27.7% of firms report a 50%+ ROI from their risk and compliance investments, while 69.3% say AI governance controls aren’t keeping pace with their deployments.
Key Takeaways
- 65.6% of financial firms are using AI in daily operations rather than pilots.
- 27.7% of the firms report a return above 50% on their AI spending.
- At 69.3% of the firms, AI use scored higher than oversight on the researchers’ 0-to-100 scales.
- 33.3% of the firms keep a list of where they use AI, and 19% have procedures for handling an AI incident.
Banks, insurers, and other financial firms now use AI in live compliance work, and many say it is paying off, but most have not added oversight to match. Those are the results of AI in Risk & Compliance 2026, a survey of 300 senior risk and compliance executives by Parker & Lawrence Research, a market research firm, and RegTech Analyst, a provider of information and events for compliance professionals.
Writing about the financial industry, the researchers said it “may have solved its ROI problem. But in doing so, there is evidence that it could have created a governance gap.”
Most firms use AI in daily risk and compliance operations, led by cybersecurity and financial crime
Across seven risk and compliance areas, 65.6% of firms use AI in daily operations.
Use is highest in:
- cybersecurity (76% of firms)
- financial crime checks such as anti-money laundering, fraud and sanctions screening (73%)
- compliance management, which covers tracking new regulations and mapping them to internal policies (72%)
It is lowest in monitoring employee trading and communications for misconduct (59%) and in ESG reporting (38%).
In 58.4% of the AI uses firms reported, AI carries out tasks itself rather than only supplying information or recommendations. The report gives the example of customer onboarding where AI agents can gather customer data, run the required checks, and assemble the case for a compliance officer to review. The most common uses are summarizing documents (55% of firms), searching internal and outside sources for information (52.7%), and drafting reports and responses (48.3%).
AI agents already play a part in compliance decisions at 51% of the firms. 14.7% say agents directly shape compliance decisions, and 36.3% say agents supply information that feeds these decisions.
Every firm reports a positive return on its AI spending
27.7% of the firms report a return above 50% on their AI spending, and 13.3% report a return of 1% to 10%. No firm reported a loss. The returns are the firms’ own estimates, not audited figures.
The average firm has 4.4 of 13 oversight measures
The researchers checked each firm for 13 AI governance measures, from a written AI policy to an independent audit. The average firm has 4.4 of them.
Most firms have a written AI governance policy (56%) and rules requiring human oversight of AI (52.7%).
Fewer have measures that track and check individual AI systems: 33.3% keep a list of where they use AI, 29% review and approve an AI system before it goes live, 26.7% monitor how AI systems perform after launch, and 19% have procedures for handling an AI incident. Only 13.7% have an independent auditor check their AI.
A chief compliance officer at a U.S. wealth management firm told the researchers: “I am genuinely surprised by how few firms appear to have these controls in place; you would hope the numbers were much closer to at least 75% or 80%.”
AI use outpaces governance at 69% of firms
The researchers scored each firm from 0 to 100 on how deeply and independently it uses AI and how much AI affects its decisions. They gave each firm a second score, also from 0 to 100, for its oversight measures. For 69.3% of the firms, the AI-use score is higher.
On those 0-to-100 scales, the firms reporting an ROI above 50% scored 4.9 points higher on AI use than the firms reporting 1% to 10%, but only 1.8 points higher on oversight. The researchers concluded that firms are earning returns by letting AI act more autonomously and shape more decisions, faster than they are adding oversight.
The researchers say firms should add oversight first where AI acts most on its own
The researchers say firms do not need to pause AI projects until every oversight measure is in place. They recommend starting with the AI that acts most independently and affects the biggest decisions, and putting these in place:
- an AI inventory
- a risk rating for each AI use
- review before launch
- ongoing monitoring
- incident response procedures
- audit trails
Methodology
The 300 respondents work at financial firms in the U.S. (33%), the U.K. (20%), France, the UAE, Singapore, and Australia. 56% work at established financial institutions and 44% at fintech companies. Their titles range from compliance manager to chief compliance officer, chief risk officer, and chief information security officer.
