Sixty-four per cent of financial services firms are already investing in AI, according to Emerj’s research.[1] That isn’t surprising. What is surprising is how few of those investments produce anything a client or a regulator would recognise as a better outcome, and the gap between spending and results is the main problem advice firms have with AI in 2026.

I don’t think AI is overhyped. I think most firms adopt it in the wrong order. The ones that benefit aren’t the ones spending the most. They’re the ones that know what problem they’re solving before they buy anything.

Where AI is producing value in advice firms now

AI is already part of day-to-day operations in financial services, not a future topic. TCS has partnered with Anthropic to run Claude across its own operations and build sector-specific products for regulated industries.[2] EIOPA named a data-driven culture as a strategic priority in its 2025 annual report, including support for using AI in risk management.[3] The tools work. The open questions are which ones to use and how to govern them.

For an IFA or wealth management business, the areas producing value right now are fairly narrow:

  • Meeting preparation and follow-up. Tools that read the client file, recent contact and portfolio position before a review can draft notes and flag points for the adviser, with a person checking the output before anything is acted on or sent.
  • Compliance support. Monitoring, flagging and documentation work that’s rule-bound and repeatable, with a qualified person reviewing what the system surfaces.
  • Paraplanning. First-draft reports, research summaries and suitability letters, all reviewed before any document reaches a client.
  • Operational triage. Routing incoming queries, sorting documents and pulling out the exceptions that need a human decision.

Aaron Klein, founder of Conteo, has built what he calls an “operating system for meetings” that prepares advisers for client reviews from previous conversations.[4] It does one specific job. That narrowness is deliberate, and it’s the principle worth copying.

The governance mistakes most firms are making

The gap between deploying AI and being able to secure, evaluate and govern it is creating liability for regulated firms, as VentureBeat’s reporting on enterprise AI spend puts it.[5] One engineering blog’s tracking puts the share of finance firms with AI pilots that haven’t reached production at 21 per cent.[6] The usual reason isn’t technical. It’s that nobody designed the governance a regulated production system needs at the start.

The FCA has noted wide variation in how firms approach risk assessment,[7] and a firm running AI without a proper governance framework is likely to attract closer scrutiny. The European Central Bank has pointed to real discrimination risks in customer-facing AI that hasn’t been properly validated.[8] Neither is a reason to stop. Both are reasons to build carefully.

The firms that benefit from AI are not the ones running the most tools. They are the ones that know, for each tool, exactly who reviews its output before it reaches a client or a regulator.

Three failures come up again and again:

Treating AI output as finished. A suitability letter drafted by AI is a starting point for a qualified adviser, not a deliverable. Under time pressure that line blurs, so it has to be built into the system rather than left to habit: an AI-drafted document can’t be sent without a named person signing it off.

Letting AI agents share credentials with core systems. VentureBeat reported that 54 per cent of enterprises have had an AI agent security incident, and most still let agents share credentials.[9] For a firm holding client financial data, that’s a route to a breach.

Buying infrastructure faster than you can measure what it costs. AI spend is growing faster than the means to attribute or justify it.[5] In a regulated business that’s a governance gap as well as a financial control weakness.

Level 1, Level 2 and Level 3 in an advice firm

Most firms come to AI conversations thinking they need a custom build. Most don’t.

Level 1 (education) covers what’s already inside tools you pay for: Microsoft 365 Copilot in your existing licence, better prompting of the tools your team already uses, a template library for paraplanning first drafts. No extra spend and no integration work. For a lot of firms, this alone frees up a noticeable amount of paraplanning and admin time.

Level 2 (integration) connects two or three existing systems so information moves between them without being typed in twice. A CRM that updates itself after a client call. A compliance checklist that starts when a case reaches a certain stage. This is configuration work, usually days to a few weeks, not a major technology project.

Level 3 (custom build) is real engineering: custom pipelines, complex logic, work across several data sources. It suits a small number of firms with complex, high-volume problems. It isn’t where most advice businesses should start.

Try Level 1 first. One of the top hotels in the UK came to me expecting a large outside project, and most of what they wanted turned out to be possible with the Copilot licences they already had. Advice firms are often in the same position.

