Artificial intelligence has moved well beyond the hype phase in financial services. It is already reshaping workflows, accelerating research, and opening the door to powerful new efficiencies. But with that opportunity comes a complex set of risks - regulatory, operational, ethical, and reputational, that firms simply cannot afford to ignore. In our recent Lanware Live session, AI in financial services: What could possibly go wrong?, we brought together a panel of experts to examine the current risks associated with AI adoption in financial services. Our panel featured John de Freitas (Director, ACA Aponix - Europe), Tim Orme (Founder, French Elm Advisors), Henry Duncombe (MD, Lanware), and Dan O’Hara (CTO, Lanware), who explored what leaders need to understand as they embrace AI within their organisations.

Discover below the key themes, risks, and recommendations from this thought-provoking session, and gain practical guidance on how financial services firms can adopt AI safely, responsibly, and strategically. We also draw on Lanware’s own research, conducted regularly over the past 2 years, which shows a clear shift from our clients merely thinking about AI to actually doing it. Each survey reveals new developments, signalling that AI adoption in financial services is accelerating and the landscape is evolving rapidly.

The AI landscape: A rapidly expanding ecosystem

The AI ecosystem is broad, complex and fast-moving. As Lanware CTO Dan O’Hara explained, today’s market is built on two distinct layers:

1. Foundational models

At the core are large-scale foundational models developed by a small number of major players, including OpenAI, Google, Anthropic, Meta, and Microsoft.

These models require vast amounts of data, computing power, and investment to build, and they underpin much of the AI capability available in the market today.

2. Application layer

Sitting on top of these foundational models is a long tail of applications. Many tools branded as “AI” are, in reality, “application wrappers” built on the same small group of underlying engines. This has important implications:

• Capabilities can vary significantly between tools
• Data handling practices are not always transparent
• Compliance and governance depend heavily on how each application configures and controls the underlying model

When assessing AI vendors and the associated vendor risk, these factors need to be examined in detail.

Where firms are actually using AI today

Across the Lanware client base, a view echoed by our expert panel, AI adoption is strongest in three key areas:

1. Productivity & efficiency

Common use cases include:

• Email drafting
• Meeting summarisation
• Document creation
• Replacing web search

These are often seen as lower-risk entry points that build organisational familiarity with AI. However, they should not be assumed to be risk-free. Appropriate operational due diligence remains essential for any platform providing these services.

2. Investment research

Firms are increasingly using AI to support research activities such as:

• Summarising broker research
• Distilling large or complex documents
• Analysing market data
• Emerging use cases such as shareholder voting preparation

This is where genuine competitive advantages are beginning to emerge. The clients we see operating in these areas are typically proceeding with caution, often taking a modular, incremental approach rather than a “big bang” rollout, in order to maintain strong governance and oversight.

3. Compliance & operations

Use cases here include:

• Due Diligence Questionnaire (DDQ) responses
• Regulatory and internal reporting
• Pattern identification
• Policy drafting

While many firms are still in the experimental phase, clear value is emerging quickly as teams begin to see tangible results.

The risks: What could actually go wrong?

Our guest cybersecurity and risk specialist, John Defreitas, described AI as a technology that “turbocharges risk”. Three categories stood out:

1. “Over permissioning”

This was one of the most significant risks discussed, as many AI tools require deep access to documents, systems, or internal data. If permissions aren’t carefully controlled, the consequences can be serious, including:

• Tools accessing data they should not
• Sensitive information is being surfaced to the wrong people
• Firms are losing visibility and control over what data has been exposed

This risk is further amplified when organisations interact with external vendors that use AI “under the hood”. A critical question firms must ask is “Do we really know what happens to our data once it enters third-party systems?”

2. Explainability & blackbox behaviour

Even the creators of AI models don’t always fully understand how AI systems arrive at their outputs. As a result, responses can:

• Vary between queries
• Be difficult to audit
• Lack of clear traceability for regulators
• Introduce hidden bias or errors that compound over time

As Dan noted: “You shouldn’t be letting AI make decisions yet, and certainly not without human review.”

