BOSTON -- November 13, 2026 -- Boston Consulting Group (BCG) reports that 73% of the 26 systemically important banks in its benchmark permit AI agents in production for select use cases, while only 8% have a comprehensive, standardized framework to monitor and control them. By FairsOnline's calculation, that is about 19 banks running agents against roughly two with full controls, a ratio of about nine to one.
No bank in the sample permits broad production use of agents. At 88% of banks, about 23 of the 26, agents make up 10% or less of the AI portfolio, according to the report "AI Safety and Governance in Banking 2026".
Restrictions and prohibitions stand in for monitoring at most banks
Ninety-two percent of the banks are piloting or permitting agentic AI. Fifty-four percent, about 14 banks, have written restrictions or prohibitions on agents into their risk-appetite frameworks. BCG says more than half rely on these limits to manage risk until agent-specific monitoring is built.
The report defines agentic systems as those that plan and execute multistep tasks, take actions and adjust their approach without human input at every step. Moving beyond select use cases will require standardized, scalable monitoring, BCG says.
Almost half of the banks logged an AI incident within 12 months
Forty-six percent of the banks, about 12 of 26, reported an AI-related issue or incident in the past 12 months. More than a quarter said their AI systems were falling behind the promised business case. BCG's read is that the downside of AI risk includes lost value as well as major risk events. The company did not disclose which banks took part or what the incidents involved.
Policy is in place, but operational controls trail
Ninety-six percent of banks manage AI risk through existing risk frameworks, and 77% have a dedicated AI policy. The share that has defined its appetite for AI risk rose to 73% from 57% in 2025, a gain of 16 percentage points.
Operational tooling is thinner. Fewer than half have a centralized, tool-based AI inventory. None has a human-oversight framework that is consistently implemented across AI systems.
Mature risk management correlates with faster AI scaling
Banks with more mature risk management are 2.5 times more likely to be advanced AI adopters, according to BCG. Banks that use standardized, previously approved patterns for lower-risk applications are nearly twice as likely to move them from idea to production in under six months. BCG says this lets them reserve deeper review for novel and higher-risk uses.
Anne Kleppe, BCG's global lead for AI safety and governance and a coauthor, says agents are still a small share of AI portfolios at most banks, leaving a window to build controls before their use expands. Coauthor Matteo Coppola, global leader of BCG's Risk and Compliance practice, says the banks that apply governance best day to day are scaling AI most extensively.