Strategy brief · November 2026

Bank AI operating models: who is scaling, how they govern it, and what is still open

A comparison of how 12 leading banks deploy, organize and govern AI, built from public disclosures. It ends with the strategic questions I think matter most for a firmwide technology agenda.

The point of view

Employee access to AI is close to universal at the leading banks; the open questions are now governance and value. Banks have converged on a governed central platform with business-owned use cases. Agentic AI is moving faster than supervisory guidance, which leaves each bank to set its own agent perimeter and its own way of proving value.

01 · ACCESS IS SOLVED

Adoption metrics no longer separate leaders

Reported employee access: BNY 99%, Morgan Stanley ~98%, Citi 87%+, Barclays ~90% on Copilot. Evident finds only 12% of use cases report impact against operational KPIs and about 1% disclose concrete financial returns.

02 · ONE OPERATING MODEL

Central platform, business-owned use cases

LLM Suite, Eliza, Lumina, Claves and Capital One's enterprise platform all centralize models, data access and controls. Use cases sit with the businesses. A named AI executive is now common: UBS (Jan 2026), RBC (Feb), HSBC (Apr), Citi (Apr), Wells Fargo (Oct).

03 · THE GOVERNANCE GAP

US model-risk guidance now excludes generative and agentic AI

SR 26-2 (Apr 17, 2026) replaced SR 11-7 and puts generative and agentic AI outside its scope until a future RFI. Banks are filling the gap themselves. Goldman has a CIO/CRO co-chaired AI Risk Committee, and BofA reviews each project on 16 risk dimensions.

04 · THE AGENT PERIMETER

Banks disagree on outside agents

JPMorganChase and RBC block third-party AI agents from customer accounts. Morgan Stanley lets clients' agents connect over MCP. BofA argues for human authorization of agent payments. No industry standard exists yet.

05 · ENGINEERING FIRST

Software delivery is the first agentic workload at scale

14,000 Citi engineers on Devin. Hundreds of agents alongside Goldman's 12,000 engineers. About 40% of BNY code AI-authored. Claude Code targeted at half of Barclays developers by year-end. The likely next effect is on the shape of technology teams.

06 · VALUE DISCLOSURE DIVERGES

Some banks commit to targets; others decline

RBC targets C$700M–1B by 2027. BofA guides $300M of savings in 2026 rising to $700M in 2027. BNY tracks ~$450M. Capital One will "not quantify." JPMorganChase calls its earlier $2B benefit figure "stale."

Twelve banks, side by side

Ordered by 2026 Evident AI Index rank. Open a row for leadership, platform, agentic footprint, governance and value. The operating-model labels are my synthesis of each bank's disclosures, not the banks' own terms.

Where each bank leads

Evident AI Index 2026 pillar ranks out of 50 banks (lower is better). The index weights Talent at 45%, Innovation 30%, Leadership 15% and Transparency 10%. Transparency is the pillar closest to responsible AI. Several leaders rank high on talent and innovation but low on leadership and transparency.

Rank: 1–5 6–10 11–20 21–35 36–50

The regulatory clock

The dates that shape AI operating-model decisions across US, EU, UK and Canadian banking.

Feb 2026
Financial Services AI Risk Management Framework v1.0 (Cyber Risk Institute)Voluntary

Developed with the FSSCC, US Treasury and more than 100 institutions, with NIST input. It is the closest thing to a shared industry baseline.

Apr 17, 2026
SR 26-2 / OCC Bulletin 2026-13 replace SR 11-7In effect

Narrower model definition, oversight scaled to risk and materiality, aimed mainly at banks above $30B in assets, nonbinding. Generative and agentic AI are explicitly out of scope; the agencies plan an RFI.

Apr 2026
FCA AI Live Testing, second cohort

Barclays and UBS are participating in the UK regulator's live testing programme.

Jul 16, 2026
OSFI bulletin on generative and agentic AI

Canada's prudential regulator addressed gen and agentic AI ahead of Guideline E-23.

Jul 27, 2026
EU Digital Omnibus on AI enters into forceIn effect

Regulation (EU) 2026/1744 delays high-risk obligations. Art. 50 transparency (chatbot disclosure, labelling) still applies from Aug 2, 2026. AI-literacy duties remain, in softer form.

May 1, 2027
OSFI Guideline E-23 (model risk) takes effect

Enterprise model-risk expectations for Canadian banks, including AI models.

Dec 2, 2027
EU AI Act Annex III high-risk obligations apply

Covers creditworthiness and credit scoring, and life and health insurance pricing: risk management, data quality, human oversight, documentation, conformity assessment.

Aug 2, 2028
EU AI Act Annex I (AI in regulated products) applies

Open questions for a firmwide AI strategy

The disclosures above point to five decisions where leading banks still differ. Each needs a clear, defensible position and a plan to carry it out.

  1. Where is the agent perimeter?

    Separate internal agents, agents acting for clients and third-party agents acting on clients' behalf. Each needs its own identity, authorization and liability model. Blocking outside agents works today, but it may not hold once clients expect their own agents to transact.

  2. What is the firm's own standard for governing generative and agentic AI before regulators write one?

    SR 26-2 leaves the gap open. Leaders are writing their own controls, such as agent identity and access, post-deployment monitoring and human sign-off for high-risk actions. Getting ahead of the RFI lets a bank help shape it rather than react to it.

  3. Build, route or partner for models?

    Options include model-agnostic routing (JPMorganChase, UBS, BNY), proprietary or open-weight models (Capital One, RBC's ATOM) and a single strategic partner (Morgan Stanley with OpenAI). Each choice affects cost, concentration risk and how much of the stack the bank controls.

  4. How should value be measured?

    Moving from counting use cases and users to outcomes attributable to the P&L means agreeing on baselines with Finance. Evident adds an outcomes pillar in 2027, so the market will soon compare banks on it.

  5. What happens to the technology talent model?

    If engineering is the first workload to scale with agents, the mix of junior and senior engineers, vendor spend and team structure will change first, and the strategy needs to plan for that.

Method and sources

Researched and built in one session using agentic AI tools: parallel research agents read and cross-checked the sources below, and the page was generated and checked in code. Figures are as disclosed by the banks or reported by the sources, are self-reported and unaudited, and carry the dates noted. Several bank profiles draw on BankingNewsAI's per-bank summaries of earnings calls, filings and press. Where counts conflicted, I used the most recent dated figure. This brief is not affiliated with or endorsed by any bank named.

  1. Evident, 2026 Evident AI Index: key findings (Oct 6, 2026) and index rankings
  2. Rocketdocs, SR 11-7 replaced by SR 26-2 (Oct 2026); Elevate, SR 11-7 rescinded: the AI gap (Sep 2026); Schneider Downs, Banking agencies revise MRM guidance (Apr 2026)
  3. AI Act Explorer, Digital Omnibus on AI; Acceleraid, What the postponement changes for banks (Jul 2026)
  4. Fortune, How JPMorgan's CIO is reshaping work with a $19.8B tech and AI budget (Apr 29, 2026)
  5. BankingNewsAI bank profiles (updated Oct 27 – Nov 3, 2026): JPMorganChase, Bank of America, Citigroup, Wells Fargo, Goldman Sachs, Morgan Stanley, Capital One, BNY, HSBC, Barclays, UBS, RBC