Your most material AI is bought, not built

The AI that matters most in UK financial services is increasingly not built by the firms that have to answer for it.

That is the finding worth taking to a board out of the fourth Bank of England and FCA survey, published on 26 October 2026. Adoption is the headline number: 86% of respondents use AI, up from 75% in 2024, with generative AI making up 56% of reported systems. The number that changes governance is quieter. Third-party systems have risen to 39% of all reported AI systems and to 53% of the systems firms themselves classify as high materiality. The material end of the estate has crossed over into bought rather than built.

The survey asked 196 firms, 101 larger and 95 smaller, and most of the detailed figures come from the 105 that completed the full questionnaire. The authors caution against reading the 2024 comparisons too precisely, because question wording, scope and respondent populations differ between rounds. The direction is not in doubt.

The figure that moved

What the survey measured	2024	2026
Respondents using AI	75%	86%
Third-party share of all reported AI systems	33%	39%
Third-party share of high-materiality systems	35%	53%
Share of all systems rated high materiality	16%	7%

Read the last two rows together. The proportion of systems rated high materiality has fallen while the absolute number has risen, which means firms are deploying far more AI and classifying a smaller slice of it as consequential. Within that smaller slice, the majority is now someone else's model. Governance attention has been concentrated onto exactly the population a firm has least ability to inspect.

The survey is also explicit about where that attention is going. Oversight of third-party AI is the most commonly reported governance challenge: 54% of respondents cite the difficulty of applying model risk management to vendor models, and 49% cite overseeing systems provided or materially influenced by third parties. Limited transparency into third-party systems is named as a constraint by 34%, with information security and operational resilience ahead of it at 40%.

Assurance is not understanding

The sharpest pair of numbers in the report concerns high-materiality systems. For the ones built in house, 77% of respondents rely on deep technical understanding of how the system works. For third-party systems, that falls to 24%, and 81% rely on vendor assurance and contractual terms instead.

This is the point at which the survey and the FCA's good practice paper meet. Published on 19 October 2026 and updated the following day, that paper sets out good practice and areas for improvement drawn from supervisory engagement, and states plainly that its examples do not create new requirements, prescribe a single model or replace a firm's responsibility for its own use cases. The existing framework already applies: PRIN, the Consumer Duty, SM&CR, SYSC and operational resilience. Among the areas for improvement on third-party AI, the FCA names relying on vendor assurances without testing them, becoming overly dependent on providers that are hard to replace, and having no exit options for a single platform. It also confirms that firms remain responsible for AI services they outsource.

Contractual assurance and tested assurance are different controls. One transfers a representation; the other produces evidence. Under SM&CR the accountable senior manager is taking reasonable steps either way, and the FCA says it does not expect senior managers to be technical specialists. It does expect the responsibilities to be mapped to named senior management functions from the design stage, with auditable records of decisions, rationale, challenge and escalation.

Where each finding lands on an existing framework

Survey finding	Framework it already engages	What the board should be able to see
53% of high-materiality AI systems are third-party	SS1/23 model risk management principles	A model inventory that separates built from bought at the materiality tier that matters, not one list of tools
24% hold deep understanding of third-party high-materiality systems; 81% rely on vendor assurance	SM&CR reasonable steps	The accountable senior manager able to state the model's known limits without quoting the supplier
54% name applying model risk management to vendor models as a governance challenge	SS1/23 and the FCA third-party expectations	Validation standards and notice of significant model changes written into the contract, then exercised
Pre-deployment controls each reported by over 90%; ongoing monitoring, leakage testing and periodic recertification each by about half	Consumer Duty outcomes monitoring and the FCA monitoring expectations	Drift detected before a customer outcome moves, with thresholds that trigger action
Three cloud and compute providers account for 79% of reported relationships	Operational resilience and SYSC 15A, with DORA for EU group entities	The important business services map naming the model provider, inside a severe but plausible scenario

The controls stop at the door

Pre-deployment controls are near universal in the survey: human approval, pre-deployment review and vendor due diligence are each reported by more than 90% of respondents. Ongoing monitoring, leakage testing and periodic review or recertification are each reported by only about half. Firmwide AI policies exist at 94% of respondents and centralised AI or model risk governance forums at 84%, so the structure is in place. The weakness is in the part of the lifecycle where a bought model changes without being asked.

The FCA describes the same shape from the supervisory side. Its areas for improvement on monitoring include a narrow focus on technical metrics rather than real-world outcomes and drift, monitoring that is reactive or static and so finds harm only after it occurs, and second and third line functions that lack the AI expertise to challenge. On resilience it notes that some firms did not consider AI, or their dependence on AI models, in their operational resilience reviews even as the use cases became more material.

That is a data governance problem before it is a model problem. A vendor model consumes the firm's data and produces outputs that feed decisions and disclosures, so the Critical Data Elements going in and the outputs coming out need owners, lineage and thresholds whether or not the model in the middle can be opened. Lineage that stops at the API call is lineage that stops short of the control.

Concentration is the next question

The survey puts numbers on dependency. The top three cloud and compute providers account for 79% of reported relationships, and the top three model or API providers for 54%. Agentic deployment is widespread but deliberately narrow: 80% of respondents have agents deployed and a further 14% plan to within twelve months, 80% use them for decision support with humans deciding and executing, and only 2% allow broad autonomy. Even including planned use, no more than 9% expect agents to approve or decline customer outcomes, execute trades, initiate payments or change limits. Meanwhile 88% expect frontier AI cyber capabilities to have a moderate or high impact on their risk profile over the next two years.

The restraint on autonomy is real and should be acknowledged. It also means the exposure is not yet about agents acting alone. It is about a concentrated set of suppliers whose models sit inside the firm's most consequential decisions, with the firm's understanding of them resting on paperwork.

Five questions before the next board meeting

Of the AI systems we classify as high materiality, how many are third-party, and who is the named senior management function for each?
For our three largest model or compute dependencies, what have we tested ourselves rather than accepted on vendor assurance, and when?
Do our contracts give us notice of significant model changes, and have we ever exercised that clause?
Which of our important business services would degrade if a single model provider became unavailable, and has that appeared in a severe but plausible scenario?
If a bought model drifted, which monitoring threshold would move first, and would it reach this board before it reached a customer?

A model you cannot open is still a model you have to defend.