When a UK financial firm says regulation is slowing its AI programme down, it is rarely talking about a single rule. The Bank of England and FCA survey of AI in UK financial services, published on 26 October 2026, asked respondent firms which regulatory areas they saw as constraints. 42% of respondents perceived UK data protection and privacy regulation as posing a high compliance burden, 29% said the same of international regulation, and UK intellectual property rights was the area most often linked to unclear best practice. 28% of respondents indicated no regulatory constraints.
The first three findings point at two different kinds of problem. The survey defines unclear best practice as uncertainty about how to comply with legal requirements in practice. A high compliance burden is a different signal: the obligation may be well understood and still costly to meet. The two need different responses, and a programme that treats them the same way risks either over-engineering controls for a settled rule or stalling while it waits for certainty.
This guide is written for the Head of Regulatory Affairs, the General Counsel or the Chief Data and AI Officer at a bank, insurer or investment firm who has to explain those constraints to a board and still ship. It covers the constraint ranking and what each constraint actually requires. It cedes the full regulator map to our AI risk management framework guide for UK sector regulators, live monitoring evidence to our FCA AI Live Testing guide, and the Annex III timetable to our EU AI Act Omnibus delay explainer.
This guide is shipped by the team behind DATS, the five-stage AI consulting system from DILR.AI, delivered by senior practitioners who ship code, not decks. Or see the AI operating model, which covers governance, RACI and lifecycle, audit-ready by design.
What did the 2026 Bank of England and FCA survey find about AI regulatory constraints?
The Bank of England and FCA survey, published 26 October 2026, found that 42% of respondents perceived UK data protection and privacy regulation as a high compliance burden on AI adoption and 29% said the same of international regulation. UK intellectual property rights was the area most often associated with unclear best practice, followed by international regulation such as the EU AI Act. 28% of respondents reported no regulatory constraints.
Read the base carefully before quoting these numbers in a board paper. 196 firms responded to the 2026 survey, 101 larger firms and 95 smaller ones, and 105 completed the full questionnaire. The report states that its figures are based on the full survey unless otherwise stated, so the 42%, 29% and 28% are shares of full-survey respondents who answered the question, not of every regulated firm in the UK. Firms with fewer than 100 employees could choose a shorter questionnaire, and its results are reported separately: around 38% of short-form respondents reported no specific regulatory constraints, and 30% identified data protection, confidentiality and IT considerations as constraints. Those two figures come from a different question set, so they should not be set beside the full-survey percentages as if they were the same measure. The wider DATS pillar guide to enterprise AI consulting in the UK explains why these base questions matter whenever a survey is used to justify investment.
The survey also asked which frameworks shape how firms develop and deploy AI. That is a different question from which rules constrain them, and the answers mix domestic and international frameworks.
The EU AI Act was cited by 71% of respondents and the NIST AI Risk Management Framework by 60%, against 65% for the FCA AI Update and 63% for the Consumer Duty. The report describes firms' AI as shaped by a combination of domestic and international frameworks, and that mix is the backdrop to the 29% who perceived international regulation as a high compliance burden.
Why does UK data protection rank as the heaviest perceived compliance burden?
The survey does not say why UK data protection ranks highest, but the likely reason is reach: most AI use cases in a financial firm touch personal data, so the UK GDPR questions recur for each one. A bank needs a lawful basis, a defensible purpose, a data protection impact assessment where risk is high, and specific safeguards when a significant decision is solely automated. AI multiplies how often those questions are asked.
Much of the burden sits in written law rather than open questions, though applying it still takes judgement. The Data (Use and Access) Act 2025 changed several parts of the UK GDPR in 2026, and two of those changes matter to a financial firm scoping AI.
The first is automated decision-making. From 5 February 2026, the old Article 22 was replaced by new Articles 22A to 22D. Article 22A now defines a decision as based solely on automated processing "if there is no meaningful human involvement in the taking of the decision", and Article 22C requires the controller to put safeguards in place for those decisions where they are significant: information, the right to make representations, human intervention and the right to contest. For a lender, that turns a vague worry into a design question: does a person with authority to change the outcome review the model's output before it takes effect, or not? Our guide to Article 22A and the DUAA goes through the mechanics; the point here is that the test is now written down, so most of the work is in deciding and evidencing what meaningful involvement means for each workflow.
The second is the lawful basis. Article 6 gained a seventh basis, recognised legitimate interest, which removes the balancing test for a closed list of five public-interest conditions such as crime prevention and safeguarding vulnerable people. It is narrow. Most commercial AI in a bank, from credit decisioning to marketing and service, sits outside that list and still needs one of the other bases, usually legitimate interests with a documented balancing test. Our recognised legitimate interests explainer covers where the new basis does and does not reach.
The data protection regulator, whose website now names it the Information Commission's Office, publishes guidance on AI and data protection for controllers using AI. The practical reading for a regulatory affairs lead is that much of this burden is evidence work, and evidence is cheaper to produce when it is planned with the use case than when it is reconstructed afterwards. Governance belongs in the AI operating model, which in DATS covers governance, RACI and lifecycle, audit-ready by design.
