Frontier AI models are becoming increasingly capable of performing complex tasks autonomously, and banks remain cautious about deploying agentic AI widely. As AI capabilities advance, banks need to move beyond establishing governance policies and principles to building the capabilities required to operationalize AI consistently in practice.
BCG’s AI Safety and Governance in Banking Benchmark, based on 26 global and domestic systemically important banks, examines how prepared institutions are for this next phase. The findings reveal an industry at different stages of readiness: most banks have established the foundations of AI governance, but their capabilities to put those frameworks into practice and scale AI safely vary considerably.
Three findings from the benchmark stand out:
- Agentic AI is in production at most banks, but usage remains limited, and agent-specific monitoring and control capabilities are still being built out. Seventy-three percent of banks permit agents in production for select use cases. However, at 88% of banks, agents make up 10% or less of the AI portfolio, and only 8% of institutions have a comprehensive, standardized monitoring and control framework that explicitly covers agents.
- Operational governance maturity is becoming a differentiator. Most banks have established foundational AI risk frameworks, but significant gaps remain in translating these into a consistent, scalable operating capability. Seventy-seven percent of institutions have a dedicated AI policy, yet fewer than half have a centralized, tool-based AI inventory, and none report a comprehensive human-oversight framework consistently implemented across AI systems.
- Effective governance enables speed. Banks in the top third for more mature risk management were 2.5 times as likely to be advanced AI adopters as those in the bottom third. Banks using preapproved AI patterns were also twice as likely to move lower-risk applications into production in under six months.
BCG assessed institutions along two dimensions: AI adoption and AI risk maturity. The analysis reveals four broad groups, from banks still building their governance foundations to those combining higher adoption with more mature risk management. Importantly, even institutions with relatively high overall AI risk maturity tend to be less prepared to govern agentic AI. (See the exhibit.)
The governance challenge extends beyond banks’ own AI systems. Technology providers can change AI capabilities after initial approval, while business users can increasingly build or configure their own agents. Both developments make it harder for banks to keep track of which AI systems are in use and how their capabilities and risks shift over time as well as to ensure that the appropriate controls are applied throughout the life of an AI system.
For CEOs and CROs, the benchmark points to four priorities:
- Standardize governance for repeatable AI uses using preapproved patterns and reusable controls, while reserving more in-depth reviews for novel and higher-risk applications.
- Strengthen continuous testing and monitoring to track how AI systems behave in production, detect problems, and intervene when necessary.
- Extend oversight throughout third-party relationships, including changes to AI capabilities, provider concentration, fallback arrangements, and exit plans.
- Establish safeguards for citizen development, including up-to-date AI inventories, training, permissions, approved platforms, and monitoring.
The choices banks make now will determine how effectively they can manage AI as its capabilities and adoption advance. Speed and control are often seen as competing objectives. Our findings suggest that effective governance can support both.
With agentic AI still at an early stage of deployment, banks have an opportunity to build the operational capabilities needed to manage more autonomous systems before their use becomes widespread. Doing so can give banks the confidence to scale AI and ultimately unlock greater business value.
