Banks run generative AI on two speeds at once: customer-facing tools are production-ready but tightly guardrailed, while internal functions like compliance, HR and audit are still mostly proof-of-concept. The bigger gap sits between written policy and actual enforcement, since staff are told not to use AI for certain decisions but no technical control stops them. The direction is a centralised AI control tower, still months from live at most banks.
Which banking functions are actually ahead on AI?
Customer-facing AI is not new. Banks ran IVR chatbots for years, and generative AI is closing the gap those systems left, but banks stop short of letting it decide anything on committed products. Retail and commercial-institutional functions are furthest ahead: on a live call, AI pulls transaction data in real time and reads the customer's tone and sentiment to flag vulnerability, while the customer still talks to a person and the AI works behind the scenes.
Complaint handling follows the same pattern. AI-drafted responses are blind-tested against manually written ones, and a reviewer scores the response without knowing which one wrote it.
"AI wins that comparison by quite a margin," said the former Vice President at Citi interviewed for this report. Internally, audit calls itself the leading adopter of generative AI, on the logic that audit work is reproducible so the same inputs should produce the same documented outcome, with humans still reviewing every output. Compliance, data analytics, HR and learning and development are all running proof-of-concept work at a similar pace, none of them holding back.
| Customer-facing AI | Internal AI | |
|---|---|---|
| Maturity | Production-ready, tightly guardrailed | Mostly proof-of-concept |
| Example use case | Live agent-assist, complaint drafting | Audit, compliance, HR, L&D |
| Human role | AI works behind the scenes; person stays customer-facing | Human reviews every output |
Who really controls AI decisions today?
AI governance started as a centralised function, but at the pace things move day to day, control has gotten uneven. Enterprise-level, customer-facing deployments stay well managed. Day-to-day employee tool use is different: staff have Copilot, Copilot Chat, and bank-hosted ChatGPT, Claude or Gemini platforms, with much lighter oversight of how they are actually used.
"You are telling employees you cannot use AI to risk score customers or your colleagues, but then, is there a control in place to restrict users from doing it? So I could do it," the expert said. Training raises awareness. It does not restrict behaviour.
Banks are centralising AI governance in response, but for now most lean on the existing model risk framework to do the job, since dedicated infrastructure is still months, maybe a year, away for most institutions.
What does a centralised AI control tower look like?
The challenge inside banks has moved from building AI to operating it consistently once it is live. Drift and hallucination are already tracked through KPIs and KRIs, but only in isolated pockets of the bank rather than enterprise-wide. The direction of travel is a centralised AI control tower: governed, managed and monitored centrally, with every function feeding its use cases into one framework that shows what has been built, when it went live, and whether drift is creeping in.
A structural limitation runs underneath all of it. A bank can manage bias directly in its own machine-learning models. It cannot with a third-party large language model, since no one, including the provider, can fully explain how a given response was generated. Governance across banks stays fragmented today even as the stated direction is one common architecture, and regulatory reports already document generative-AI-generated misinformation resulting in financial penalties across the industry.
- 01
Accountability
Who owns the outcome, and whether it was ethical to build in the first place, not simply whether it was technically possible.
- 02
Traceability
What was done, how it was done, and whether the steps can be reconstructed after the fact.
- 03
Transparency
Granular, end-to-end visibility into execution, not just the final output a user sees.
- 04
Data integrity
A bank can manage bias directly in its own models. It has little control over how a third-party LLM was trained.
Where do regulators draw the line on bank AI use?
The Monetary Authority of Singapore, the UK and the US have all started issuing guidance, and the posture today is wait and watch: built on what is known now, expected to tighten as more incidents surface. Specific use cases are already off-limits for AI-driven decisioning, including profiling, ranking, vulnerability assessment and reading emotions or moods, and banks must keep a human in the loop for exactly these categories.
"Some of the examples are profiling, ranking, vulnerability, emotions, moods, and some more of a sentiment. In these use cases, banks should not be using AI to arrive at any decisions," the expert said. Whether regulatory expectations converge or diverge across jurisdictions is still open, and the evidence points toward divergence: the UK's Prudential Regulation Authority has pushed for large language models built within the UK rather than sourced offshore, over concerns about sovereignty if access to a handful of external providers were ever restricted or manipulated, a risk India's own dependence on Microsoft and Google for AI infrastructure sharpens.
Are banks headed toward autonomous AI, or staying supervised?
The industry's stated aspiration is greater autonomy than exists today, and fraud and Suspicious Activity Report review sits furthest along that path, since the work is manual-intensive, entirely internal and never touches a customer. Even as more of it shifts to autonomous agents, a human stays in the loop reviewing outcomes, just with far fewer people per process than today.
That shift carries a workforce implication beyond headcount. As agents take on more of the load, coding alone becomes less central, and the valuable skill set moves toward AI governance, evaluation and human-agent collaboration, sometimes called deep teaming internally. On infrastructure, AWS is particularly well positioned with an end-to-end ecosystem spanning build, test, deployment and governance, Microsoft stands out for day-to-day productivity through Copilot, and OpenAI stays the underlying model layer banks build on top of rather than replace.
How far and how fast autonomy goes is genuinely unknown. A single incident in the next few months could trigger regulation that pulls everything back toward a more supervised state, which is why banks planning AI governance and vendor strategy should design for progressive autonomy rather than full automation from the outset.