Why is UK intellectual property most often linked to unclear best practice?
UK intellectual property is most often linked to unclear best practice because the government has not decided how copyright should apply to AI training, and no UK court has answered the central question. A financial firm fine-tuning a model on third-party reports, research or market commentary cannot point to a statutory exception that plainly covers commercial use, and it cannot point to a ruling that says training on such material in the UK is lawful.
Start with the statute. The text and data analysis exception in section 29A of the Copyright, Designs and Patents Act 1988 covers computational analysis "for the sole purpose of research for a non-commercial purpose". A bank's AI programme is commercial, so that exception does not carry it.
Then the policy. The government consulted on copyright and AI from 17 December 2024 to 25 February 2025, and its preferred option was a broad exception for data mining with an opt-out for rights holders. The Report on Copyright and Artificial Intelligence, published on 18 March 2026 under section 136 of the Data (Use and Access) Act 2025, stepped back from it. In the report's words, "We will not introduce reforms to copyright law until we are confident that they will meet our objectives for the economy and UK citizens." The report proposes to gather further evidence rather than legislate now, and it sets out no timetable for reform.
Then the courts. In Getty Images v Stability AI, [2025] EWHC 2863 (Ch), handed down on 4 November 2025, the High Court found that the Stable Diffusion model weights were not an infringing copy of Getty's works. The judgment does not settle whether training in the UK infringes copyright: Getty abandoned its training and development claim after acknowledging there was no evidence the training took place in the United Kingdom. It is a High Court decision on a narrow point.
That combination fits the survey's finding that IP is where respondents most often lacked clear best practice. The practical answer is to separate the two uses that matter. Using a licensed foundation model on the firm's own records raises fewer copyright questions than fine-tuning on content the firm does not own, and a use case can often be scoped to the first. Where it cannot, the licence terms for the training content become a procurement item, not a legal research project.
How does the EU AI Act reach a UK financial firm?
The EU AI Act binds providers and deployers of AI systems, and a UK financial firm is caught when it places an AI system on the EU market or when the output of its AI system is used in the Union. A UK bank with EU customers, an EU branch or an EU group parent can therefore be in scope even though the Act is not UK law, which helps explain why international regulation ranked second as a perceived burden.
For a lender, the relevant category is the Annex III high-risk list, which includes AI used to assess creditworthiness. The deadline moved this year. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026; according to the National Law Review summary of the Omnibus, Annex III high-risk obligations now apply from 2 December 2027 rather than 2 August 2026, and obligations for AI embedded in regulated products move to 2 August 2028. The survey's international regulation category, which it illustrates with the EU AI Act, appears in both of its measures: it was the second most cited high compliance burden and the second most frequent area of unclear best practice. For a bank, a sensible starting point is the model inventory and validation evidence it already keeps under PRA SS1/23 model risk management, which applies to PRA-regulated banks, followed by a gap check against what the Act asks of a high-risk system. Our AI risk management framework guide maps the two side by side.
Deciding where AI belongs before it is built is the job of the first two stages of our DATS five-stage AI methodology, Discover and Diagnose and then Prioritise and Place, and the diagnostic produces a ranked roadmap of where AI belongs and where it does not.
Why did respondents also cite PRA, FCA and Bank expectations as unclear?
The survey found that respondents cited unclear best practice for several other regulatory areas, including PRA, FCA and Bank expectations. That is not a finding that UK supervisors are writing new AI rules. The FCA's approach maps AI onto existing obligations, so the uncertainty is about how existing duties apply to a new kind of system.
The FCA set out that approach in its AI Update, which links AI risks to rules firms already follow.
Two examples show the pattern. The Consumer Duty requires a firm to evidence good customer outcomes, and the firm still has to decide what outcome testing means for a generative AI assistant answering customer questions. SS1/23 sets model risk principles for PRA-regulated banks, and the bank still has to decide how to apply them to a third-party large language model whose training data it cannot see. The survey points the same way: applying model risk management principles to third-party or vendor-supplied models was the governance challenge selected by 54% of respondents.
The answer is the same as for any principles-based regime: write the firm's interpretation down, name an owner, and keep the evidence. Accountability is already allocated in most firms. The survey found 94% of respondents placed accountability for AI systems and outputs with business area owners or users, and 90% with executive leadership. For the senior manager angle, our PRA SM&CR Phase 2 guide covers who carries the duty, and our Supercharged Sandbox guide covers when it helps to test an interpretation with the FCA directly.
Are the biggest blockers to AI in financial services regulatory at all?
Not always. In the 2026 Bank of England and FCA survey, integration into existing business processes and decisions was the most frequently reported large non-regulatory constraint, cited by 23% of respondents, followed by legacy systems or infrastructure at 22%. Separately, 28% of respondents indicated no regulatory constraints. The two questions use different scales, so they cannot be ranked against each other.
The report notes that this is a change from 2024, when the top non-regulatory constraints were safety and security, access to skills, and transparency and explainability. The 2026 answer points at implementation: getting AI into the processes and systems a firm already runs. In a bank, that often means a case management system, a credit workflow or a complaints queue. Our AI execution office is embedded delivery, with production placements the client owns.
