The Pulse

Most banks in BCG benchmark permit AI agents, but few have full controls

A BCG benchmark found that 73% of 26 systemically important banks permit AI agents in production for select uses. Only 8% had a comprehensive, standardized monitoring and control framework explicitly covering agents.

AI.info Team · · fact-checked · against 2 sources ↓ · Published 13 Nov 2026

Nearly three-quarters of the banks in a Boston Consulting Group benchmark permit AI agents in production for select uses, but few have comprehensive controls specifically covering them. Only 8% had a comprehensive, standardized monitoring and control framework that explicitly covered agents, according to the consulting firm's findings.

The benchmark covered 26 global and domestic systemically important banks. It assessed both their adoption of AI and the maturity of their AI risk management.

Agents remain a small share

BCG found that 92% of the banks were piloting or permitting agentic AI, while 73% permitted agents in production for select use cases. None permitted broad production use.

At 88% of banks, agents accounted for 10% or less of the AI portfolio. Agentic systems can plan and carry out multistep tasks, take actions and adjust their approach without human input at every step.

More than half of the banks, or 54%, had defined restrictions or prohibitions on agentic AI in their risk-appetite frameworks, the benchmark found. Those restrictions sit alongside efforts to develop monitoring and control capabilities for agents.

Anne Kleppe, BCG's global lead for AI safety and governance and a coauthor of the report, said banks were cautious about scaling agents because they lacked controls, particularly monitoring capabilities. She said the challenge was to turn governance from a framework into an operating capability.

Policies outpace operational controls

Almost all institutions in the benchmark, 96%, managed AI risk through existing risk frameworks. The share that had defined its appetite for AI risk rose to 73% from 57% in 2025, and 77% had a dedicated AI policy, BCG reported.

Fewer than half had a centralized, tool-based inventory of AI systems. None reported a comprehensive human-oversight framework consistently implemented across their AI systems.

Nearly half of the banks, 46%, reported an AI-related issue or incident in the preceding 12 months. More than a quarter said their AI systems were falling behind their promised business case.

Governance and adoption

Banks in the top third for risk management maturity were 2.5 times as likely to be advanced AI adopters as those in the bottom third, the benchmark found. The comparison measures how governance maturity and adoption appeared together in the study.

Banks using standardized, previously approved patterns for lower-risk AI applications were nearly twice as likely to move those applications from idea to production in under six months, BCG said. The firm described those patterns as a way to standardize repeatable uses while reserving more detailed reviews for novel and higher-risk applications.

The report also points to governance challenges beyond banks' own AI systems: technology providers can change AI capabilities after an initial approval, while business users can build or configure agents themselves. BCG says those developments make it harder to track which systems are in use and how their capabilities and risks change over time.

Among its recommendations, the firm called for continuous testing and monitoring of AI systems in production, oversight of changes in third-party relationships, and safeguards for employees building or configuring their own agents.