Key Takeaways
- • 86% of surveyed financial services firms formally use AI, up 15 points from 2025 and 41 points from 2024, according to the 2026 AI Benchmarking Survey by ACA Group and the National Society of Compliance Professionals (NSCP).
- • Only 38% of firms have a formal program to test or validate AI outputs, even though 60% conduct ongoing human review of AI outputs.
- • 81% of respondents say their compliance oversight is calibrated to AI risk, but only 51% are confident they could produce documentation of that oversight on short notice.
- • 55% of firms have enhanced due diligence on AI vendors, up from 43% last year, and only 18% have an incident response plan covering AI-specific incidents.
- • The survey of 261 NSCP members and ACA clients, completed in September 2026, points to testing and documentation as the next priority for compliance teams.
Summary
AI adoption is now widespread across financial services, and compliance teams are shifting their focus from whether to use AI to whether they can verify that it performs as intended. According to the third annual 2026 AI Benchmarking Survey by ACA Group (ACA) and the National Society of Compliance Professionals (NSCP), 86% of respondents' firms formally use AI, compared with 2025 and 2024 levels that were 15 and 41 percentage points lower, respectively. Most firms limit AI to internal use cases (69%), while 18% also use it in client-facing applications. Nearly one in four are experimenting with agentic AI. Enterprise or private generative AI tools such as ChatGPT Enterprise and Claude Enterprise are the most widely used, adopted by 85% of firms, compared with 18% using free or public generative AI tools.
The survey highlights a gap between oversight and testing. Sixty percent of firms conduct human review of AI outputs on an ongoing basis and 26% do so ad hoc, but only 38% have a formal program to test or validate outputs. AI testing was the most common priority for compliance leaders over the next 24 months, and 24% of respondents are actively developing formal testing programs. Governance has advanced: 89% of AI-adopting firms have policies governing employee AI use, up from 70% in 2025, and 66% have an AI governance committee or similar working group, up from 48%. Among firms using AI for compliance tasks, marketing and advertising review is the most common use case, and 90% of those firms report improved efficiency in that activity. Overall, 43% of firms use AI for at least one compliance activity.
Risk concerns remain concentrated in information security (68%), data privacy (59%), and cybersecurity (55%). Technical controls remain inconsistently applied, with no single control used by more than 36% of firms, and only 18% have an incident response plan addressing AI-specific incidents. Vendor oversight is tightening, with 55% of firms enhancing due diligence on AI vendors, up from 43% last year.
ACA President Carlo di Florio said that if an examiner asked how a firm reviewed AI-assisted decisions, only about half of respondents felt confident they could promptly produce the necessary documentation. He noted that although the SEC has not adopted a rule specifically governing AI, firms remain subject to existing obligations covering fiduciary duty, recordkeeping, vendor oversight and data protection. Aaron Pinnick, Senior Manager, Thought Leadership at ACA, cautioned that human review without clear evaluation criteria and expertise can become a procedural exercise rather than an effective control. NSCP CEO Melissa Loner said AI is now part of compliance professionals' day-to-day responsibilities. Participants included compliance and risk professionals from asset managers, alternative investment advisers, private equity firms, hedge funds and broker-dealers, with the most common respondent profile being a firm with 11 to 50 employees and $1 billion to $10 billion in RAUM. ACA and NSCP discussed the results in a webcast on November 11, 2026.
The survey highlights a gap between oversight and testing. Sixty percent of firms conduct human review of AI outputs on an ongoing basis and 26% do so ad hoc, but only 38% have a formal program to test or validate outputs. AI testing was the most common priority for compliance leaders over the next 24 months, and 24% of respondents are actively developing formal testing programs. Governance has advanced: 89% of AI-adopting firms have policies governing employee AI use, up from 70% in 2025, and 66% have an AI governance committee or similar working group, up from 48%. Among firms using AI for compliance tasks, marketing and advertising review is the most common use case, and 90% of those firms report improved efficiency in that activity. Overall, 43% of firms use AI for at least one compliance activity.
Risk concerns remain concentrated in information security (68%), data privacy (59%), and cybersecurity (55%). Technical controls remain inconsistently applied, with no single control used by more than 36% of firms, and only 18% have an incident response plan addressing AI-specific incidents. Vendor oversight is tightening, with 55% of firms enhancing due diligence on AI vendors, up from 43% last year.
ACA President Carlo di Florio said that if an examiner asked how a firm reviewed AI-assisted decisions, only about half of respondents felt confident they could promptly produce the necessary documentation. He noted that although the SEC has not adopted a rule specifically governing AI, firms remain subject to existing obligations covering fiduciary duty, recordkeeping, vendor oversight and data protection. Aaron Pinnick, Senior Manager, Thought Leadership at ACA, cautioned that human review without clear evaluation criteria and expertise can become a procedural exercise rather than an effective control. NSCP CEO Melissa Loner said AI is now part of compliance professionals' day-to-day responsibilities. Participants included compliance and risk professionals from asset managers, alternative investment advisers, private equity firms, hedge funds and broker-dealers, with the most common respondent profile being a firm with 11 to 50 employees and $1 billion to $10 billion in RAUM. ACA and NSCP discussed the results in a webcast on November 11, 2026.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.