Bank AI Ambitions Outpace Control Systems, Survey Finds

Bank leaders are planning to give artificial intelligence more decision authority than their current control systems appear ready to support. In a new global survey of 300 credit, treasury and risk leaders, 76% said they expect AI to make autonomous risk or credit decisions at scale within five years. Only 18% reported fully operational, embedded governance for AI models today.

The research report, published October 22, was conducted by FT Longitude and sponsored by SAS and Microsoft. It found that 10% of respondents currently use AI for autonomous risk or credit decisions at scale, while 70% place at least moderate limits on autonomous use. The tension is therefore prospective: institutions are signaling broader authority before many have built the operating evidence to support it.

Several controls lag. Nineteen percent said they monitor model drift in real time, 36% continuously update or retrain models, and 42% lack a defined mechanism to deactivate a model that crosses preset boundaries. Sixty-three percent said they would be willing to use a less transparent model if it produced better outputs.

The study is a directional benchmark, not a credit-union estimate

The sample spans 31 countries and is weighted toward large institutions: 66% of respondents worked at banks with more than $50 billion in assets, and 20% were C-suite executives. The public methodology does not make the findings representative of U.S. credit unions. Vendor sponsorship also warrants care, because SAS sells data, risk and AI-governance technology.

Those limits do not erase the operating question. They make it more specific. A credit union should not infer that autonomous decisioning is an inevitable five-year destination. It can use the reported gaps as test conditions before expanding authority in underwriting, pricing, collections, liquidity or fraud work.

Separate assistance from authority

The report says AI already performs an average of 23% of the work inside surveyed decision processes, but it cautions that this does not mean AI makes 23% of the decisions. Document collection, summarization, anomaly detection and scenario preparation can reduce work without transferring the final decision.

That distinction should be explicit in a credit union’s inventory. Each use case needs a recorded authority level: prepare information, recommend an action, execute within a narrow rule, or decide autonomously. The control burden changes at each step. A tool that summarizes a credit file needs source accuracy and review; a system that changes a limit or declines an application also needs legal, fairness, reason, exception and remediation evidence.

Require a control proof before an authority increase

Before expanding autonomy, technology and risk leaders should require evidence that the credit union can detect drift, identify the active model and data version, reconstruct the decision, interrupt the workflow, route affected cases to staff and restore service without losing the record. The approval should identify who can widen authority and who can restrict it.

The NCUA’s current AI resources emphasize that existing safety-and-soundness, consumer-protection, privacy, resilience and third-party expectations continue to apply. Our report on the FSB’s 12 final AI practices provides an institution-wide crosswalk; the AI inventory and change-control playbook connects individual model versions, tests, approvals and rollback evidence.

The survey does not prove that any bank’s planned autonomy will materialize or produce better outcomes. Its useful signal is the gap between intention and control maturity. For credit unions, the defensible sequence is control proof first, added authority second.