Most firms use human review of AI outputs, yet only 38% have a formal AI testing program

AI adoption is widespread across financial services firms, and compliance teams are shifting their focus to assurance. According to the 2026 AI Benchmarking Survey by ACA Group (ACA) and the National Society of Compliance Professionals (NSCP), firms are increasingly focused on verifying that their AI tools perform as intended.

The third annual AI Benchmarking Survey found that 86% of respondents’ firms formally use AI, a 15-point increase from 2025 and a 41-point increase from 2024. Most respondents report using AI only for internal use cases. The survey found that 69% of firms limit AI to internal use cases, while 18% also use AI in client-facing applications. Nearly one in four are experimenting with agentic AI. Enterprise or private generative AI tools (e.g., ChatGPT Enterprise, Claude Enterprise) are the most widely used, with 85% of firms adopting these tools, compared with 18% using free or public generative AI tools.

The 2026 AI Benchmarking Survey was completed in September by 261 NSCP members and ACA clients. Across the three annual surveys, respondents’ focus has evolved from whether to use AI, to how to govern it through policies and committees, and now to how to test and validate it.

“Human review of AI outputs is increasingly common,” said Aaron Pinnick, Senior Manager, Thought Leadership, ACA. “But it must be supported by a disciplined approach to oversight, and with clear evaluation criteria and the right expertise. Without a disciplined approach, human review can become a procedural exercise rather than an effective control. Firms need to go further with formal testing, technical controls, and documentation that demonstrates effective oversight.”

Other key findings include:

• Confidence in oversight is higher than the ability to document it: 81% of respondents agree or strongly agree that their compliance oversight is calibrated to the risk of the AI activity, but only 51% are confident they could produce documentation of that oversight on short notice.
• Formal testing remains limited: 60% of firms have implemented human review of AI outputs on an ongoing basis, and 26% do so on an ad hoc basis, but only 38% have a formal program to test or validate AI outputs. Firms are aware of the importance of establishing formal AI testing programs. AI testing was the most common priority for compliance leaders over the next 24 months, and 24% of respondents are actively developing formal testing programs.
• AI policies and training are widespread: Among firms that have adopted AI, 89% have policies governing employee AI use, up from 70% in 2025, and 66% have an AI governance committee or similar working group, up from 48%. Firms have also updated cybersecurity training (64%) and privacy training (65%) to address AI-related concerns.
• Compliance teams are seeing value: 43% of firms use AI for at least one compliance activity, with firms using AI for an average of approximately three compliance tasks. Marketing and advertising review is the most common compliance use case: 41% of firms using AI for compliance tasks apply it to this activity. Among those using AI for marketing and advertising reviews, 90% report improved efficiency.
• AI risk concerns are widespread, while technical-control adoption remains limited: Information security (68%), data privacy (59%), and cybersecurity (55%) remain respondents' top AI concerns, as in prior years. However, technical controls around AI tools that could help firms manage these risks are still inconsistently used by firms, with no technical control used by more than 36% of firms. Preparation for AI-related incidents and disruptions remains limited, but only 18% have an incident response plan that addresses AI-specific incidents and disruptions.
• Enhanced due diligence of AI vendors is increasing: 55% of firms have enhanced their due diligence on AI vendors, up from 43% last year. As more firms rely on third-party AI tools, and these tools become increasingly integrated into operations, thorough vendor due diligence is important to managing AI risk.

“AI adoption and governance are top priorities for firms, compliance professionals, regulators, and investors. Today, however, if an examiner asks how a firm reviewed AI-assisted decisions and outputs, only about half of respondents felt confident they could promptly produce the documentation necessary to demonstrate effective oversight of AI,” said Carlo di Florio, President, ACA. “Although the SEC has not adopted a rule specifically governing AI use, firms remain subject to existing requirements related to fiduciary duty, governance, compliance, recordkeeping, vendor oversight, data protection, and other applicable obligations. Building testing and documentation into AI governance programs now will make regulator and investor conversations easier.”

“AI is no longer an emerging consideration for compliance professionals. It's increasingly part of their day-to-day responsibilities,” said Melissa Loner, CEO of NSCP. “What's encouraging is the progress firms are making in establishing governance frameworks, but this year's findings also highlight the work ahead in testing, documentation, and demonstrating effective oversight. Our continued collaboration with ACA gives compliance professionals valuable benchmarks to evaluate their programs, identify gaps and prioritize next steps.”

ACA and NSCP discussed the results during a webcast on November 11. View the webcast replay. Download the full 2026 AI Benchmarking Survey report.

About the survey and respondents
Participants included compliance and risk professionals from asset managers, alternative investment advisers, private equity firms, hedge funds, and broker-dealers. The most common respondent profile was a firm with 11 to 50 employees and $1 billion to $10 billion in regulatory assets under management (RAUM). Percentages may not sum to the total due to rounding.

About ACA Group
ACA is the leading governance, risk, and compliance (GRC) partner in financial services. For more than 20 years, ACA has empowered clients to launch, grow, and protect their businesses through an innovative combination of advisory, managed services, distribution solutions, and analytics with its ComplianceAlpha^® technology platform. In 2026, ACA was recognized by CNBC as one of the World's Top Fintech Companies and named to Business Insider's America's Top Management Consulting Firms list, reflecting its commitment to delivering technology-enabled compliance and risk solutions. ACA's global team of 1,700 professionals includes former regulators and industry practitioners. For more information, visit www.acaglobal.com.

About NSCP
Founded in 1986, the National Society of Compliance Professionals (NSCP) is the leading non-profit membership organization for compliance professionals in the financial services industry. NSCP provides its members with education, advocacy, and resources to support effective compliance programs. Learn more at nscp.org.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261112134673/en/