The Bank of England and the UK government are weighing a landmark proposal to introduce a common testing regime for general-purpose AI models. The move aims to strip away the ‘black box’ opacity of US-developed algorithms and relieve the operational burden on individual lenders.
A ‘Fail-Safe’ for the Financial Frontier
With roughly 75% of UK financial firms now deploying AI, the sector has “substantially outpaced” almost every other industry in adopting the technology. However, this rapid rollout has left regulators uneasy. While the Financial Conduct Authority (FCA) has already launched its ‘AI Lab’ to help firms experiment, the new proposal shifts the focus from how banks use AI to the integrity of the models themselves.
The initiative, reportedly submitted to the Department for Science, Innovation and Technology (DSIT) by Starling Bank’s CIO Harriet Rees, suggests that a centralised testing regime would act as a vital “fail-safe.” Rees, who also serves as the government’s financial services AI ‘champion’, argues that an independent assessment would provide the comfort that models—predominantly sourced from US tech giants like OpenAI and Anthropic—meet a baseline UK standard before they are integrated into critical banking infrastructure.
The Shift from Principles to Practice
The push for a more formalised regime follows a series of sharp warnings from the Bank of England’s Prudential Regulation Authority (PRA). In meetings late last year, the PRA told chief risk officers that monitoring of AI models was “not frequent enough,” suggesting that traditional risk management frameworks are struggling to keep pace with the autonomy of generative AI.
Several key drivers are propelling this shift:
-
Reliance on Foreign ‘Frontier’ Models: Much of the UK’s banking innovation is built on third-party US technology. Standardising testing ensures these systems align with UK-specific financial stability requirements.
-
Operational Duplication: Currently, every bank must perform its own due diligence on the same base models. A common regime would reduce this friction and ensure consistency across the sector.
-
Systemic Risk and ‘Herding’: The Bank’s Financial Policy Committee has warned that if multiple banks use the same flawed algorithm, it could lead to market-wide shocks or cyber vulnerabilities.
-
The ‘Explainability’ Gap: As AI moves from static statistical models to ‘agentic’ systems that change behaviour rapidly, regulators are demanding better documentation of how these models arrive at their outputs.
Why Current Testing Isn’t Enough
The move toward a standardised regime isn’t just about bureaucracy; it’s a response to real-world vulnerabilities that “patchwork” testing fails to catch.
-
The ‘Proxy Bias’ Trap: Without rigorous, sector-wide fairness testing, AI models can inadvertently discriminate. A recent FCA review highlighted how postcodes can act as a “proxy” for protected characteristics, leading to people of colour facing higher costs or being declined service—often without the bank’s internal logs flagging a violation of law.
-
Hallucinated Sanctions: In compliance, “hallucinating” LLMs have been known to fabricate sanctions violations, complete with fake OFAC IDs. A single phantom alert can freeze legitimate transactions and trigger mandatory regulatory disclosures, leaving treasury teams to explain fictional scenarios to auditors.
-
Market Herding: Jonathan Hall of the Bank’s Financial Policy Committee has warned that AI-driven trading could amplify “herding behaviour.” If multiple firms use the same un-vetted model, a single algorithmic glitch could accelerate market swings, potentially contributing to a flash crash that individual firm-level testing would never have predicted.
Who Will Hold the Keys?
The AI Security Institute (AISI) is currently the frontrunner to lead this testing. Discussions between industry leaders and the AISI have been described as positive, with participants noting a distinct gap in the global landscape for a sector-specific testing framework of this nature.
While the PRA intends to remain ‘technology-agnostic’ and avoid stifling innovation with prescriptive rules, it has clearly marked AI as a supervisory priority for 2026. This signals that while new laws may not be immediate, the expectation for rigorous, evidence-based testing is now non-negotiable.
Strategic Takeaways for the Treasury
For corporate treasurers and finance leaders, this regulatory evolution marks a transition from AI as an ‘innovation tool’ to AI as a ‘routine hazard’ that requires industrial-scale governance:
-
Auditability is King: Treasury teams must move beyond simply validating outputs and start documenting robust governance frameworks that can withstand supervisory scrutiny.
-
Critical Third-Party Oversight: Under the upcoming ‘Critical Third Parties’ regime, the BoE will have new powers over major AI and cloud providers. Expect tighter vendor due diligence requirements by the end of 2026.
-
Global Alignment: As the UK navigates its ‘pro-innovation’ stance against the EU’s more rigid AI Act, the BoE is pushing for international coordination through the G20, ensuring that UK standards remain globally competitive.
This proposal for a common testing regime is a pragmatic response to the reality of the UK’s tech ecosystem. By standardising what lies ‘under the bonnet’ of banking AI, the government is attempting to safeguard the financial system without slowing the pace of the very innovation that keeps London a global hub.