The Bank of England and Financial Conduct Authority's new AI survey gives financial-services teams a practical reason to revisit what happens after deployment approval. Respondents reported initial reviews much more widely than continuing monitoring. For compliance and model-risk owners, the useful next step is to check whether a deployed system still has current evidence behind its controls.
The joint report, published on October 26, 2026, describes participating firms' practices. It does not announce a new AI rule or establish that any particular firm's controls failed.
What the survey establishes
The report received 196 responses, including 105 full questionnaires. Unless specified otherwise, results use the full survey and valid responses to each question. More than 90% reported human approval, pre-deployment review and vendor due diligence as data-risk controls. Around half reported ongoing monitoring, leakage testing and periodic review or recertification. Third-party systems accounted for 53% of reported high-materiality AI systems.
These are self-reported findings, not an independent inspection or a sector-wide census. Question wording and respondent populations also limit comparisons with earlier surveys. Independent coverage by The Perimeter Report corroborates the monitoring gap in the published results; it does not independently test the underlying controls.
Turn approval evidence into a continuing record
Maetra's analysis is that an approval should begin an evidence lifecycle. An assessment made before launch cannot by itself explain what changed afterward. A supplier can revise a model, an application owner can add a tool, or a workflow can start handling a different class of information. Each change creates a question about whether the earlier assessment still describes the system.
For a hypothetical customer-service assistant, consider an initial permission to prepare draft replies. If a later integration lets it send messages, the control record should identify the new capability, its owner and the reason the previous evidence remains adequate or needs revision. A successful launch review would not answer those questions on its own.
A useful evidence record therefore connects the system and workflow to the control being tested. It records the test date, the tested version, the owner, the result and the next review trigger. That gives a reviewer something concrete to inspect when a supplier notice or internal change arrives.
Ask suppliers for evidence that can expire
A vendor assurance document can support a decision without covering every local deployment choice. Teams should specify which assurance claim they rely on, which component it covers and which conditions would make it stale. The aim is to make the dependency reviewable by someone who did not negotiate the original contract.
Useful questions for the supplier include whether the relevant test covered the deployed version, whether connected tools were included and how customers receive material change notices. A missing answer should become an assigned follow-up with a due date. It should not disappear into a general statement that the vendor has been assessed.
Keep supplier evidence separate from evidence generated inside the firm. A provider's security test and a local workflow test may support the same control, but they answer different questions. Retain their scope and dates when mapping them to a requirement so that reuse does not hide a coverage gap.
Review one live workflow this week
The following is an operational recommendation, not a checklist issued by the regulators:
- Select one deployed AI workflow whose output or action could affect a customer.
- Identify its current model, supplier, tools, data access and accountable owner.
- Locate the last test of the actual deployed configuration.
- Define the changes that require a fresh review and the person responsible for noticing them.
- Set a next review date and document how an overdue evidence item is handled.
For an action-taking agent, include the boundary between a recommendation and execution. A human review may be appropriate for some actions, while other actions can run within defined permissions. What matters is evidence that the chosen control operates where the action occurs.
An AI audit evidence record can help structure the questions about versions, decisions and results. It should remain connected to the workflow rather than becoming a detached archive.
Keep the compliance interpretation proportionate
The survey is a useful diagnostic for governance discussions. It cannot tell a firm which legal requirements apply to its own services, or prove that adding monitoring produces compliance. Those decisions need the firm's applicable obligations, risk assessment and evidence.
For teams using Maetra, Comply supports framework mapping and evidence freshness, while Audit preserves relevant history. Neither replaces a supplier assessment or application testing. Start with one control whose evidence has become hard to locate or date, and use Maetra's framework resources to connect it to an accountable review process.
Sources
- Bank of England and FCA: Artificial intelligence in UK financial services, 2026, October 26, 2026. Primary survey and methodology.
- The Perimeter Report: BoE/FCA AI survey 2026, October 26, 2026. Independent reporting on the same survey.