Operationalizing AI Governance Gives Banks an Advantage in Scaling AI

• Most Banks Permit AI Agents in Production for Select Use Cases, but Adoption Is Limited and Only 8% Have Comprehensive Controls
• Nearly Half Reported an AI-Related Issue or Incident in the Past 12 Months
• Most Have Governance Foundations in Place, but Day-to-Day Controls Lag
• Banks with More Mature Risk Management Are 2.5 Times More Likely to Be Advanced AI Adopters

BOSTON-AI agents are entering production at most major banks, but few have a comprehensive framework to monitor and control them. A new Boston Consulting Group (BCG) benchmark of 26 global and domestic systemically important banks finds that agentic AI has reached production at most banks, but usage remains limited, and agent-specific monitoring and control capabilities are still being built out. Seventy-three percent of banks permit agents in production for select use cases. However, at 88% of banks, agents make up 10% or less of the AI portfolio, and only 8% have a comprehensive, standardized monitoring and control framework that explicitly covers agents.

These are among the findings of AI Safety and Governance in Banking 2026: Why Operationalizing Governance Gives Banks an Advantage Scaling AI. The benchmark examines how prepared the banks are to govern AI as it becomes more autonomous, assessing their AI adoption and the maturity of their AI risk management. It also finds that banks that have their governance right are better at scaling, challenging the assumption that governance and speed are a tradeoff.

"Agentic AI has arrived, but most banks are cautious in scaling aggressively, as they are lacking the controls and especially the monitoring capabilities for increasingly autonomous agents," says Anne Kleppe, BCG's global lead for AI safety and governance, and coauthor of the report. "As AI scales and becomes more autonomous, the next challenge is clear: turning governance from a framework into an operating capability. With agents still a small share of AI portfolios at most banks, there is a window to get that right before their use expands."

Scaling AI Agents Safely Will Require Monitoring Capabilities That Few Banks Have Fully Built

Agentic AI systems can plan and execute multistep tasks, take actions, and adjust their approach without requiring human input at every step. Banks are only beginning to develop the controls needed to manage these systems.

• Limited Deployment. Ninety-two percent of banks are piloting or permitting agentic AI, and 73% permit agents in production for select use cases. None permit broad production use, and at 88% of banks, agents make up 10% or less of the AI portfolio.
• Restrictions to Manage Risk. Fifty-four percent have defined restrictions or prohibitions on agentic AI in their risk-appetite frameworks. Only 8% have a comprehensive, standardized monitoring and control framework that explicitly covers agents.

Most banks do not yet have the capabilities to monitor and control agents comprehensively, and more than half are relying on restrictions and prohibitions to manage the risks in the meantime. Moving beyond the deployment of select use cases will require banks to build frameworks and technical capabilities to monitor and control agents in a standardized and scalable way.

Nearly half of banks (46%) reported an AI-related issue or incident in the past 12 months, while more than a quarter said AI systems were falling behind their promised business case. These findings show that AI risk is already here, and its downside can include lost value in addition to major risk events.

Governance Foundations Are Largely in Place, but Day-to-Day Control Lags

Most banks have put the basic structures of AI governance in place. Almost all (96%) manage AI risk through their existing risk frameworks, 73% have defined their appetite for AI risk (up from 57% in 2025), and 77% have a dedicated AI policy. But translating those policies into operational controls remains a challenge. Fewer than half of the banks have a centralized, tool-based AI inventory, and none have a comprehensive human-oversight framework that is consistently implemented across AI systems.

Governance and Speed Do Not Have to Be a Tradeoff

BCG's research challenges the assumption that stronger AI governance slows banks down: banks with more mature risk management are 2.5 times more likely to be advanced AI adopters. For example, banks that use standardized, previously approved patterns for lower-risk AI applications are nearly twice as likely to move those applications from idea to production in under six months. By standardizing what repeats, they can reserve deeper review for novel and higher-risk uses.

"Banks have largely built the foundations for governing AI, and the benchmark shows that governance and speed need not be a tradeoff," says Matteo Coppola, global leader of BCG's Risk and Compliance practice, and coauthor of the report. "The banks that are applying governance best in day-to-day operations are the ones scaling AI most extensively. The task now is to extend that discipline to agents before they become more deeply embedded."

Media Contact:
Bruce Wraight
[email protected]

About Boston Consulting Group

Boston Consulting Group bridges the gap between ambition and outcomes for the world's leading companies and organizations. We are built for this era of unprecedented change - bringing strategic clarity rooted in over 60 years of deep domain knowledge, combined with applied AI shaped by our practitioners. BCG works shoulder-to-shoulder with CEOs across industries and geographies to deliver transformative impact at scale: stronger returns, transferred capabilities, and change that sticks. For more information, visit bcg.com.