Banks need stronger controls as AI use expands

AI maturity depends on deeper production use

A bank can give more employees access to AI without changing how its operations work. Evident’s findings point to a further step: embedding AI in production workflows, the day-to-day work where the technology is deployed. For banking technology leaders, the question becomes what changes when employees use AI: the work completed, the capacity recovered and the controls required.

Measuring those changes means separating deployment from financial value. Evident describes banks expanding AI use while adding specialist staff, supporting employees and strengthening oversight. Each change affects how work gets done, but each needs its own measure. Deployment counts show where AI is used; reported returns show financial results; decisions about saved time show how banks use the capacity AI creates.

Deployment is accelerating while financial reporting develops

The deployment figures show how quickly banks are expanding AI use. In the findings accompanying its index, Evident said banks advanced their AI use about three times faster last year than during the previous three years. The 50 banks surveyed cited more than 1,100 AI use cases since 2021. Evident has a commercial interest in demand for AI maturity assessment.

Evident’s maturity index assesses talent, innovation, leadership and transparency, placing deployment within a broader view of a bank’s capabilities. JPMorgan Chase ranked first, followed by Capital One, Royal Bank of Canada and CommBank. The index examines a bank’s ability to develop AI, direct its use and account for its effects. It therefore measures organizational maturity across several areas, while financial return remains a separate measure.

The practices Evident identified among leading banks help explain that broader assessment. Evident found that these institutions invested in controls and governance, the responsibilities and rules used to direct AI, while Mousavizadeh of Evident said high-scoring banks emphasized deployed AI and its effects. Both observations point to the support needed around operational use. For executives, that means examining the expertise and oversight available to sustain applications once employees begin relying on them.

AI is already in operational use across major institutions. Bank of America, Wells Fargo, Citigroup, BNY and JPMorgan Chase have described AI use across their organizations. In Evident’s findings, banks also identified software implementation and advisory tools as activities producing value this year. These examples show where banks see a contribution from AI, but assessing the financial result means connecting the operational effect to revenue, cost or another financial outcome.

More banks are making that connection in their reporting. Evident counted 12 banks reporting return on investment, or ROI, from AI projects, compared with eight last year. More institutions are reporting financial results, but the unit being counted is the bank. A bank-level reporting count cannot be used as a project success rate because each institution may operate many applications.

The use-case total answers a different question because it counts applications accumulated over time. Comparing it directly with the number of banks reporting ROI would mix applications with institutions. An investment review should instead distinguish deployment, productivity and financial results, then connect them where the bank has measured the relationship. This keeps expanding use visible while giving reported returns their proper meaning.

Deeper deployment changes staffing and the use of saved time

Connecting deployment to useful work starts with the people supporting it. Mousavizadeh said institutions scoring highly in Evident’s index add AI scientists, AI product managers, engineers and risk specialists to support production use and its impact. Banks are also recruiting specialists and directing resources toward employees using the technology. These roles spread responsibility across scientific development, product decisions, engineering and risk management.

Employee access brings continuing operational work for those teams. Applications need development, maintenance and management as employees use them, so the expertise around them becomes part of the deployment commitment. Evident’s findings place specialist staffing and employee support alongside deeper workflow use. For a technology leader, the practical question is whether the institution can support the applications it puts into operation.

Once those applications save time, management must decide how to use the recovered capacity. Mousavizadeh said banks finding such savings tend to direct the time toward clients, products and unfinished work. The sequence matters: AI reduces the time a task takes, which frees capacity for the bank to assign elsewhere. The productivity gain depends partly on what happens to that work next.

Following the reassigned work gives executives a concrete way to evaluate the gain. Managers can assess changes in output or service by tracking work on clients, products and backlogs. Saved hours therefore need to be tracked through their use before they can be connected to a financial result. Mousavizadeh describes reinvestment in work, so treating the same hours as staffing reductions or immediate profit would change the meaning of the reported practice.

Governance expands with AI’s operational reach

The staff supporting deployment must also manage the consequences of AI errors. In emailed comments to CIO Dive, Mousavizadeh said banking technology executives prioritize governance and safety because banks operate under extensive regulation, make high-consequence decisions and depend on trust. AI can inform decisions involving credit, fraud, payments, trading, financial advice, customer data and financial services. Its growing operational role therefore brings it into work that directly affects customers and institutions.

Those consequences make oversight part of the deployment decision. “Errors can therefore translate directly into financial loss, customer harm, regulatory breaches or systemic and reputational risk,” Mousavizadeh said. Her explanation ties governance to the work banks perform. As AI takes on a larger role, those controls must address how mistakes affect money, customers, regulatory obligations and confidence in the institution.

Evident’s staffing findings show banks adding people to this oversight work. Evident found that AI governance talent across the top 50 banks increased 33% year over year. Banks also strengthened measures to protect information. These changes accompanied faster AI expansion, with industry security remaining a priority and public concern increasing as AI systems became more powerful.

For planning, this makes oversight part of the operating commitment that wider AI use requires. Banks must consider which scientific, product, engineering and risk specialists support an application, along with its governance, safety and information-protection measures. Assigning responsibility for these tasks gives executives a concrete way to assess whether the bank can maintain its controls as use expands.

Oversight teams may themselves become users of AI. Accenture found that more than half of banking IT executives expect AI agents, systems that carry out assigned tasks, to become fully embedded in risk, compliance and audit functions, as well as fraud detection and transaction monitoring. Accenture’s consulting business gives it a commercial interest in banks expanding AI adoption. The finding describes executives’ expectations about future deployment across those functions.

Using agents in control work adds another responsibility for governance leaders. Mousavizadeh’s explanation concerns the consequences of AI errors, while Accenture’s finding concerns expected uses of AI in managing risk; they address different parts of the operating problem. A bank placing agents in audit or transaction monitoring must evaluate those systems as applications with their own possible errors and consequences. Reviewing their work remains a responsibility of the control function, even when AI performs some of its tasks.

Key executive takeaways

• Separate deployment from financial results: Evident counted 12 banks reporting AI ROI, up from eight last year. Investment reviews need distinct measures for deployment, productivity and financial returns, with links between them where outcomes have been measured.
• Track how saved time becomes useful work: Banks are directing AI-generated time savings toward clients, products and unfinished work. Operations managers need to follow that reassigned capacity to assess changes in output and service, supported by scientific, product, engineering and risk specialists.
• Build oversight into AI expansion: AI governance staffing across Evident’s top 50 banks rose 33% year over year. Technology and risk executives need clear responsibility for safety and information protection, including oversight of AI agents deployed in audit, compliance and transaction monitoring.