The Bank and PRA Response to HMT, DSIT and DBT on AI in Financial Services

Prudential Regulation Authority | 20 Moorgate, London, EC2R 6DA +44 (0)20 3461 4444 | www.bankofengland.co.uk Rt Hon Rachel Reeves MP Chancellor of the Exchequer Rt Hon Liz Kendall MP Secretary of State for Science, Innovation and Technology Rt Hon Peter Kyle MP Secretary of State for Business and Trade and President of the Board of Trade Sarah Breeden Deputy Governor, Financial Stability Sam Woods Deputy Governor, Prudential Regulation CEO, Prudential Regulation Authority 1 April 2026 Dear Chancellor and Secretaries of State, Thank you for your letter of 28 January relating to enabling safe AI innovation. As you point out, this has been an area of focus for the PRA and wider of Bank of England for several years, and continues to be so. This letter responds to your requests that we (1) work closely with HMT and DSIT to publish a plan setting out how we will help enable safe AI innovation, including to agree a suitable timeline in the first half of 2026, and (2) report annually on how our regulatory approach has enabled innovation and growth driven by AI in the financial sector.

1. Our plans to enable safe AI innovation, including planned work for 2026 If adopted responsibly, AI offers significant opportunities for unlocking innovation and economic growth, both in the financial sector and the broader economy. Given the Bank’s statutory objectives, we want to create an environment in which responsible adoption of AI can thrive and contribute to financial sector innovation, competition, competitiveness, and growth, whilst safeguarding the integrity of the financial system. We are taking a proactive, forward-looking approach to achieving that goal. Given the rapid pace of AI development and adoption, we keep our approach under continuous review. Our work in pursuit of that goal dates back several years. In 2022, we published a joint Discussion Paper 5/22 with the FCA, setting out how our rules applied to the use

Bank of England | Prudential Regulation Authority Page 2 of AI, and seeking views on how our regulatory framework might need to evolve. The feedback we received indicated that many respondents thought there were no regulatory barriers to the safe and responsible adoption of AI in the UK. Several other themes came through, including: that given the rapidly changing capabilities, live guidance or best practice could be helpful; the importance of coordination amongst regulators domestically and internationally; concerns on the increasing use of third party models and data; and the need for ongoing industry engagement. This feedback continues to inform our ongoing approach. In 2023, we issued new Model Risk Management Principles for banks, which are technology-agnostic and outcomes￾focussed but deliberately included factors relevant to the use of AI models. We intend to build on this further in 2026, including by using the insights on good practice we have gained through both our supervisory dialogue and broader engagement with firms (on which more detail below). In addition, the PRA has highlighted AI adoption in its 2026 supervisory priorities, meaning AI will be a key topic of exploration in our supervisory dialogues with firms. All of this has been underpinned by our active monitoring through ongoing engagement with practitioners and experts. This engagement is crucial to ensuring that we understand both the state of current adoption and the trajectory of future adoption, such that we are equipped to manage risks that may emerge in future. This year we will run the fourth edition of the Bank and FCA’s biennial survey of AI adoption by the financial sector; this survey provides vital ongoing insight and analysis into AI use by Bank and FCA-regulated firms. In May last year, we and the FCA established the AI Consortium, a platform for public-private engagement to gather input from stakeholders on the capabilities, development, deployment and use of AI in UK financial services. Through the Consortium, members are pursuing work to explore and identify approaches to support better management of key risks to the financial system arising from its use of AI, with a focus on (i) concentration risks including from third-party model providers, (ii) the evolution of AI ‘edge cases’ as adoption moves into use cases more relevant for financial stability such as credit risk assessment and trading, (iii) explainability and transparency in generative AI, and (iv) AI-accelerated contagion in financial markets, as well as discussions on emerging trends such as the rise of agentic AI. The AI Consortium will publish a report on its work, including these areas of focus, this year. In addition, through our co-chairing of the Cross Market Operational Resilience Group, made up of participants from authorities and industry, we continue to support its AI Taskforce, created in 2024 in response to concerns relating to sector-level risk introduced by the rapid adoption of Generative AI. In May last year the AI Taskforce published its AI Baseline Guidance Review, which provides guidance to firms on: government and regulatory approaches, risk management principles and frameworks, technical implementation, third party and legal considerations, and education and awareness.

