AI on Guardrails: How the Right AI Controls Give Financial Institutions an Edge in Innovation

Any technology entering the financial industry must pass rigorous compliance and resilience tests, which can slow adoption. Yet, AI is rapidly finding a leading place in technology strategies across financial institutions.

Multiple compelling business drivers are fueling AI testing and adoption, including competitive positioning, cost optimization and efficiency gains. BBVA alone has more than 3,000 ChatGPT Enterprise licenses at work to drive productivity in legal, risk, marketing, talent and finance. But use cases for AI don’t stop there. Know-Your-Customer, research, credit underwriting and client services are other areas where banks are finding potential for AI. 

While early results using AI can be exciting, there are significant hurdles that early adopters must overcome to ensure long-term success. The sheer volume of code machines can generate makes governance, compliance and security a challenge.  In addition, firms report that it’s difficult to integrate AI tools with complex internal systems and databases.  

The pressure to manage and integrate AI comes amid a larger, long-standing imperative to modernize a vast and complex landscape of legacy systems, vendor software and sprawling use of spreadsheets. This dual mandate places significant strain on already overburdened technology departments.

The scope of the legacy challenge is illustrated by the fact that maintaining today’s infrastructure, or “running the bank,” can represent up to 70% of technology budgets (Gartner). In addition to being unsustainable from a cost perspective, this reality leaves only around 10% of budgets for green field innovation. As a result, taking advantage of AI and other technology opportunities are automatically pre-constrained by a shortage of budget and developer resources. 

What’s more, technology costs are escalating. According to McKinsey, annual technology spending in banking has been increasing 9%, outpacing revenue growth of 4%. Despite increased investment, McKinsey found that most banks still experience declining productivity, growing cost of complexity and a hard-to-prove connection between technology investment and competitive advantage.

Where financial firms realized quantifiable value from their technology spending, McKinsey observes a “virtuous cycle” of technology investment underpinned by improvements in developer productivity that unlocks technology capacity. 

In pursuit of this virtuous cycle, financial firms are evaluating AI-assisted coding tools and agentic AI to boost developer productivity and make it faster and less costly to upgrade legacy systems, reduce vendor dependencies, replace end-user computing and realize their innovative potential in green field areas.

Yet, early evidence suggests that the initial gains from AI-assisted software development don’t match the full potential of the technology. A recent academic study involving nearly 5,000 developers using GitHub CoPilot, found that the AI tool led to a 26% improvement in productivity. However, the highest gains were among junior developers, versus senior developers, which raises concerns about the potential for defects and security vulnerabilities, as junior developers may trust the AI implicitly or lack experience to validate the output.

While a 25% plus increase in developer productivity is significant and welcome, is this enough to address the massive organizational weight, cost and operational risk of the legacy code base in financial institutions?

In our view, it’s not nearly enough and on its own doesn’t create competitive differentiation as these AI capabilities are broadly available to all institutions.

Notably, the lifecycle of software deployed in financial markets often exceeds 20 years and speeding up the initial development is a small part of that overall lifecycle. To recognize substantial and differentiated gain, four factors should guide how firms employ AI to boost developer productivity:

Use industry-specific, trusted guardrails and frameworks

AI-assisted development can generate code at machine speed, but how can you ensure compliance, security of customer data, maintainability and consistency of code across applications? Generating code at speed could exponentially exacerbate governance challenges. 

These concerns are alleviated when AI is applied within a validated software platform framework. In this scenario, the platform provides the guardrails needed to make AI-generated code predictable and compliant because the code cannot deviate from the functional and compliance parameters established by the platform.

Sequoia Capital is among those who see utility in “AI on guardrails.” They note that because it’s inefficient to encode significant domain and application-specific in a general model, industry-specific architecture offers “guardrails to ensure compliance and application logic that mimics the way a human might think about reasoning through a workflow.” 

Empower software generalists to do specialist work

Making experienced developers more productive is hugely valuable but the competition to hire and retain those skilled resources continues to intensify. As a result, most financial institutions find their business growth is limited by the availability of these experts, especially those with a strong understanding of the vertical.

That said, firms have a major opportunity to use AI to enhance productivity among junior- and mid-level developers. Given the proper framework, where AI delivers well-structured, governable code, we see instances where most developers and even technically aligned business analysts can assemble 80-90% of a financial markets application.

Segment the business problem and provide clear measures of value

Having clear goals for using AI and metrics for desired outcomes helps promote a virtuous cycle of technology investment. Keep in mind that:

1. Not all business problems require the same approach, speeding software development is different from software replacing human reasoning or judgment in business workflows.
2. Focus investments on large business problems: addressing the massive sprawl of End-User Computing (EUCs), modernizing legacy technologies to improve performance and lower risk and reducing vendor dependencies.
3. Accelerate not just initial software development but also testing, maintenance and integration.
4. Define specific measures of success that quantify the output and also measure the cost and skills required to implement at scale.

Be model-agnostic and consistent with the central AI strategy

Being agnostic is important to integrating AI into the software development lifecycle (SLDC). Currently, there are a handful of companies with the scale and expertise to produce LLMs necessary to power AI capabilities. There is no clear winner and there may never be one, meaning that any strategy to integrate AI into the application layers must be model-agnostic. A better approach is for the software platform to provide the model with the prompts and domain-specific knowledge to achieve the desired output.

In summary, prioritizing developer productivity is foundational if financial markets firms are to capitalize on both the potential of AI (and other opportunities on their innovation roadmaps) and the need to modernize legacy technologies. 

We think that the next phase of AI-enabled software development will evolve from today’s focus on making individual developers more productive to augmenting the full software development lifecycle with dedicated AI bots focused on each phase of design, development, testing and deployment. Importantly, especially for financial markets, even an advanced, agent-driven future will need to operate within highly specific guardrails and frameworks to ensure that AI cannot jeopardize resilience, compliance, audit and security.