AI Adoption Hits 86% in Finance as Compliance Teams Pivot to Testing and Assurance

AI adoption in financial services has surged to 86%, but a significant gap has emerged between implementation and the ability to prove oversight to regulators. As firms move beyond basic governance policies, the industry is now pivoting toward rigorous testing and validation to ensure automated systems remain compliant with existing fiduciary and data protection obligations.

What was announced

The 2026 AI Benchmarking Survey, conducted by ACA Group and the National Society of Compliance Professionals (NSCP), reveals a 41-point increase in AI usage since 2024. Based on responses from 261 members and clients in September, the data shows that while 85% of firms have adopted enterprise-grade generative AI tools like ChatGPT Enterprise or Claude Enterprise, the majority (69%) restrict these tools to internal use cases. Only 18% currently deploy AI in client-facing applications, though nearly a quarter are experimenting with agentic AI.

The focus for compliance teams has shifted from establishing initial policies to the technical challenge of assurance. While 89% of firms now have formal AI use policies and 66% have established governance committees, formal testing remains a bottleneck. Only 38% of respondents have a dedicated program to validate AI outputs, despite 60% performing ongoing human reviews. A critical vulnerability exists in recordkeeping: although 81% of professionals believe their oversight is correctly calibrated to risk, just 51% are confident they could produce the necessary documentation for a regulatory examiner on short notice. Furthermore, only 18% of firms have an incident response plan specifically tailored to AI-related disruptions.

The companies involved

ACA Group is a major provider of governance, risk, and compliance (GRC) solutions to the financial services industry. Headquartered in the United States and owned by private equity firm Genstar Capital, the group has expanded its global footprint and technological capabilities through both organic growth and strategic acquisitions. ACA provides advisory services and technology platforms designed to help investment advisers, asset managers, and broker-dealers navigate complex regulatory environments.

The National Society of Compliance Professionals (NSCP) serves as a non-profit membership organization dedicated to the needs of compliance professionals in the financial services sector. It focuses on providing education, professional development, and networking opportunities for its members, who primarily work within the regulatory frameworks of the SEC, FINRA, and other financial authorities. Together, these organizations provide benchmarking data that tracks how the compliance function is evolving in response to emerging technologies like generative AI and machine learning.

What FF News has reported before

FF News has tracked ACA Group’s ongoing efforts to modernize compliance through technology and global expansion. In 2026, the firm expanded its R&D capabilities by launching the Durham Innovation Hub to accelerate the development of its ComplianceAlpha technology. This followed a strategic move to partner with Confluence Technologies to automate GIPS verification data feeds. Leadership changes have also been a focal point, including the appointment of Patrick Olson as Chief Executive Officer in 2023. Additionally, the group has scaled its operational capacity by opening a new office in Pune, India, to tap into global technical talent.

What this means

The "honeymoon phase" of AI experimentation is ending, replaced by a looming "documentation debt." While firms have been quick to adopt enterprise AI for efficiency gains—particularly in marketing and advertising reviews—the lack of formal validation programs suggests many are flying blind. Regulators like the SEC do not need new AI-specific rules to penalize firms; existing fiduciary and recordkeeping requirements are sufficient. The industry is now under pressure to move from "human-in-the-loop" as a vague concept to a verifiable, technical control. Firms failing to bridge the gap between oversight confidence and documentation reality are increasingly exposed to significant regulatory risk.