The Bank of England Says Several Participants at Its AI Roundtables Noted That Firms' Traditional Model Risk Management Approach to Validation Would Not Be Sustainable in Its Current Form as Generative AI and Agentic Systems Proliferated

In late 2025 the Bank of England hosted three roundtables with participants from regulated firms, "to better understand the constraints firms may be facing in adopting AI, and how the Bank and PRA can support responsible AI adoption." Each roundtable drew from a different sector the PRA regulates: challenger banks and UK-focused larger banks, global systemically important banks, and insurers. Observers from the FCA and HMT were present, and the discussions were held under the Chatham House Rule.

The Bank's summary was published on February 16, 2026. What it records are the participants' points, as the Bank summarizes them. Parts of it follow, not the whole.

Support for the Framework

Across all three roundtables, the summary says, participants expressed support for the PRA's regulatory framework as it related to AI. The PRA's supervisory statement on model risk management, SS1/23, "was noted by several participants as pragmatic in enabling responsible AI adoption." Most participants, it says, "did not see the need yet for detailed AI-specific regulatory guidance or rules."

Model Risk Management

Second-line risk functions, the summary says, "continue to approach the use of AI with caution, which may delay AI deployment pipelines." There were mixed views on whether that caution was optimal or inevitable. Drivers, it says, could include bottlenecks in AI skills and expertise, and a desire to ensure that compliance with supervisory expectations "could be comprehensively demonstrated."

As an example, the summary says, several participants noted that firms' traditional model risk management approach to validation "wouldn't be sustainable in its current form as generative AI and agentic systems proliferated." The traditional emphasis on understanding a model's inner workings, how inputs mapped to outputs, "wasn't tenable or fully effective for increasingly complex AI models."

The concept of having a human in the loop, the summary says, "was also challenged by the rise of agentic AI."

Several participants suggested that risk management "needed to evolve to put greater emphasis on testing, monitoring and setting guardrails around the outcomes of broader AI systems."

Providers and Data

Procurement and contract negotiations with third-party AI providers, the summary says, were slowed by inconsistent familiarity with regulated firms' compliance requirements. Several participants noted that the Bank could explore convening financial and technology firms to agree minimum standards for third-party AI providers to the regulated financial sector. Some noted that "as AI models become embedded in agentic systems throughout their firm's core business processes, substituting between AI providers may become more challenging."

Data protection laws, the summary says, were a challenge to deploying and scaling AI use cases, and several participants noted that the legal requirement to complete data protection impact assessments in certain situations slowed their AI deployment pipeline. Data quality, the summary says, can also be a barrier, "particularly in some areas of insurance."