AI in financial services: adoption, impact and risks

AI in financial services: what the Cambridge survey found

The Cambridge Centre for Alternative Finance’s 2026 Global AI in Financial Services Report gives leaders a useful view across firms, vendors, and regulators. Its 628 respondents included 203 fintech firms, 149 traditional financial institutions, 146 AI vendors, and 130 regulatory authorities. Data were collected between October 2025 and January 2026 across organisations operating in 151 countries.

This was a voluntary survey of informed respondents, not a census of the sector. The report says responses reflect self-assessment and may carry selection bias. Its figures describe the participating organisations; they should not be presented as the proportion of every financial firm that has adopted AI.

Three different survey questions and measures; the figures are shown together to frame a management discussion, not as a conversion funnel. Source: Cambridge Centre for Alternative Finance, 2026.

Adoption is not the same as business impact

When a team says it has “adopted AI”, that could describe an experiment, a tool used in one department, or a system embedded in a critical service. Cambridge distinguishes these stages. Among surveyed firms, 40% reported advanced adoption, yet only 14% described AI as transformational to strategy and competitive advantage. The gap invites a more precise question: what has changed for the business because of the deployment?

Perceived productivity improvements are visible in the report, particularly in technology, data, product, and operations functions. Evidence of enterprise value is harder to assemble. Cambridge found that 55% of surveyed industry respondents struggled to measure AI’s value, rising to 76% among large financial institutions. It also found 40% reported increased profitability, while 43% reported no change. These are self-reported outcomes and do not establish that AI alone caused the difference.

A sound investment case pairs a measure of speed with measures of rework, error, cost to serve, and customer outcome. For example, a faster customer response is useful only if answers remain reliable and exceptions can be handled. Leaders should decide which result matters before buying more capacity or widening a pilot.

The risks sit inside everyday operations

The Cambridge respondents broadly agreed on two leading concerns: data privacy and protection, and unreliable AI outputs. Among surveyed industry firms, 74% cited privacy and protection, while 70% cited hallucinations and unreliable outputs among the top risks. Those concerns are practical. A system can expose information, produce a convincing wrong answer, or embed an error in a process that staff no longer examine closely.

Data quality is also a constraint on progress. In the Cambridge survey, 40% of industry respondents cited data availability and quality as a leading challenge; the figure was 49% among traditional financial institutions and 34% among fintechs. A model built on fragmented records may generate polished output without a dependable factual basis. That is a business design problem, not solely a model-selection problem.

The Bank of England and FCA’s 2024 UK survey likewise identified data privacy, data quality, and data security among firms’ leading perceived risks, and highlighted growing concern about third-party dependence. Its population and dates differ from Cambridge’s global survey, so it is corroboration of the themes rather than a directly comparable trend.

Governance should enable a measured pace

In a June 2026 statement, the FCA said it would rely on existing frameworks, including the Consumer Duty, the Senior Managers and Certification Regime, and expectations for governance and controls, rather than introduce AI-specific rules at that point. That is a UK regulatory position, not a description of requirements in every jurisdiction covered by Cambridge’s research. Firms should assess their own activities and obligations before drawing a compliance conclusion.

The useful leadership response is proportionate. A low-consequence internal aid does not need the same oversight as a system influencing customer treatment, fraud decisions, or access to a financial product. For consequential use cases, set an accountable owner, define the review and challenge process, test outputs against real cases, and agree what evidence would justify scaling.

CyberSolace’s AI System Data Security Self-Assessment offers a practical starting point for checking data handling, supplier dependencies, and oversight before a use case grows. Security leadership support can then help management address the gaps and keep those decisions visible.

Five questions for the next investment review

1. What business result are we buying? Name the process, a baseline measure, and the outcome the AI use case should improve.
2. What would count as a harmful error? Include customer, financial, privacy, and operational consequences.
3. Can we see whether it works? Measure quality and exceptions as well as speed and usage.
4. Who can challenge or stop it? Give a named owner the evidence and authority to intervene.
5. What happens if a supplier or data source fails? Test the fallback and decide how the service continues.

Use the answers to decide whether to scale, redesign, or stop a use case. The aim is to make the investment decision visible, repeatable, and responsive to what actually happens in operation.

If you would like an independent view of the security and governance around a financial-services AI use case, start a conversation with CyberSolace.