A 90-day plan for an advice firm

This isn’t a transformation programme. It’s a sequence of decisions a senior manager can work through without starting a project.

List the five tasks that take the most time relative to how complex they are. Not the ones that feel strategic. The ones where qualified people spend hours on rule-bound, repetitive work that doesn’t need their professional judgement. These are your Level 1 candidates.

For each one, check whether a tool you already pay for can do it. Microsoft 365, your CRM and your back-office platform all have AI features most firms aren’t using. Checking takes an hour or so.

Find one place where two systems should talk to each other and don’t. In advice firms the common one is the gap between the meeting note and the compliance record. If someone copies information from one to the other by hand, that’s a Level 2 candidate.

Before anything touches a client or a regulatory output, write down who reviews it and what they’re signing off. Most implementations skip this. Answer it before you deploy, not after an incident.

Treat AI spend like any other operating cost. What does it cost, what does it produce, and who’s accountable for the answer? If you can’t say for a tool you already use, sort that out before adding another.

How AI changes the fraud risk

AI also changes the threat side. Anthropic’s own research suggests powerful AI models could be widely available to attackers within six to twelve months.[10] For a regulated firm, that means AI-enabled fraud and social engineering are growing faster than most compliance frameworks were designed for.

Identity verification, voice and video authentication, and any process that relies on one person recognising another are now material risks. You don’t need a new technology programme for this. You do need to review your existing fraud and impersonation controls with this threat in mind.

The next step

Most financial services firms will need to take AI seriously to stay competitive. The ones that rush it, buying infrastructure before governance and counting tools instead of client outcomes, are the ones likely to end up in front of a regulator. Start with the list of five tasks above. It takes an afternoon, and it tells you whether you have a Level 1 problem or something bigger.

This article is for informational purposes only and does not constitute regulated financial advice or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

[1] Emerj, ‘AI in Financial Services Executive Cheat Sheet’, Emerj Artificial Intelligence Research, 2026. Available at: https://emerj.com/fcs1 [Source date unconfirmed; treat statistic as indicative.]

[2] Anthropic, ‘TCS and Anthropic partnership announcement’, Anthropic, June 2026. Available at: https://www.anthropic.com/news/tcs-anthropic-partnership

[3] EIOPA, ‘Annual Report 2025’, European Insurance and Occupational Pensions Authority, 2026. Available at: https://www.eiopa.europa.eu/publications/annual-report-2025_en

[4] fintech-impact, episode featuring Aaron Klein, Founder, Conteo, 26 May 2026. [Cited for named application of AI in financial adviser meeting preparation.]

[5] VentureBeat (2026) ‘The AI compute gap: enterprises are buying infrastructure faster than they can measure what it costs’, VentureBeat, 21 July 2026. Available at: https://venturebeat.com/ai/the-ai-compute-gap-enterprises-are-buying-infrastructure-faster-than-they-can-measure-what-it-costs

[6] Zen van Riel (2026) ‘AI agent scaling gap: pilot to production’, AI Engineer Blog, June 2026. Available at: https://zenvanriel.com/ai-engineer-blog/ai-agent-scaling-gap-pilot-production-2026 [21% figure for finance sector pilots not reaching production.]

[7] FCA (2026) ‘Non-handbook guidance: CorePRU 7 overall risk assessment’, Financial Conduct Authority, July 2026. Available at: https://www.fca.org.uk/publications/guidance-consultations/gc26-4-non-handbook-guidance-corepru-7-overall-risk-assessment

[8] European Central Bank (2024) Research evidence on customer-facing AI discrimination risks in financial services. [Industry report cited for validation requirements in customer-facing AI deployments.]

[9] VentureBeat (2026) ‘The agent security gap: 54% of enterprises have already had an AI agent incident and most still let agents share credentials’, VentureBeat, 18 July 2026. Available at: https://venturebeat.com/ai/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials

[10] Anthropic (2026) ‘Expanding Project Glasswing’, Anthropic, June 2026. Available at: https://www.anthropic.com/news/expanding-project-glasswing