Key Takeaways
- A bank is only as ready for AI as its weakest foundation meaning its overall readiness level is the lowest of its five area scores, not the average.
- Five areas decide whether an AI project reaches production: data, decision governance, technology and integration, people and operating model, and regulatory evidence.
- Most banks sit between Level 1 and Level 2, where individual pilots work but nothing is yet repeatable across products.
- The right lending platform depends on the level a bank has actually reached and buying for Level 4 while operating at Level 1 wastes money and time.
What AI Readiness Means in Lending
AI readiness is a bank's ability to put an AI tool into a live credit decision and keep it there safely. It is not a question of whether the bank has a data science team or a promising proof of concept. It is a question of whether the machinery around the model exists: clean data arriving at the moment of decision, credit rules that can change without a software release, people who own the outcome, and a record that shows a regulator what happened and why.
Think of it as the difference between owning a car and having a road to drive it on. Most banks now own the car. The Bank of England and the FCA found that 75% of UK financial firms were already using AI in 2024, up from 58% two years earlier[1]. The same survey found that only 16% of use cases were rated high materiality, and credit decisions sit firmly in that category. An AI Readiness Assessment measures the road, not the car.
Figure 1: AI adoption among UK financial firms, 2022 and 2024 surveys [1].
The Five Things That Decide If a Bank Is Ready
- Data. Application, bureaux, open banking / open finance and internal performance data arrive in a consistent record at the point of decision, with lineage and audit trails that show where each value came from. Good looks like a single view of the borrower that underwriters and models both use, rather than figures re-keyed from one system to another. Our piece on data orchestration for banks sets out how that record is assembled.
- Decision Governance. Credit policy is written as versioned rules with named owners, every change is approved and logged, and every model sits in an inventory with a risk tier and a validation date. Good looks like being able to say, for any date in the past, exactly which policy and which model were live.
- Technology and Integration. The bank can connect a new data source or model without rebuilding its origination stack. Good looks like documented APIs, configuration instead of code for policy changes, and a clear view on what to buy and what to build, a choice we explore in digital transformation in lending.
- People and Operating Model. Credit, risk, compliance, operations and technology work from one backlog with one accountable executive. Good looks like a named owner for AI outcomes; the Bank of England survey found 84% of firms already report having an accountable person for their AI framework [1], so the question is whether that person can actually change credit policy.
- Regulatory Evidence. For any decision, the bank can reproduce the inputs, the rules that fired, the model version, the outcome and any human override. Good looks like producing that evidence in hours, not assembling it over weeks from logs and emails.
The Four Levels of AI Readiness
The levels below describe where a bank is today and what it should do next. They are deliberately practical: each level is defined by what the bank can prove, not by what it has purchased.
Figure 2: The four levels of AI readiness in lending
Level 1: Exploring
The bank runs experiments, often led by an innovation team. Data sits in product silos, underwriting is mostly manual, and credit policy lives in documents and credit memos. Models, where they exist, are scorecards maintained in spreadsheets.
What to do next: pick one product, build a single borrower record for it, and rewrite its credit policy as explicit rules. That work pays off whatever AI comes later.
Level 2: Piloting
One or two use cases are live, usually in shadow mode or for a narrow segment. Rules are partly digitised, but each new data source is an IT project and model governance is tracked by hand. This is where most pilots stall, as we discussed in AI and ML in lending: moving beyond a buzzword.
What to do next: move policy into a configurable decision engine, create a model inventory with monitoring thresholds, and start measuring straight-through processing and override rates.
Level 3: Scaling
Several products share one decisioning layer. Automated underwriting handles straightforward applications while exceptions are routed to human queues, and a decision audit trail exists by default. Change still takes effort, but it no longer needs a project.
What to do next: introduce champion and challenger testing, tie model monitoring to automatic alerts, and extend the same record into servicing and collections, as covered in automated loan processing.
Level 4: Embedded
AI is used across origination, pricing and portfolio monitoring. Policy changes go live in days, any past decision can be replayed, and governance effort is proportionate to materiality, which is the direction both the PRA and the US agencies now expect [2][3].
What to do next: hand bounded, well-logged tasks to AI agents, keep validation continuous rather than annual, and make sure your data and models stay portable.
