The financial services industry is worried about the impact of cyber security, operational resilience and dependence on external technology providers, as a new survey reveals growing dependence among firms on artificial intelligence (AI).

A joint report by the Bank of England and the Financial Conduct Authority (FCA) found that 80% of firms that responded to the detailed regulatory survey had deployed AI agents, with only 2% deploying agents with broad autonomy. A further 14% reported plans to deploy AI agents in the next 12 months.

The survey found that 80% reported using agents to provide decision support, 46% had deployed systems capable of executing actions within predefined rules, and 22% reported using agents with conditional autonomy, where human approval is required for certain actions.

The survey also revealed that 39% of firms reported implementing third-party software in their AI systems, compared with 33% in 2024, with 53% representing highly crtitical material, up from 35% two years ago.

The joint report, published on Monday, examines how financial services firms are adopting, managing and governing AI. It surveyed 196 firms across banking, insurance, investment firms and other financial service providers. Of these, only 105 completed the full survey, which included questions on AI agents.

The report identified sector concern over cyber security risks, with 79% citing significant concentration among third-party cloud and computing providers. The survey highlighted that operational resilience and information security were identified as major constraints on third-party AI adoption by 40% of respondents, while 34% cited limited transparency into external AI systems.

Around 57% rated the risk of AI-related cyber threats being exploited at scale as high or severe, rising to 80% when considering the next one to three years.

Only half of respondents reported having periodic system reviews, leakage testing or ongoing monitoring, while 94% reported having firmwide AI policies, principles or standards.

The FCA and the Bank of England said the survey provided evidence on AI adoption and risk management among firms, rather than a comprehensive assessment of the entire financial services sector.

The survey also found that generative AI accounted for 56% of all reported AI systems, while operations and IT represented the largest area of deployment, at approximately 31% of systems.

The wider survey found that 86% of responding financial services firms were using AI, compared with 75% in 2024 and 58% in 2022, although the regulators cautioned that differences in respondents and survey scope limit direct comparisons.

16% of respondents reported using AI agents for automated customer communications, rising to 34% when planned deployments were included. No more than 9% expected to use agents for sensitive activities such as executing trades, initiating payments or approving customer outcomes, even when planned deployments over the coming year were considered.