For years, the banking industry's central AI question was whether the technology could perform reliably enough to be useful. That question is becoming less interesting. Banks already use AI to summarize information, spot patterns, support employees, automate routine processes, and assist complex decisions. As AI moves from giving answers to taking action, a tougher question comes up: When should it be allowed to act?
An AI system that suggests a response to a service representative is not the same as one that changes a customer's account. Flagging a suspicious transaction is different from blocking it. Identifying an underwriting exception is not the same as making a credit decision.
This distinction matters even more as generative AI evolves into agentic systems capable of invoking APIs, coordinating workflows, and initiating actions across financial platforms.
U.S. regulators are also recognizing that the existing governance playbook may not be sufficient. In 2026, the Federal Reserve, OCC and FDIC updated their approach to model-risk management while acknowledging that rapidly evolving technologies such as generative and agentic AI raise considerations beyond traditional model frameworks.
The next phase of banking AI therefore needs to focus less on how many use cases institutions can launch and more on how much authority each AI-enabled workflow should receive.
Not Every Banking Workflow Needs the Same Level of AI Autonomy
Banks should avoid treating autonomy as a binary choice between human control and fully automated decision-making. A more useful model treats autonomy as a spectrum.
On one end of the scale, AI collects information, suggests options, or prepares actions for humans to approve. Further along the scale, it can carry out low-risk tasks if they stay within established limits. At the opposite end, AI can complete full workflows on its own and notify a person if anything goes outside its authority.
If we compare an AI system handling a standard internal service request to one processing high-value payment, the basic AI capability could be the same, but the appropriate level of authority should not be. While transaction value matters, it is only one factor to consider. Banks also must consider the effect on the customer, whether the transaction can be reversed, the regulatory implications, and the consequences of making a mistake. An action that can easily be reversed might warrant more autonomy than one that affects credit access or involves transferring a large amount of money. Accuracy by itself is not sufficient. The authority given to an AI system should reflect the consequences of the actions it can take.
Model accuracy alone cannot determine autonomy. The consequence of being wrong must also determine how much authority the system receives.
Human-in-the-Loop Alone is Not Enough
Human oversight is essential, but requiring manual approval for every consequential action can create a new control problem. As approval volumes rise, reviewers may struggle to distinguish routine decisions from the exceptions that genuinely require judgment.
Banks could end up reproducing bottlenecks if every action must go through an approval queue. Routine approvals can reduce human oversight to a checkbox. The goal is not to remove people, but to involve them precisely when needed.
Banks can set boundaries using transaction limits, role-based permissions, confidence thresholds, policy rules, and escalation conditions. When an AI stays within these boundaries, it can carry out the action; when it doesn't, it can send the case for human review. In this way, human involvement depends on the level of risk rather than applying it to all cases. The control approach thus changes from 'every action has to be approved by a person' to 'the system determines when a person needs to get involved'. This difference will be important if AI is to operate across thousands or millions of banking interactions.
Governance Must Be Engineered into AI Architecture
Once AI can initiate actions, governance cannot remain a committee that reviews a system before launch. Control must become part of the system itself.
An autonomous agent should effectively have an identity, defined permissions, and clear limits. Banks need to know what data it can access, which systems they can call, what actions they can perform, what financial value it can influence, and when their authority expires.
This becomes more important in agentic architecture. A consequential action may happen during several API calls after an AI makes its original decision through payment platforms, fraud services, compliance engines or core banking systems.
Banks therefore need visibility into the entire chain of action, not simply the model’s output.
Important decisions should be traceable: what information the system received, what it decided, which policy permitted the action, which systems were invoked, and what happened afterward.
And authority must be revocable. If performance deteriorates, fraud patterns change or risk conditions shift; banks need the ability to restrict an agent immediately.
Autonomy Should Be Earned, Not Granted
There is no need to grant systems wide-ranging authority from the beginning if we are to move AI from a pilot phase into actual banking workflows; instead, it is more practical to gradually increase autonomy as systems show they perform reliably within existing controls.
An AI system could initially suggest actions while employees retain the final say. After enough testing and monitoring, it could carry out a limited number of low-risk actions within the predefined limits. Its authority could increase over time, even though higher-risk decisions would still require human review. This kind of progression also requires a system architecture that can adapt as authority changes. With clear permission models, secure integration, ongoing monitoring, and reusable AI components, banks can adjust the level of autonomy without completely redesigning their workflows. Just as importantly, banks must also be able to reduce that authority when performance, risk conditions, or regulatory requirements change.
The next phase of AI in banking will be less about the number of use cases underway. Maturity will instead be measured by how deliberately banks allow their systems to earn greater autonomy.
Authored by
Santosh Jadhav
Senior Vice President, FinTech, Cybage