How to Score Your Bank
Rate each of the five areas from 1 to 4 using the descriptions in Table 1. Score on evidence, not intention: if you cannot show it to an auditor today, it does not count. Your overall level is the lowest of the five scores. An average hides the gap that will stop a project, and this ai maturity model is built to expose that gap.
Copy the scorecard below into your own planning document. Owners should be named individuals, and the evidence column should point to something a reviewer can open.
Figure 3: An illustrative bank scoring well on technology but capped at Level 1 by governance and evidence.
What Each Level Means for Choosing a Platform
Banks at different levels need different things from a lending platform, and the most common mistake is to buy for the level you hope to reach rather than the one you are at.
At Level 1, the priority is speed to a first governed journey. You need a platform that brings data together for one product and lets credit teams express policy as configuration rather than code, so the foundations get built while value is delivered.
At Level 2, the priority is getting pilots out of the lab. Look for a configurable rule engine, a library of ready-made data integrations and a decision audit trail that exists without extra build.
At Level 3, the priority is scale without losing control: several products on shared decisioning, exception queues, model versioning and champion and challenger testing.
At Level 4, the priority is openness: APIs that let you bring your own models and agents, clear permissions for automated actions, and the ability to export your data and decision history if you change supplier.
ezbob's platform is designed to cover the whole path. Its Configuration Studio lets your own credit team change eligibility rules, score cut-offs, risk-based pricing and underwriting queues without development tickets. A library of live integrations covers credit bureaux (Experian, Equifax, and TransUnion), identity and KYC checks (Jumio, AU10TIX, Scanovate), screening through LSEG World-Check and open banking through Plaid and Equifax and open finance through HMRC data, with a low-code connector for new sources. Eligibility checks return in under 30 seconds, comparable deployments have exceeded 60% straight-through processing and government-backed Bounce Back Loans reached up to 90%, and every decision event and user action is written to a tamper-evident audit trail. For a bank choosing an AI lending platform, that combination matters more than any single model, because it lets the platform grow with the bank instead of being replaced at each level. It also reflects our wider view of AI in lending: models are replaceable, the governed decision layer is not. For the operational side, see digital lending operations.
FAQ
Who should lead AI readiness work inside a bank?
One accountable executive, usually the Chief Risk Officer or Chief Credit Officer, because AI changes who effectively makes credit decisions. Technology and data leaders deliver the work, but the owner must be able to approve policy and accept model risk. In the UK that accountability should sit with a named Senior Manager.
How is AI readiness different from digital transformation?
Digital transformation moves existing processes online. AI readiness asks whether those processes can safely hand judgement to a model and prove afterwards what the model did. A bank can have a polished digital journey and still sit at Level 1, because its decisions rest on manual review and unwritten policy.
Do smaller banks need a different approach to bigger ones?
The five areas are identical, but the route differs. Smaller banks rarely justify building their own platform teams, so they often progress faster by buying configurable infrastructure and focusing internal effort on policy, data ownership and governance. Proportionality in current supervisory guidance also allows lighter treatment of lower-risk models [2][3].
How often should a bank redo the assessment?
At least annually, and after any material change: a new product, model, data source or rule. EU firms should plan around 2 December 2027, when the AI Act's high-risk obligations reach credit scoring [4]. Tracking the two lowest-scoring areas quarterly keeps attention on the gaps that actually cap progress.
To learn more and to discuss your needs and requirements, please contact Francesco Manitta or Yaron Shoshani at [email protected] or +44 1375 887390.
References
- Bank of England and Financial Conduct Authority, Artificial intelligence in UK financial services – 2024 (21 November 2024). https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024
- Prudential Regulation Authority, SS1/23 Model risk management principles for banks (May 2023, effective 17 May 2024). https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss
- Board of Governors of the Federal Reserve System, SR 26-2: Revised Guidance on Model Risk Management (17 April 2026). https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
- Jones Walker, The EU approved a high-risk AI delay, but most transparency obligations remain (2026). https://www.joneswalker.com/en/insights/blogs/ai-law-blog/yes-august-2-still-matters-the-eu-approved-a-high-risk-ai-delay-but-most-trans.html?id=102nbon
