Finance Sector Outpaces Regulators in AI Adoption

A report from the Cambridge Centre for Alternative Finance (Cambridge Judge Business School), covered by PYMNTS on April 28, 2026, finds that financial services firms are far ahead of regulators in AI adoption. PYMNTS reports 4 in 5 firms are deploying AI at some level, agentic systems have crossed into mainstream use, and firms report real productivity and profitability gains. Software engineering is identified as the sector's "most mature" AI application. By contrast, 48% of regulators surveyed described themselves as still in an "exploring" stage or not engaged with AI at all.

The report ties software engineering's maturity to elevated cyber risk: 48% of industry respondents flagged adversarial AI as a primary risk vector, and 73% named data privacy and protection among top perceived vulnerabilities, per PYMNTS's summary. PYMNTS also reports a perception gap on adversarial AI specifically - roughly half of industry respondents and regulators cited it as a top concern, versus roughly a third of vendors - suggesting the companies building AI security tooling may be underestimating a risk that practitioners and regulators rate more highly.

A consistent theme across recent industry studies is a widening gap between commercial AI deployment velocity and regulatory readiness. This report reinforces that pattern specifically in finance, where productivity incentives coexist with elevated systemic-risk concerns around data privacy, adversarial manipulation, and the resilience of AI-embedded systems.

Financial-sector engineering teams embedding AI into production pipelines should treat this report as a prompt to audit adversarial-robustness testing and data-protection controls specifically around AI-assisted software engineering workflows, since that is both the most AI-mature function and a named primary risk vector. Do not rely solely on vendor risk assessments given the documented perception gap.

Track whether financial regulators expand AI-specific staffing or capability disclosures, whether vendors close the gap on adversarial-robustness transparency, and whether sector audits or incident reports surface adversarial exploits or data-exfiltration paths tied to AI tooling. The full Cambridge Centre for Alternative Finance report has the underlying methodology and sample composition for readers who want to verify these figures directly.