Bank of England | Prudential Regulation Authority Page 3 The above has been supplemented with additional structured engagement with a wide range of firms. Late last year we conducted three roundtables with participants from regulated firms to better understand the constraints firms may be facing in adopting AI, and how the Bank and PRA can support responsible AI adoption. Each roundtable was held with representatives from a different PRA-regulated sector: (1) challenger banks and UK-focussed larger banks; (2) global systemically important banks; and (3) insurers. These provided important insights for our ongoing work, including on industry support for the PRA’s regulatory framework as it relates to AI and on the need for risk management practice to evolve as more complex AI is deployed. Most participants also did not see the need yet for detailed AI-specific regulatory guidance or rules, and most couldn’t see a case for a Bank or PRA AI sandbox at this time; the FCA’s Supercharged Sandbox and AI Live Testing initiatives were seen as providing sufficient offerings for testing purposes. We intend to repeat these AI roundtables this year. Separately, the PRA held two roundtable sessions in October with Chief Risk Officers from some of the largest PRA-regulated firms to discuss the adoption of artificial intelligence and machine learning technologies in the context of implementing the principles set out in SS1/23 ‘Model risk management principles for banks’ as supervisory expectation. The PRA presented thoughts on specific topics for AI and machine learning (ML), including risk appetite, model tiering, explainability and interpretability, data and overfitting, independent validation, and ongoing model monitoring. In addition, we continue to conduct ad hoc rounds of meetings with market participants to understand the latest uses of AI in financial markets, particularly to seek the perspective of firms beyond our regulatory perimeter, via the Bank’s Market Intelligence activities, which also informs our financial stability work. We are also actively collaborating with domestic and international authorities on the use of AI in the financial system. This year, the G20 Financial Stability Board, chaired by the Bank’s Governor Andrew Bailey, is prioritising work with international standard-setters on sound practices for AI adoption, use, and innovation by financial institutions. The PRA acts as a co-chair of the International Association of Insurance Supervisors’ (IAIS) AI workstreams, helping provide guidance and standards to support national regulators and supervisors in managing AI-related risks effectively. The Bank is working with the G7, via its cyber expert group, to manage the risks that AI could pose to cybersecurity. Domestically, we will continue to work closely with the AI Security Institute to better understand potential financial stability risks involving frontier AI agents, as well as with the Digital Regulation Cooperation Forum (DRCF). The Bank will also use AI, where appropriate, to support and enhance our own capabilities in 2026. For example, the Bank uses AI for predictive analytics, the study of non-linear interactions between variables, and analysis of larger and richer data sets, which can potentially help forecast – for example – GDP growth and bank distress. We

Bank of England | Prudential Regulation Authority Page 4 have also rolled out off-the-shelf AI assistants across the Bank, delivering productivity gains in a range of tasks including summarisation, note-taking, and code generation. Where needed, we are also building bespoke AI solutions. For instance, the PRA is actively exploring the use of LLMs to enhance supervisory tools, supporting tasks such as data extraction and natural language querying. Through this considerable programme of work to date, we are keeping under review our technology-agnostic approach to regulation and whether further action or guardrails might be needed to promote the responsible adoption of AI in the financial sector – including in light of how rapidly the technology, its use cases and adoption levels are advancing. 2. How we will report annually on how our regulatory approach has enabled innovation and growth driven by AI in the financial sector Going forward we propose to do so via the PRA’s annual Business Plan and Annual Report, referring to wider Bank initiatives where appropriate. We hope this response is helpful, and look forward to continued working with HMT, DSIT and DBT on this important topic. Yours sincerely Sam Woods Deputy Governor and CEO, Prudential Regulation Authority Sarah Breeden Deputy Governor, Financial Stability