observability and secure deployment practices.
AI Data Foundation
Controls data quality, lineage and exposure.
AI Organisation & Operating Model
Ensures risk, technology and business ownership remain aligned.
Sources & further reading
01 · CCAF 2026
2026 Global AI in Financial Services Report – Adoption, Impact and RisksCambridge Centre for Alternative Finance · 2026
02 · EBA 2026
Risk Assessment Report – June 2026European Banking Authority · June 2026
03 · FSB 2026
Sound Practices for Responsible Adoption of Artificial Intelligence: Consultation reportFinancial Stability Board · 10 June 2026