3. Vendor & third-party risk

Most firms now rely on a wide ecosystem of suppliers - from IT, applications and data providers to fund administrators, legal advisers, HR, and compliance partners. Increasingly, these suppliers are embedding AI into their own operations.

This raises several important questions firms should be asking:

• What AI tools are being used?
• Where is your data being processed or stored?
• Is that data being used to train other models?
• Do you have contractual rights to audit AI usage or prevent misuse?

Lanware MD Henry Duncombe highlighted a sharp increase in clients introducing AI-specific contractual controls, such as:

• Mandatory disclosure of AI usage
• Audit rights
• Breach notification obligations
• Termination rights in cases of misuse

These controls are likely to become standard practice very quickly.

Real-world consequences: A warning shot

Multiple panellists referenced a major incident involving an AI-enabled application built on Salesforce (not Salesforce itself). Because the AI tool required broad system access, when it was compromised:

• High-profile firms such as Tiffany’s, LVMH and Coca-Cola were impacted
• Sensitive information was exposed
• The breach impact was far-reaching across many organisations

This incident highlights a new reality: AI can significantly expand the blast radius of a cyber incident, amplifying both the scale and consequences of a single breach.

What regulators are saying

Regulators are moving quickly, closely monitoring both the market and the firms they oversee.

FCA

• Strongly pro-innovation
• Introduced a “supercharged sandbox” for AI experimentation
• Expect firms to implement “privacy and security by design”
• Require the same governance standards as any other operational or financial risk

SEC

• Conducting sector-wide AI sweeps to assess market practices
• Created an internal AI Task Force
• Increasing scrutiny of downstream vendor usage and data flows

Looking ahead, expect the regulatory bar to rise materially in 2025–2026, not only for the FCA and the SEC, but also for other global regulators. Firms adopting AI will need to demonstrate rigorous governance, transparency, and risk management to stay ahead of evolving expectations.

Choosing AI tools: Should firms standardise?

According to Tim Orme, most financial services firms today:

• Use three or more AI tools for the same task
• Are still in the experimenting phase
• Have yet to standardise their AI toolset

This aligns with recent broader industry research, though consolidation is expected, first by task, and eventually by model.

Microsoft Copilot was repeatedly highlighted by the panel as one of the most robust solutions for enterprise-grade compliance. Even so, firms need to pay attention to subscription levels implementation details, as Microsoft Copilot license or deployment can differ significantly from one another.

Building no-code AI agents: Should small firms do it?

No-code automation is improving, particularly within the Microsoft AI ecosystem. However, Dan O’Hara cautioned that the space is still in its early stages:

• Tools can be “a bit finicky”
• Security & guardrails aren’t yet perfect
• Firms must ensure they operate strictly within trusted boundaries

For firms without development capabilities, the advice is clear: wait before fully diving in.

Practical advice for CEOs who feel behind

The panel closed the discussion by sharing guidance for leaders feeling pressure to “catch up” with AI adoption. Here are their personal expert tips:

1. Start with transparency (John)

Understand what the business wants to achieve with AI and be clear how it will be governed.

2. Ask the same questions you asked about cloud (Dan)

• Where is my data?
• Who can see it?
• What changes might the vendor make without notice?

3. Speak to your team (Tim)

AI is already being used, formally or informally. Take the time to understand the real landscape before setting a strategy.

4. Don’t rush (Henry)

The pace of AI development is faster than your pace of adoption, and that’s okay. Start small, build trust and tie AI initiatives directly to business strategy.

Final thought: AI is a shift, not a trend

AI isn’t going away - it’s becoming a foundational operating layer for financial services. Adopting it safely requires:

• Clear governance
• Rigorous vendor scrutiny
• Controlled experimentation
• Human oversight
• Cultural buy in
• Senior accountability

As a sector, we must keep asking tough questions, challenging assumptions, and designing controls that evolve alongside the technology. All our panel agrees:

The firms that succeed won’t necessarily be the fastest adopters; they’ll be the smartest.