Most financial institutions using high-autonomy AI lack incident procedures

New research from Parker & Lawrence Research finds that 81% of financial institutions using high-autonomy AI in risk and compliance have no AI incident-management procedures. The study spans 300 firms across six markets and shows AI use has moved into production even as governance controls lag.

Why it matters: - Financial institutions are deploying AI more deeply in risk and compliance, but control systems are not keeping pace. - The gap raises operational, regulatory and model-risk exposure as AI systems move from recommendation to action. - The findings suggest many firms may be scaling AI without the basic governance needed to respond to failures or harmful outputs.

What happened: - Parker & Lawrence Research published AI in Risk & Compliance 2026 on September 30, 2026. - The report is based on surveys of 300 financial institutions in the UK, France, the US, Australia, Singapore and the UAE. - The research also includes a survey of 100 technology providers, expert interviews and product-focused market research. - 72.0% of the institutional sample, or 216 firms, report using high-autonomy AI in at least one risk and compliance domain. - Among those firms, 81.0% report no AI incident-management procedures. - 70.4% report no pre-deployment review and approval. - 65.3% report no AI inventory or use-case register.

The details: - The report defines high autonomy as AI acting with human review by exception or executing autonomously within predefined controls. - 89.7% of institutions report fewer than half of the 13 assessed AI governance and control capabilities in place. - The average institution reports only 4 of the 13 capabilities. - Across the seven assessed risk and compliance domains, 65.6% of reported AI activity is already at production stage or beyond. - 58.4% of reported AI activity involves AI taking action rather than only providing information or recommendations. - Firms with higher AI deployment report more policies, oversight, testing and monitoring than low-deployment firms. - The uplift in controls does not match the greater intensity of AI use. - Firms relying only on general employee access to foundation models report the fewest controls on average, with less than 3 of the 13 assessed capabilities in place. - The report includes benchmarks for AI spend, realised ROI, deployment depth, autonomy and decision impact. - The report also includes the AI Deployment Intensity and AI Control Maturity indices. - Additional analysis covers differences between ROI leaders and laggards, plus deep dives across financial crime compliance, conduct risk, compliance management, cybersecurity, technology risk, data risk and ESG. - The report compares AI regulatory prescription and implementation maturity across six markets. - It also examines hybrid AI architectures, the changing role of agents, and a market map of AI-enabled RegTech providers. - The full report is available here.

Between the lines: - The research points to a maturity mismatch: AI is already embedded in operational workflows, but governance is still catching up. - That pattern matters most where AI can initiate actions, not just surface insights, because control failures can move directly into business processes. - The weakest control posture appears among firms using broad employee access to foundation models, which may indicate uneven oversight outside centralized AI programs.

What's next: - The report positions governance maturity, not just adoption, as the next benchmark for financial-sector AI programs. - Firms expanding high-autonomy use will likely need to build incident response, inventories and pre-deployment controls before regulators and internal risk teams force the issue. - Parker & Lawrence Research says the report is available to buyers and stakeholders as a market reference point.