Banking regulators in the United States and Europe are increasing scrutiny of how financial institutions deploy advanced artificial intelligence, including so-called agentic systems that can make and execute decisions with limited human intervention. Regulators are asking banks how AI models are controlled, audited and recovered after failures, according to people familiar with the discussions cited by Reuters. The focus reflects growing concern that the same technology promising efficiency could amplify cyberattacks, operational mistakes or market disruptions.
Agentic AI is the main new concern
Traditional AI tools usually provide recommendations or automate narrow tasks. Agentic systems can take actions independently, connect to multiple systems and pursue goals over several steps.
That autonomy can create new operational risks if a model behaves unexpectedly.
U.S. regulators are asking detailed questions
Federal banking agencies are examining how banks use autonomous AI in cybersecurity, fraud detection and internal operations.
They want to know who can stop a system and how decisions are recorded for audit.
European regulators are focused on resilience
The Bank of England and European Central Bank are emphasizing recovery plans for cyber incidents and AI-related failures.
They are concerned that disruption at a large institution or common technology provider could spread quickly.
Foreign-built models add geopolitical risk
Regulators are also asking about models developed in China and other jurisdictions.
Data access, software updates and hidden dependencies can create national-security concerns.
AI concentration could create systemic vulnerability
If many banks rely on the same model provider or cloud platform, a single failure could affect multiple institutions at once.
This is similar to existing concerns about concentration in cloud computing.
Independent backup systems are expensive
Regulators increasingly want banks to maintain recovery capabilities that do not depend on the same AI or infrastructure that failed.
Building genuinely independent systems can be costly and technically difficult.
Rogue agents have raised urgency
Recent incidents involving autonomous software making unexpected changes have shown that testing environments do not capture every risk.
Financial institutions face higher stakes because mistakes can affect payments, markets or customer data.
Rules are still evolving
Watchdogs are not yet imposing one universal set of AI rules. Instead they are using existing operational-risk, model-risk and cyber-security frameworks.
More specific regulation may follow as use cases mature.
The IMF has also warned on cyber resilience
The International Monetary Fund has urged financial systems to strengthen cyber capacity as digital dependence increases.
AI can help defenders detect attacks faster but can also give attackers more scalable tools.
Banks face a difficult balance
Institutions do not want to fall behind competitors by moving too slowly on AI. At the same time, a major failure could create regulatory and reputational damage.
The new scrutiny suggests regulators want innovation to continue, but with clearer accountability and stronger recovery plans.
Sources
- Reuters reporting on U.S. and European banking regulators, Oct. 13, 2026
- IMF financial-stability and cyber-risk guidance
Model risk is moving beyond credit scoring
Banks have used statistical models for decades, but generative and agentic AI can influence a much wider set of activities. Systems may write code, investigate alerts, interact with customers or trigger operational processes. That broadens model risk from a narrow compliance discipline into a core technology-governance issue.
Regulators want institutions to know exactly which actions an AI system can take and where human approval remains mandatory. Clear logs and audit trails are especially important when a model changes data or interacts with external systems.
Third-party vendors create another layer of risk
Most banks do not build every AI model themselves. They depend on cloud providers, software vendors and specialist startups. A vulnerability at one supplier can therefore affect many institutions at once.
Regulators are increasingly asking banks to map these dependencies and prepare alternatives. That could raise costs but also reduce the chance that one vendor failure becomes a systemic event.
The industry may see slower deployment in high-risk functions
Banks are likely to keep using AI aggressively in low-risk tasks such as document processing, while moving more cautiously in payments, trading and cybersecurity automation. The regulatory message is not to stop innovation, but to make failure recoverable.
Another unresolved issue is accountability when an AI system acts across several internal departments. A mistake may involve a vendor model, bank data and a human supervisor simultaneously. Regulators are therefore pushing institutions to define ownership before failures occur. Clear responsibility could become one of the most important governance requirements as autonomous tools spread.
