AI Control Across Eight Institutional Sectors
We analyzed eighty of the world's leading financial institutions across eight sectors against a single core question: not whether they utilize AI, but whether their public record outlines evidence of structural control frameworks over the systems on which they increasingly depend.
The poles are far apart: Banks outlined the strongest framework elements observed within their publicly available disclosures among all sectors reviewed, while Private Equity firms presented the least public disclosure at the median sector level.
The pattern is structurally consistent. Where institutions disclose AI control frameworks, the evidence concentrates primarily at the model layer—specifically how models are governed, validated, and operated—and rapidly thins across the broader AI stack. Public disclosure regarding autonomous agentic frameworks remains limited across the institutions reviewed. On the infrastructure layers beneath them—compute, data centers, and power—the public record is comparatively sparse.
Research Basis
Sector-level observations reflect Institutional AI's qualitative analysis of publicly available disclosures accessible as of June 30, 2026, for the institutions included in the baseline data pool of The State of AI Control in Institutional Finance — 2026 Edition.
These findings describe macro-level patterns observed exclusively within the public record. They represent Institutional AI's analytical opinions based on the methodology described herein and must not be interpreted as compliance certifications, legal audits, attestations, or operational assessments of any individual institution's actual internal controls, risk management practices, governance processes, or technical capabilities.
where each sector sits at the median
What the grid shows at a glance
- Across every sector, the median disclosed posture is concentrated in the Models layer. At the median, Power, Compute, and Data Centers remain Not Disclosed across all eight sectors. Agents remain Not Disclosed except for the Operational pillar in the four strongest-disclosing sectors.
- The sector medians form a clear progression. Banks, Asset Managers, Wealth Managers, and Retirement Providers exhibit the broadest median disclosure; Insurance follows closely; Asset Owners and Asset Servicers show a narrower median footprint; and Private Equity remains Not Disclosed across all twenty-five cells at the median.
- No sector's median reaches Governed. Even Banks—the sector with the greatest number of Governed designations—has a typical institution at the Evolving tier. Governed designations are concentrated among a relatively small number of institutions rather than representing the sector median.
AI CONTROL EVIDENCE IS CONCENTRATED AT THE MODEL LAYER
Documented Governed designations appear overwhelmingly within model governance and operations, with limited public disclosure across agentic systems and the infrastructure layers beneath them.
The analysis identifies where documented AI control framework elements appear across the stack: thirty-nine Governed evaluations at Models/Operational, twenty-five at Models/Logical, thirteen at Models/Technical, two at agentic operation, and none identified across the remaining ecosystem layers.
One cell illustrates the difference between sector-level and institution-level views: Models/Technical appears unfilled in the composite sector baseline while containing thirteen individual Governed designations across the reviewed institutions. The leading profiles are sufficiently advanced in their public disclosures that the same analytical cell can appear absent in the sector view while being clearly represented at the individual institution level.
SECTOR AVERAGES MASK SIGNIFICANT INSTITUTIONAL VARIATION
Across every sector reviewed, differences between individual institutional profiles exceed differences between sector medians—revealing a landscape defined by unevenly disclosed AI control maturity.
That variation, repeated across every sector, is a central finding: the difference between the strongest and weakest anonymized institutional profiles within a single sector is materially greater than the difference between sector medians. This is why our underlying model evaluates the landscape institution by institution, even as we present macro-level observations sector by sector.
The arithmetic reinforces this distinction: across the two thousand individual cell evaluations conducted to develop these sector baselines, only seventy-nine cells—fewer than 4%—received a Governed designation.
These findings should be understood as evidence of significant institutional variation in publicly disclosed AI control frameworks, not as a uniform assessment of any sector or individual institution.
AI CONTROL ACROSS THE EIGHT INSTITUTIONAL SECTORS
.png/:/rs=w:600,cg:true,m)
A sector-by-sector analysis of publicly disclosed AI control frameworks across eighty leading financial institutions.
Taken together, the research converges on a single conclusion. Of two thousand control-cell evaluations, two hundred nine — just over one in ten — disclose control at any tier above Not Disclosed. Of those, thirty-two rise to a Governed designation through named, auditable mechanisms. And of those, none achieved a Sovereign designation under the framework. The shape matters as much as the count: all thirty-two Governed cells sit at the Models layer — none at the autonomous agent layer, and none across the infrastructure layers of Power, Compute, and Data Centers. The record describes not simply a scarcity of publicly demonstrated control, but its concentration within one narrow portion of the AI stack.
Asset Owners — The Stewards of Capital
Asset owners are institutions whose fiduciary obligations make AI control categorical, not optional. Entrusted with the retirement security of workers, the wealth of nations, and the long-term promises made to beneficiaries and citizens, they are the entities to whom the institutional finance ecosystem is ultimately accountable — and command of AI across the system will depend on whether they can control the systems increasingly shaping how capital is allocated across economies and generations.
