Seventy-two percent of UK financial services employees now use AI daily. Eighty-nine percent use it at least weekly. And 32% say they’ve encountered inaccurate or misleading AI output while doing it.
That figure comes from a Skillcast survey of 148 UK financial services employees, reported in September 2026. It’s a smaller, more specific data point than the EMEA-wide boardroom research we wrote about a few weeks ago, but it points at the same underlying problem from ground level rather than the boardroom: AI is now woven into daily workflows in one of the UK’s most heavily regulated sectors, and roughly a third of the people using it are getting wrong answers they then have to notice, correct, or, worse, not notice at all.
The gap between “we use AI” and “we’d catch it if AI got it wrong”
Almost three-quarters of financial services employees using AI daily is not a surprising number in 2026. What’s more interesting is what sits next to it: a meaningful minority already know, from direct experience, that the outputs aren’t always reliable. The real question a compliance function needs answered isn’t whether AI is being used, that’s settled. It’s whether there’s a working way to know when it’s gotten something wrong, before that wrong output becomes an email to a client, a figure in a report, or a decision about someone’s account.
That’s a different problem from the “shadow AI” story we covered in the EMEA piece, unapproved, untracked agents operating outside IT’s visibility. This is arguably the harder version: AI tools that are approved, known about, and actively relied on, still producing errors that nobody’s systematically catching, because “we use an approved tool” and “we verify every output” are not the same statement, and a lot of organisations are currently only able to make the first one.
Why this lands differently in the UK specifically
Here’s what makes this genuinely a UK story rather than a smaller echo of the EMEA one. Since 19 June 2026, UK organisations have carried a new duty under section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025: a clear, accessible route for anyone to raise a data protection complaint, acknowledged within 30 days, investigated properly, with an outcome communicated back.
Put the two things together. An AI tool producing a wrong or misleading output involving someone’s personal data, in an organisation that now has a live, dated legal duty to receive and act on exactly that kind of complaint, is no longer a quiet internal correction. It’s a complaint with a clock attached, whether it arrives as a formal written submission or as a frustrated phone call, which the law now treats the same way.
Financial services carries this particularly acutely. An AI-assisted decision involving somebody’s account, application, or risk profile that turns out to be wrong isn’t just an accuracy problem anymore. It’s a live candidate for a section 164A complaint the moment the person affected realises something’s off, and the 30-day acknowledgement clock starts the moment that complaint, however it arrives, lands.
What “verified” actually needs to mean
The instinctive response to an accuracy statistic like this is usually a training push, teach people to fact-check the AI’s output before they use it. That’s necessary, but it’s a people-layer fix to what’s really a systems-layer gap.
Training tells someone what to do. It doesn’t produce a record of whether they did it. If a section 164A complaint lands six weeks after an AI-assisted decision, the organisation doesn’t need to show that staff were told to verify AI outputs. It needs to show, for that specific decision, that verification actually happened, who did it, when, and against what. A training slide deck doesn’t answer any of those questions. A logged review does.
That’s the same gap we keep finding underneath every framework in this series, whether it’s POPIA’s enforcement notices citing missing compliance frameworks, or King V’s shift toward disclosed, evidenced governance outcomes. A policy that says “verify AI outputs before relying on them” is necessary and not remotely sufficient. What closes the gap is a record, tied to the specific decision, that verification happened, reviewable the moment a complaint asks the question.
What to actually check
For any UK organisation, particularly in financial services, where AI is already part of daily workflow, four questions are worth answering honestly right now, not after the first complaint arrives:
Do you know which AI-assisted outputs currently reach a customer, a regulator, or a decision about someone’s account, without a documented human check first? If a section 164A complaint arrived tomorrow about a specific AI-assisted decision, could you show, not just claim, that it was reviewed? Is your complaints intake, however people actually reach you, phone, email, a form, feeding one single tracked process, or several disconnected ones? And when an AI tool’s output is found to be wrong, is there a record of what changed as a result, or does the correction just happen quietly and disappear?
If any of those answers involve “we’d have to go and check,” that’s the actual gap this data is describing, not whether AI is being used well, but whether you could prove it was, on the day someone asks.
Talk to our team about building that evidence trail before the first complaint tests whether it exists.
#AIGovernance #DUAA #DataProtection #FinancialServices #Compliance #PrivIQ
Sources
- Skillcast UK financial services survey (32% encountering inaccurate/misleading AI output, 72% daily use, 89% weekly use) — verified via Corporate Compliance Insights’ news roundup (10 September 2026), which cites the Skillcast poll of 148 UK financial services employees directly. This is a secondary report of Skillcast’s findings rather than Skillcast’s own primary publication, I did not locate Skillcast’s original release directly, so I’d treat the underlying figures as reported rather than fully primary-sourced, and recommend a quick check against Skillcast’s own site before this goes to print given how central the statistic is to the piece.
- Section 164A DUAA complaints duty — unchanged from earlier, fully verified work in this project (commencement 19 June 2026, 30-day acknowledgement, no small-organisation exemption, complaint definition not tied to a specific channel).
- The connection between the two — this is an original argument constructed for this piece, not a claim made by either source. Skillcast’s survey doesn’t mention DUAA, and DUAA’s provisions don’t reference AI accuracy specifically. The link, that AI errors in a regulated sector now have a live formal complaints channel with a legal clock attached, is PrivIQ’s own analytical framing, and I’d flag it as such rather than imply either source draws this connection itself.
- What I did not do — state or imply that every AI error automatically qualifies as a valid section 164A complaint, the duty covers complaints about how personal data is handled, not every service or product quality issue. I’ve kept the piece to cases where the AI error involves someone’s personal data specifically, which is the accurate scope.