AI CONTROL. FOR FINANCIAL INSTITUTIONS.
Nearly all run AI. Few can prove they control it.
THE PROBLEM
AI is a given. Control is not.™
Most institutional discourse on AI has, until now, framed the challenge as one of governance. Frameworks have been written. Policies have been issued. Committees have been formed. This work has been necessary and, in many cases, valuable. It is also incomplete.
Governance describes what an institution intends to do. Control describes what it can demonstrably do. The distance between the two is not academic — it is where fiduciary and regulatory exposure may accumulate.
We sought to measure that distance. Across eighty of the world's leading financial institutions, spanning eight sectors, we examined each institution against a single question: not whether it uses AI, but whether it can publicly demonstrate control over the systems on which it increasingly depends. The resulting industry picture is revealing.
We REVIEWED AI control at 80 institutions
THE STATE OF AI CONTROL IN INSTITUTIONAL FINANCE — 2026
Eighty institutions · Eight sectors · One 5×5 Control Matrix™
Nearly every leading financial institution can run AI. Very few can publicly demonstrate that they control it.
Demonstrable control concentrates in one narrow band — the governance of models — and becomes progressively less visible across the broader AI stack. At the level of the autonomous agents now entering production, relatively few institutions publicly demonstrate governed control. At the infrastructure layers beneath — compute, data centers, and power — public evidence of control remains limited.
A board that equates governance with control may underestimate its exposure. This report is the record of where institutional finance actually stands.
WHY FINANCIAL INSTITUTIONS ARE DIFFERENT
Control in financial services has a shape. It must be deep, and it must be wide.
Deep — control runs the full AI stack. The AI you rely on does not run on software alone. It runs on agents, models, data centers, compute, and power. A regulator asking you to prove control is not satisfied by application logs — the questions that decide your exposure (where it executed, under whose key custody, in which jurisdiction) live below the application layer. Control that stops at the software is not control.
Wide — control reaches across the chain. You do not operate most of the AI you depend on. It runs inside your asset managers, your asset servicers, your providers — firms whose systems produce the numbers that land in your books and your duty. Control that stops at your own walls leaves the rest of your exposure unguarded. The duty does not stop at the perimeter. Neither can the control.
Five ecosystems deep. The full delegation chain wide. That is the shape of fiduciary control of AI — and it is why the institutions that steward capital cannot borrow a control model built for a single organization's own operations.
THE INDUSTRY AT A GLANCE
What the FINANCIAL SERVICES INDUSTRY shows
Read together, the sectors tell a consistent story. Where institutions publicly demonstrate control of AI, the evidence concentrates at the model layer — how models are governed, validated, and operated — and thins elsewhere. Disclosure on autonomous agents is limited; on the underlying infrastructure of compute, data centers, and power, it is sparser still.
A second theme recurs across sectors: the distance between aspiration and demonstration. Capabilities are described in the language of governance, and pilots in ways that suggest broader deployment, more often than the public record substantiates. Sectors that disclose specific, auditable mechanisms show the strongest control signals; sectors whose AI activity principally reflects investment in, or deployment of, AI elsewhere disclose the fewest.
Heat-map classifications reflect publicly available information reviewed under the methodology described in this report. They are not assessments or certifications of any institution’s actual internal AI capabilities or controls. Grey (Not Disclosed) indicates the absence of public disclosure, not the absence of control.
The report does not evaluate, certify, or benchmark any individual institution. Tiers reflect the authors' analytical interpretation of public information and the completeness of public disclosure, not statements about any institution's actual controls, governance, capabilities, resilience, or compliance.
How the EIGHT sectors compare
Viewed by sector, the findings reveal a comparative pattern. Based on publicly available information reviewed under the methodology described in this report, banks demonstrate the greatest prevalence of publicly disclosed AI control, while private equity demonstrates the least, with other sectors distributed between them. Across every sector, publicly demonstrated control is concentrated at the model layer and becomes progressively less evident at the level of autonomous agents.
The principal distinction among sectors is not where the typical institution sits, but how many institutions within each sector publicly demonstrate governed control. The variation among institutions within a single sector is greater than the variation between sector medians. For that reason, this report is intended to be read both sector by sector and institution by institution, rather than as a single industry-wide verdict.
Findings reflect the authors' analysis of publicly available information under the methodology described in this report. They are not assessments, audits, or certifications of any institution's actual AI capabilities or controls. "Not Disclosed" reflects the absence of public disclosure, not the absence of control. No institution's findings or placement are influenced by any commercial relationship with Institutional AI.
QUESTIONS EVERY BOARD SHOULD ANSWER
A board that asks these three questions and records honest answers will produce, in a single sitting, the most accurate picture of its real AI control posture it has ever held. The pattern of answers — not any single one — is the finding.
- The depth question. "Our AI runs on five layers — the agents that act, the models that decide, the data centers that hold it, the compute it runs on, the power beneath. We may have examined one or two. Controlling the top layer while renting the four below is not control. Which layers have we verified, and which are we assuming?"
- The reach question. "The numbers we book, the valuations we rely on, the decisions we answer for — more and more are produced by AI running inside the managers and servicers we delegate to, not inside us. We hold the fiduciary duty. They hold the AI. Have we verified their control, or delegated the work, kept the liability, and hoped?"
