Most financial services firms know they should be doing something with AI, and plenty are still holding back. That isn’t ignorance. It’s a considered response to real concerns that don’t get discussed honestly enough.

The hesitation is understandable. The cost of standing still, though, is rising faster than most firm owners realise.

The main reasons firms hold back

Firms hold back because of several overlapping concerns, none of them irrational on its own. Together they create a kind of paralysis, where acting and not acting both feel too risky to manage.

The three that come up most are regulatory uncertainty about what AI use is allowed and expected, cybersecurity liability from running systems the firm doesn’t fully control, and the internal change needed to make AI work at all. Each deserves to be taken seriously.

What UK regulation requires of firms using AI

The regulatory signal has sharpened in the past few months. The FCA and the Bank of England have said formally that frontier AI models now go beyond baseline cyber resilience capabilities, and they treat AI governance as a firm obligation rather than internal good practice [1]. That’s a significant change in tone.

For a small or mid-sized advice firm, it means “we haven’t thought about AI yet” is no longer a safe answer. It may not lead to enforcement tomorrow, but it leaves you without a position on something regulators are actively watching. A firm that can explain its AI use, or its deliberate decision not to use it, to a supervisor is in a stronger position than one that can’t.

EIOPA has separately found that data privacy and security, regulatory compliance including GDPR, and a skills shortage are the barriers most often cited by insurance and financial firms across Europe [2].

The firms that wait for regulatory certainty before acting will find that certainty arrives as an obligation, not a permission.

Consumer Duty and SM&CR already require firms to show how they reach decisions that affect clients. If AI is part of that process, it has to be auditable, with a person signing off at every point where a regulated judgement is made. That’s a design constraint rather than a barrier. Build to it from the start and it’s manageable.

The cybersecurity risk of AI in financial services

AI does carry real cybersecurity risk, and it gets less attention than it should.

The attack surface has grown beyond what most firms are ready for. The risks now include prompt injection (malicious input that makes an AI system behave outside its intended limits), manipulating a chatbot’s persona, and getting round its behavioural guardrails [1]. Any firm running an AI assistant, even a simple one, carries an operational risk it may not have assessed.

Then there’s vendor stability. Some of the application-layer AI tools firms have built workflows around are under pressure as compute costs rise, and some of those startups will move upmarket or fold. A firm that has built a third-party AI tool into its suitability review and then finds it discontinued or changed has a continuity problem and possibly a compliance gap. Disputes over IP and data rights in commercial AI agreements add legal exposure for firms that signed without proper scrutiny [6]. Choosing an AI vendor has become a compliance decision as much as a procurement one.

None of that means don’t use AI. It means building the governance in from the start rather than adding it afterwards.

The skills and culture gap

Firms talk about this barrier least and run into it most.

Gartner names security and governance concerns, along with skills gaps, as the main obstacles slowing production use of agentic AI [3]. The skills gap is only partly technical. It’s the distance between what a tool can do and what a team is ready to do with it: how to check it, when to override it, and who’s responsible when it goes wrong.

In financial services that distance is wider than in most sectors, because a bad AI output has real regulatory consequences. A suitability letter drafted with AI and sent without a qualified adviser reviewing it is a potential compliance failure, not a minor quality issue. The workflow has to reflect that, and building those workflows takes time and clear ownership.

The distinction that matters is between adding AI tools on top of existing structures and redesigning how the work is done in light of what the tools can do. Most firms with disappointing AI experiences tried the first. The second is harder, and it’s the one that lasts.

What staying on the sidelines costs

The efficiency gap is real and growing. Intelliflo’s 2026 research reported 97 per cent time savings on specific administrative processes at tech-engaged advice firms [4]. That’s a vendor figure for particular use cases, not a whole-firm average, but the direction holds: firms that have started putting AI into operational workflows are freeing up adviser time, and those that haven’t are carrying the admin at full cost.

The EBA’s 2026 report on digital transition in banking recorded 2,554 significant incidents in 2024, up from 2,343 in 2023, as digital infrastructure became more complex [5]. A firm without an AI governance framework adds to that risk with every tool it eventually deploys in a hurry rather than by design.

The competitive picture is moving too. Intelliflo’s data shows the share of “Champion” firms, those using technology strategically, rose by roughly a third in a year, while the cautious “Explorer” group shrank [4]. The middle ground is thinning.

My read

The firms doing this well aren’t the ones with the biggest technology budgets or the biggest appetite for risk. They’re the ones that took the question seriously, started with tools they already licence (most firms on Microsoft 365 or Google Workspace have AI capability they aren’t using), proved one process with a review step built in, and wrote down their position, even where that position was “not yet”.

Waiting won’t make the regulatory picture clearer. The FCA and Bank of England are moving towards expecting firms to have a demonstrable position on AI governance, not towards giving cautious firms more time [1]. Caution was a reasonable answer in 2024. In 2026, I think the defensible position is careful, documented, small-scale use with governance built in, and the firm that still has no written view on AI at all is the one most exposed when a supervisor asks.

This article is for informational purposes only and does not constitute regulated financial advice or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

  • [1] FCA and Bank of England, joint statement on frontier AI and cyber resilience, 2026. Primary source for the regulatory declaration that frontier AI exceeds baseline cyber resilience capabilities and constitutes a hard governance obligation for UK financial services firms. Available via FCA Publications.
  • [2] EIOPA, report on generative AI adoption barriers in European insurance and financial services, 2026. Source for data privacy, GDPR compliance, and skills shortage as leading reported barriers.
  • [3] Gartner, Hype Cycle for Agentic AI 2026 (2026). Vendor-sourced. Source for security, governance, and skills gaps as primary obstacles to production AI adoption.
  • [4] Intelliflo, Intelliflo Insights research report, 2026. Vendor-sourced. Source for 97% time savings figure on specific administrative processes, and for Champion/Explorer cohort shift data.
  • [5] EBA, report on digital transition in the banking sector, 2026. Source for significant incident counts: 2,554 in 2024 vs 2,343 in 2023.
  • [6] Reported commercial litigation context around AI partnership agreements and IP/data rights disputes, 2026. Source for the claim that AI commercial contracts carry material legal exposure for regulated firms.