Central Banks Are Opening Their Data to AI, and Warning That Controls Must Keep Up

Adoption is now normal

Artificial intelligence is no longer an experiment in UK finance. The Bank of England's 2026 report on AI in UK financial services found that 86 percent of respondent firms reported using AI, and that generative AI accounted for 56 percent of all reported systems. Operations and IT accounted for about 31 percent of reported systems, and 73 percent of small firms reported using AI. m:…9406

Agents are widespread but closely held. About 80 percent of respondents reported having AI agents currently deployed, yet only 2 percent reported deploying agents with broad autonomy. Around 7 percent of reported systems were assessed as high materiality, and 94 percent of respondents reported having firmwide AI policies, principles or standards in place. m:…9406

The risks the report ranks highest are systemic rather than firm-specific: cyber risk amplification and critical third-party dependencies were the two highest-rated systemic risks. Third-party implementations accounted for 39 percent of all reported AI systems, and the top three cloud and compute providers accounted for 79 percent of reported relationships. Some 88 percent of respondents assessed evolving frontier AI cyber capabilities as having a moderate or high impact on their risk profile, and 64 percent picked vulnerability management and patching as the area of cyber resilience receiving the greatest increase in management attention. m:…9406

Türkiye builds the doorway

Türkiye's central bank is approaching the same shift from the data side. It launched EVDS-MCP, a service that enables access to Electronic Data Delivery System data via AI tools. The system has been operating since 1993, and the new service extends the EVDS 3 platform launched in January 2026. m:…2323

The bank drew a clear boundary around its own responsibility: its role is limited to providing data compatible with AI tools, and it is not responsible for the AI tools used with EVDS-MCP or their outputs. That disclaimer matters for executives building on official data, because it places the burden of validating AI-generated analysis on the user, not the source. m:…2323

India's warning on controls

The cautionary note came from Mumbai. In his speech, Reserve Bank of India Deputy Governor Swaminathan J argued that controls must evolve commensurate with the pace and nature of growth, and that removing process steps without understanding their control function can lead to control dilution. Regulated entities, he added, remain responsible for activities they outsource to third parties. m:…7373

His measure of resilience was speed rather than size: in a digital financial system, resilience is measured by how fast a problem is detected, understood and fixed, and governance quality is measured by how quickly bad news travels to those with authority to act. He cited the 2023 US banking stress, when US$42 billion of deposits moved in a single day, as a reminder of how compressed time has become. He also argued that trust is an invisible asset requiring continuous investment in conduct, service quality and grievance handling, and that weak controls in one part of the system can impose a trust cost on the whole system. m:…7373

Together, the three documents describe a sequence rather than a contradiction: firms adopt AI, central banks open their data to it, and supervisors insist the controls around both move at the same speed. For technology executives, the practical takeaway is that AI access to official data is expanding, but accountability for what the tools produce is not shifting with it. m:…9406 m:…2323 m:…7373