- The trust question. "The firms that build these models run red teams whose job is to make them misbehave — and ship anyway, knowing they can. If the maker does not fully trust its own model, on what basis do we treat its output as reliable?"
Governance is policy. Control is evidence. These three questions separate the two. A board that can get them answered with technical proof — not provider assurance — has control. One that cannot has just found its exposure. And these are only the beginning.
Institutions We ServE
Asset Owners — The Stewards of Capital
Asset owners are the institutions whose fiduciary obligations make AI control categorical, not optional. Entrusted with the retirement security of workers, the wealth of nations, and the long-term promises made to beneficiaries and citizens, they are the entities to whom the institutional finance ecosystem is ultimately accountable — and command of AI across the system will depend on whether they can govern the systems increasingly shaping how capital is allocated across economies and generations.
Asset Managers — The Allocators of Capital
Asset managers are the institutions that transform capital into investment decisions. Positioned between asset owners and markets, they serve as the engines of allocation, research, and portfolio construction. Increasingly, AI is becoming embedded within the analytical and operational layers through which those decisions are made. As a result, the question is no longer whether asset managers will employ AI, but whether they can exercise sufficient control over the systems that increasingly influence investment judgment and fiduciary outcomes.
Asset Servicers — The Operational Backbone of Capital
Asset servicers are the institutions whose operational responsibilities make AI control a foundational requirement. They are not merely providers of post-trade services; they are the entities that safeguard assets, maintain records, administer funds, and enable the functioning of the institutional financial system itself. In the final analysis, much of the trust upon which global finance depends ultimately rests upon their ability to maintain command over the increasingly intelligent systems that support the movement, accounting, and stewardship of capital.
Banks — The Engines of Financial Intermediation
Banks occupy a uniquely consequential position within institutional finance. They are not merely intermediaries between savers and borrowers; they are the institutions that facilitate payments, create credit, manage liquidity, and support the functioning of the broader economy. As AI becomes embedded across these activities, control ceases to be a technology issue and becomes a matter of safety, soundness, and systemic resilience. In the final analysis, command of AI within banking is inseparable from command of the critical infrastructure upon which modern finance depends.
Wealth Managers — The Custodians of Advice
Wealth managers are the institutions whose advisory responsibilities make AI control a categorical, not optional, requirement. They are not merely intermediaries between products and clients; they are the entities entrusted with guiding individuals, families, and institutions through decisions that shape long-term financial outcomes. As AI becomes woven into planning, research, and client engagement, control becomes inseparable from fiduciary judgment and trust. In the final analysis, the future of wealth management will depend not simply on access to intelligent systems, but on the ability to govern them in service of the clients whose interests wealth managers are entrusted to protect.
Retirement Providers — The Guardians of Long-Term Security
Retirement providers are the institutions whose responsibilities to participants and plan sponsors make AI control a foundational requirement. They are not merely administrators of retirement plans; they are the entities entrusted with safeguarding the long-term financial well-being of millions of individuals and families. As AI becomes woven into recordkeeping, advice, operations, and participant engagement, command of intelligent systems becomes inseparable from fiduciary responsibility and trust. In the final analysis, the strength of the retirement system itself will depend in no small measure on the ability of retirement providers to govern the technologies that increasingly shape retirement outcomes.
Private Equity Firms — The Owners and Builders of Enterprise
Private equity firms occupy a unique position within institutional finance. They are not merely allocators of capital; they are the institutions that exercise ownership, influence management, and shape the strategic direction of thousands of enterprises worldwide. As AI becomes a core driver of productivity and value creation, command of intelligent systems becomes inseparable from command of the businesses themselves. In the final analysis, the competitive advantage of private equity firms will increasingly be determined not only by the capital they deploy, but by their ability to govern the technologies transforming the companies they own.
Insurance Companies — The Protectors of Risk
Insurance companies are the institutions whose promises make AI control categorical, not optional. As underwriters, claims payers, and long-term investors entrusted with safeguarding individuals, businesses, and societies against loss, they provide much of the stability modern economies depend on — and confidence in the insurance system itself will rest in no small measure on whether insurers can govern the systems increasingly shaping the pricing, transfer, and management of risk.
WHAT WE DO
THE INSTITUTIONAL AI STACK™ — THE ARCHITECTURE.
Five AI ecosystems — Power, Compute, Data Centers, Models, and Agents — connected under one institutional control structure. Custom-designed for each institution. Owned permanently. Independent of any external provider, including Institutional AI.
OLTAIX™ — THE CONTROL PLANE.
The Control Tower that governs the Stack. The difference between a security camera and a lock. OLTAIX™ is the lock.
AI CONTROL — THE OUTCOME.
The outcome. When the Stack and OLTAIX™ operate as designed, every AI system in your institution is owned, governed, auditable, and under your command.
REQUEST The REPORT
AVAILABLE ON A RELATIONSHIP BASIS TO QUALIFYING INSTITUTIONS
All discussions covered under NDA. Tiers reflect public-disclosure completeness, not assessments of any institution's actual controls.
AI is a given. Control is not.™