Asset Managers — The Allocators of Capital
Asset managers are the institutions that transform capital into investment decisions. Positioned between asset owners and markets, they serve as the engines of allocation, research, and portfolio construction. Increasingly, AI is becoming embedded within the analytical and operational layers through which those decisions are made. As a result, the question is no longer whether asset managers will employ AI, but whether they can exercise sufficient control over the systems that increasingly influence investment judgment and fiduciary outcomes.
Asset Servicers — The Operational Backbone
Asset servicers are the institutions whose operational responsibilities make AI control a foundational requirement. They are not merely providers of post-trade services; they are the entities that safeguard assets, maintain records, administer funds, and enable the functioning of the institutional financial system itself. Much of the trust upon which global finance depends ultimately rests upon their ability to maintain command over the increasingly intelligent systems that support the movement, accounting, and stewardship of capital.
Banks — The Engines of Intermediation
Banks occupy a uniquely consequential position within institutional finance. They are not merely intermediaries between savers and borrowers; they are the institutions that facilitate payments, create credit, manage liquidity, and support the functioning of the broader economy. As AI becomes embedded across these activities, control ceases to be a technology issue and becomes a matter of safety, soundness, and systemic resilience. Command of AI within banking is inseparable from command of the critical infrastructure upon which modern finance depends.
Wealth Managers — The Custodians of Advice
Wealth managers are the institutions whose advisory responsibilities make AI control a categorical, not optional, requirement. They are not merely intermediaries between products and clients; they are the entities entrusted with guiding individuals, families, and institutions through decisions that shape long-term financial outcomes. As AI becomes woven into planning, research, and client engagement, control becomes inseparable from fiduciary judgment and trust. The future of wealth management will depend not simply on access to intelligent systems, but on the ability to control them in service of the clients whose interests wealth managers are entrusted to protect.
Retirement Providers — The Guardians of Long-Term Security
Retirement providers are the institutions whose responsibilities to participants and plan sponsors make AI control a foundational requirement. They are not merely administrators of retirement plans; they are the entities entrusted with safeguarding the long-term financial well-being of millions of individuals and families. As AI becomes woven into recordkeeping, advice, operations, and participant engagement, command of intelligent systems becomes inseparable from fiduciary responsibility and trust. The strength of the retirement system itself will depend in no small measure on the ability of retirement providers to controlthe technologies that increasingly shape retirement outcomes.
Private Equity — The Owners and Builders
Private equity firms occupy a unique position within institutional finance. They are not merely allocators of capital; they are the institutions that exercise ownership, influence management, and shape the strategic direction of thousands of enterprises worldwide. As AI becomes a core driver of productivity and value creation, command of intelligent systems becomes inseparable from command of the businesses themselves. The competitive advantage of private equity firms will increasingly be determined not only by the capital they deploy, but by their ability to control the technologies transforming the companies they own.
Insurance — The Protectors of Risk
Insurance companies are the institutions whose promises make AI control categorical, not optional. As underwriters, claims payers, and long-term investors entrusted with safeguarding individuals, businesses, and societies against loss, they provide much of the stability modern economies depend on — and confidence in the insurance system itself will rest in no small measure on whether insurers can control the systems increasingly shaping the pricing, transfer, and management of risk.
The board agenda
Demand your own matrix.
This report reads eighty institutions against twenty-five cells each — on the public record, which is all a report can read. The matrix that matters is not in these pages. It is your own, drawn from what your institution can demonstrate rather than what it has disclosed, and right now you cannot draw it. Direct management to produce it, cell by cell, with evidence rather than attestation.
Name every delegate — and demand theirs.
The chain of asset managers, asset servicers, and other providers transfers the work, never the obligation. An institution can command its own five layers completely and still fall short of its duty, because most of the AI it depends on runs inside firms it does not operate. Control that stops at your own walls stops short of your duty.
Set the evidence standard.
Which model touched which decision; where, physically and jurisdictionally, it executed; who could access it and on what terms; what a third party could audit. Demonstrable control answers all four. Policies, attestations, and contractual assurances cannot — and control you cannot demonstrate is control you do not have.
REQUEST THE RESEARCH
AVAILABLE ON A RELATIONSHIP BASIS TO QUALIFYING INSTITUTIONS
All engagements and discussions are conducted under confidentiality protections, including non-disclosure agreements where applicable. Control Tiers represent Institutional AI’s analytical interpretation of the depth, specificity, and visibility of publicly disclosed AI control information and are not assessments, audits, certifications, or determinations of any institution’s actual control environment, governance practices, or operational capabilities.
See the full Legal Notices section below.
AI is a given. Control is not.™
