AI is a double-edged sword for cyber security – UK survey

A survey by the UK’s central bank and financial regulator finds increasing use of artificial intelligence (AI) by the country’s financial services firms.

The Bank of England (BoE) and the Financial Conduct Authority (FCA) published a survey of 118 financial firms on November 21. It finds that the number using AI has risen to 75%, compared with 58% in 2022.

A third of AI use cases are “third-party implementations”. Just three third-party providers account for 73% of cloud services, 44% of modelling services and 33% of data services.

Firms across the banking, insurance payments and financial market infrastructure sectors believe cyber security poses the greatest systemic risk both currently and in three years’ time. “The largest increase in systemic risk over that period is expected to be from critical third-party dependencies,” the report says.

However, improved cyber security is also among the top perceived benefits of AI, alongside data and analytical insights, and combatting money laundering and fraud.

The report says the results lend support to the view that third-party exposure will continue to increase as financial models become more complex and outsourcing costs are reduced.

Almost half of the firms surveyed – 46% – have only “partial understanding” of the AI technologies they use. A third claims they have a “complete understanding”. Respondents say the use of third-party models, in contrast to models developed internally, has contributed to the knowledge gap.

At the same time, the greatest reported barriers to adoption are security and the robustness of AI models, followed by insufficient talent and access to skills. The risks that are expected to increase the most over the next three years are “third-party dependencies, model complexity, and embedded or ‘hidden’ models”.

As a result, the financial sector is taking a cautious approach to AI adoption. Operations and IT currently dominate the use cases, and the “materiality” of these use cases is generally rated as “low”. Materiality can relate to a use case’s financial exposure or market value, the number of customers to which a financial model applies, the model’s role in informing business decisions, or the potential impact on a firm’s solvency and financial performance. Just 16% of the firms say they are adopting AI in “materially” important use cases.

In terms of governance, the majority of firms reported having an accountable person for their AI framework (84%), however accountability is often split with most firms reporting three or more accountable persons or bodies. Most firms (72%) said that their executive leadership were accountable for AI use cases.