AI Regulation and the Regulated Enterprise — Trajectory to 2030

Narrative

The trajectory of AI regulation in financial services from 2023 to 2026 reveals a growing divergence between the European Union's prescriptive approach and the United Kingdom's principles-based, contextual framework, alongside increasing industry adoption and regulatory scrutiny. The EU AI Act, which entered into force in August 2024, establishes a risk-based framework with high-risk obligations becoming enforceable in August 2026, particularly impacting financial services. This legislation, with its extraterritorial reach, mandates extensive compliance requirements such as risk management, data governance, transparency, and human oversight for high-risk AI systems, creating a layered compliance challenge for firms operating across jurisdictions.

In contrast, UK financial services regulators, including the FCA, PRA, and Bank of England, have consistently signalled a technology-neutral stance, preferring to oversee AI through existing regulatory frameworks rather than introducing new AI-specific rules. However, this approach has drawn criticism from the House of Commons Treasury Committee, which in January 2026 warned that a 'wait-and-see' attitude risks serious harm to consumers and financial stability. The Committee called for AI-specific stress testing, clearer guidance on consumer protection and Senior Managers and Certification Regime (SMCR) accountability, and the designation of major AI and cloud providers as critical third parties. The FCA's Mills Review, launched in January 2026, is specifically examining the long-term impact of AI on retail financial services, with recommendations expected by summer 2026.

Despite regulatory complexities, financial institutions are rapidly increasing their investment in AI, with 83% of CFOs planning to boost enterprise-wide AI spending by over 15% in the next two years, according to Bain & Company. The Cambridge Centre for Alternative Finance's 2026 report indicates that 81% of financial services firms are adopting AI, though only 14% are considered mature in their implementation, with fintechs leading incumbents in advanced adoption. McKinsey & Company highlights the need for Chief Risk Officers to spearhead AI risk management, emphasising clear governance frameworks and ethical guidelines, and viewing compliance as an enabler for scaling AI rather than merely a cost.

Analyst firms like Gartner predict an 'AI-First Finance Function' by 2026, underscoring the importance of transaction integrity for scaling AI, while CB Insights notes a shift where compliance is becoming a competitive differentiator. However, challenges remain, including ensuring AI system accuracy, managing vendor landscape risks, protecting data security and privacy, and retaining human accountability for outcomes, particularly as agentic AI systems gain greater autonomy. Firms are urged to proactively map AI systems against risk categories and extend model risk management frameworks to cover bias and data governance, building governance infrastructure before further guidance arrives.