It also changes how a regulatory constraint should be read in a steering committee. When a use case stalls, the first question is whether the blocker is a rule, a missing interpretation or an integration gap. The three have different owners, and an integration gap routed to a compliance review will not be solved there. McKinsey's State of AI found only about a third of organisations had AI in production in 2025, so a misrouted blocker is an expensive way to stay in the other two thirds.
Constraint by constraint: what is settled and what is not
The table below summarises the four regulatory areas discussed above, plus the respondents who reported none. It separates what a firm can treat as known from what it has to interpret, and gives the scoping move that usually keeps a use case moving. To fill it in for your own pipeline, talk to the DATS team.
| Constraint | Survey signal | What is settled | What is unclear | Scoping move |
|---|---|---|---|---|
| UK data protection | 42% of respondents perceived a high burden | Lawful basis, purpose limits, DPIAs, Articles 22A to 22D | How much human review counts as meaningful in each workflow | Design the review step and its evidence before the build |
| International regulation | 29% of respondents perceived a high burden | EU AI Act text, Annex III dates after the Omnibus | High-risk standards and guidance still in progress | Check whether outputs are used in the EU; banks start from SS1/23 evidence |
| UK intellectual property | Most often linked to unclear best practice | Section 29A covers non-commercial research only | Whether training in the UK on unlicensed works infringes | Prefer licensed models on the firm's own data; license training content |
| PRA, FCA and Bank expectations | Cited as unclear | Existing duties apply: Consumer Duty, SS1/23, SM&CR | How each duty applies to generative and third-party AI | Write the firm's interpretation down and name an owner |
| No regulatory constraint | 28% of respondents | Not applicable | Not applicable | Look at integration and legacy systems, the top large non-regulatory constraints |
How should a firm scope an AI use case so a constraint does not stall it?
A firm should scope each AI use case by naming the constraint type before the build starts. The question is whether the obstacle is a settled rule that needs evidence, an unclear area that needs a written interpretation, or a non-regulatory gap that needs integration work. Each answer has a different owner, a different timeline and a different deliverable, and mixing them is how a pilot sits in review for months.
The four steps below are a practical scoping order. They are deliberately simple, because the point is to make the constraint visible early, not to build a new governance framework.
In practice the first step removes a surprising amount of work. A use case that runs on the firm's own records, through a licensed model, avoids most of the copyright question, and hosting it inside the firm's perimeter can simplify the third-party and transfer parts of the data protection analysis. Our guide to self-hosted models for regulated institutions covers that architecture. Our AI solutions page lists six named enterprise AI solutions, from enterprise knowledge retrieval to evaluation and observability for production agents, and and the same four steps apply to each.
The fourth step should cover life after launch as well as before it. The survey's governance findings show why: human approval, pre-deployment review and vendor due diligence were each reported by more than 90% of respondents as data risk controls, while ongoing monitoring, leakage testing and periodic review or recertification were each reported by around half. For staff AI literacy and governance training, see Dilr Academy.
What is the best way to handle AI regulatory constraints in financial services in 2026?
The best approach in 2026 is to sort each constraint into settled rule, unclear area or non-regulatory gap, then resource each one differently. For a UK financial firm with a live AI pipeline, that usually means a short diagnostic, a written interpretation for the unclear areas, and evidence planned into each use case, rather than a firm-wide policy rewrite before anything ships.
The criteria that matter when choosing who helps are practical. Does the adviser separate legal interpretation from engineering, or blur them? Will they produce evidence your DPO and model risk team can sign off? Do they hand over production systems your team owns? A large firm such as Deloitte, PwC, EY, KPMG or Accenture can be the better fit when the work is a firm-wide regulatory change programme across many jurisdictions, and specialist AI firms such as Faculty are also on most shortlists. Where the need is a small number of governed use cases shipped and owned in-house, DATS is built for that shape: a placement diagnostic, an operating model and an execution office, with a named owner per ship. If your IP question is genuinely novel, a specialist copyright lawyer comes before any consultant.
Frequently asked questions
Does the 42% figure mean UK data protection law blocks AI in banking?
No. The Bank of England and FCA survey measured perception: 42% of full-survey respondents perceived UK data protection and privacy regulation as posing a high compliance burden. That describes the cost of meeting the UK GDPR for AI use cases, not a prohibition. The same survey found 28% of respondents reported no regulatory constraints, and the most common large non-regulatory constraint was integration with existing processes.
Do the survey figures cover small financial firms?
Partly. The Bank of England and FCA survey received 196 responses, and 105 completed the full questionnaire, which is the basis for the headline percentages unless the report says otherwise. Firms with fewer than 100 employees could complete a shorter version instead, and those results are reported separately, including around 38% of short-form respondents who reported no specific regulatory constraints. The two sets of figures should not be combined.
Want to work through this on your own use cases? Start with DATS AI consulting, read our approach to placing AI inside regulated systems, see how an embedded execution office ships owned placements, or browse more AI compliance guides for regulated firms.
Know which constraint is actually in the way.
30-min scoping call · No deck · Confidential. We will tell you whether DATS fits.
Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.