The median firm: AI adoption, spending, ROI and controls in financial services
Our global research shows that AI has significantly impacted the financial services industry. But its impacts are uneven. The industry is made up of very different institutions, each with a unique AI maturity profile made up of adoption, spending, operating models, controls and more.
Hence, it is not easy to describe the average firm.
We have calculated seven separate medians across our survey of 300 financial institutions. This is not one actual firm. No single respondent necessarily matches all seven values. This profile shows the centre of the distribution for seven separate metrics.
Median forecast AI spend is $635,000 for risk and compliance in 2026. Responses range from $50,000 to $15 million, influenced significantly by company size.
The median response for realised ROI is the 26-50% band. At the edges, 13.3% report returns of 1-10%, while 27.7% report more than 50%. These are self-reported bands, not audited profitability measures.
AI adoption is at production stage or beyond in five of the seven risk & compliance domains assessed at the median. The range is wide, from zero to seven, with 39 firms reporting production deployment across all seven. Production tells us that AI is live; it does not tell us how independently it acts or how consequential its outputs are.
High autonomy use cases appear in two of seven domains at the median. This means AI runs with human review only by exception or autonomously within predefined controls. 84 firms report no domains at this level; the highest observed count is six.
The median firm allows only one of the five model types assessed to materially influence decisions or outcomes. More than one-third of firms report that no models are currently granted that level of influence.
Firms report high, very high or critical AI-related risk in four of seven domains at the median. Five firms report none at that level and 32 report all seven. This measures perceived risk introduced or amplified by AI, not actual incidents or losses.
The median control count is four of thirteen. Responses range from one to ten; no respondent reports all thirteen. Coverage records whether a control exists, not whether it works consistently across every use case.
The middle of the market is already well beyond isolated experimentation. Production deployment spans five domains and high AI-related risk spans four, while control coverage reaches four of thirteen capabilities. The next challenge is keeping the full portfolio visible and controlled as autonomy and decision impact increase.
Download AI in Risk & Compliance 2026 for a deeper dive on this and more.
