Key Takeaways
- A lending AI strategy fails at its weakest layer, not at the average of its four layers.
- Most projects stall after the pilot because the data is not good enough, credit rules change too slowly or nobody can explain a decision.
- The record, the AI tools, the controls and the execution step have to be built in that order, even though the AI tools are the most visible part.
- Starting with a low-risk use case is a deliberate way to build the controls and evidence that every later step depends on.
Why Most Lending AI Projects Stop After the Pilot
Pilots are designed to succeed. They run on a curated dataset, a friendly segment and a team that knows the model well. Production is less forgiving, and three causes account for most of the projects that never make the transition.
- The data is not good enough. A model trained on a clean extract meets live data that is late, incomplete or defined differently in each system. It is telling that four of the five risks UK financial firms rate highest in their use of AI are about data: privacy, quality, security and bias.
- The credit rules are too slow to change. When policy lives in documents and every change needs an IT release, a model that recommends a new cut-off or a new segment has nowhere to land. The business case assumed weeks; the change process delivers quarters.
- Nobody can explain how a decision was reached. Credit committees, compliance teams and regulators all need to understand why an applicant was approved or declined. Nearly half of UK financial firms report only partial understanding of the AI technologies they use, and a decision nobody can explain is a decision nobody will sign off. We explore the fix in the role of explainable AI in modern lending.
The Four Layers of a Lending AI Strategy
Figure 1: The four layers, built from the bottom up.
Layer 1: Record of Credit and Borrower
What it does: holds one trusted version of the applicant, the application, the data used to assess it, the decision and the assets performance afterwards.
How it usually fails: the record is split across origination, servicing and spreadsheets, values are overwritten rather than versioned, and nobody can reconstruct what the lender knew on the day it decided.
Layer 2: AI Tools
What it does: estimates risk, extracts data from documents, categorises bank transactions and, increasingly, runs agentic tasks. This is where ai credit underwriting models live.
How it usually fails: models are trained on data that does not match production, deployed without monitoring, and left to drift until someone notices arrears rising in one segment.
Layer 3: Controls that Stop a Wrong Action
What it does: applies credit policy, limits, affordability thresholds, referral rules, permissions and the ability to switch a model off.
How it usually fails: controls live in procedure manuals rather than in the system, so they are enforced by people remembering them rather than by software refusing to proceed. For EU lenders this layer also carries the AI Act's human oversight and logging duties for credit scoring, which apply from 2 December 2027.
Layer 4: Step that turns a Decision into a Transaction
What it does: generates the contract, collects signatures, confirms bank details, disburses funds and books the loan.
How it usually fails: the decision is made in one system and re-keyed into another, conditions are checked by hand, and money can move before every condition is met. Our piece on modular lending technology looks at how to connect these steps without a monolith.
Why the Order Matters
Each layer depends on the one beneath it. AI tools running on a weak record produce confident errors. AI tools without controls cannot safely be given authority, so they stay advisory forever. Controls that are not connected to execution are only suggestions, because the transaction can still happen without them.
Most banks start with the AI tools because that is the part people can see. A model makes a good demonstration and a good board slide. But a strategy is only as strong as its weakest layer, and investment in the most visible layer does nothing to lift the weakest one.
Figure 2: Illustrative scores. Strong AI tools cannot compensate for weak controls.
12-Month Roadmap
Figure 3: A 12-month roadmap that builds the layers in order.
Quarter 1: Foundations and a Low-Risk Start. Build a single record for one product and baseline today's metrics. Put one assistive AI use case live, such as document extraction or transaction categorisation that helps underwriters without deciding for them. Starting low risk is a deliberate choice, not caution: it exercises the data pipeline, monitoring and audit trail on real traffic while the consequences of a mistake are small.
Quarter 2: Controls before Authority. Move the product's credit policy into configurable rules with version control and named owners. Stand up the model inventory, independent validation and monitoring thresholds, which UK and US supervisors now expect in proportion to each model's risk. Run the credit model in shadow mode alongside live decisions so its behaviour can be compared before it is trusted.
Quarter 3: Controlled Go Live. Let AI-assisted decisions run for one clearly defined segment, such as smaller loans with strong data, with referral thresholds that send anything unusual to a human. Connect the decision to execution so contracts and disbursement cannot proceed until every condition is met. Introduce champion and challenger testing.
Quarter 4: Prove, then Extend. Commission an independent review of the first nine months, measure outcomes against the baseline, and extend to a second product or segment. Plan year two, including which bounded tasks, if any, are ready to hand to AI agents. The FCA's Mills Review expects most leading firms to have embedded AI across almost every function by 2030, so year two is where the pace picks up.
What This Means for Your Lending Platform
A platform that cannot show which rules applied to a decision, or repeat an old decision exactly as it was made, caps the whole plan, whatever the budget. Every layer above depends on the platform recording what happened, and every regulator will ask for that record.
When choosing an AI lending platform, test it against the four layers rather than the demo. ezbob's platform brings the layers together: data enrichment and a library of bureau, identity, fraud and open banking integrations for the record; decision engine services for risk scoring, affordability, pricing and offers for the AI tools; a Configuration Studio in which the client's credit team owns rules, cut-offs and referral queues, with role-based permissions and a tamper-evident audit trail, for the controls; and flow orchestration, eSignature, disbursement that only triggers once every workflow step is complete, and a loan management system for execution. The result is automated underwriting that can be explained, replayed and changed by the people accountable for it. We describe the decisioning layer in AI automated credit decisioning, the next step in agentic AI in lending, and the longer view in the future of credit decisioning.
Done in this order, AI in lending stops being a series of pilots and becomes a capability, and AI credit decisioning becomes something a credit committee owns rather than merely observing.
FAQ
How much should a bank budget for a lending AI project?
Budget for the four layers, not the model. In most programmes the record, integration and controls cost more than model development. Fund a first-year scope tied to one product, with a stage gate before scaling, and treat validation and monitoring as recurring operating costs rather than one-off project spend.
What is the difference between AI and automation in lending?
Automation executes rules someone wrote: if income exceeds a threshold and there are no arrears, approve. AI learns patterns from data and produces estimates, such as a probability of default, that the rules then act on. Good lending systems combine both, using AI to estimate and deterministic rules to decide and constrain.
Do lenders need their own data science team?
Not necessarily to build models, but certainly to challenge them. A small team that understands credit data, can read a validation report and can interpret monitoring is essential, because accountability cannot be outsourced. Model development itself can come from suppliers or partners, provided the lender can validate what it receives.
How do you measure the return on a lending AI project?
Against a baseline set before go-live: time to decision, straight-through rate, cost per application, approval rate at constant risk, early arrears, override rates and complaints. Report risk-adjusted outcomes, not speed alone, because approving worse loans faster destroys value. Include avoided costs such as manual review and remediation.
To learn more and to discuss your needs and requirements, please contact Francesco Manitta or Yaron Shoshani at [email protected] or +44 1375 887390.
References
- Bank of England and Financial Conduct Authority, Artificial intelligence in UK financial services – 2024 (21 November 2024). https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024
- Prudential Regulation Authority, SS1/23 Model risk management principles for banks (May 2023, effective 17 May 2024). https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss
- Board of Governors of the Federal Reserve System, SR 26-2: Revised Guidance on Model Risk Management (17 April 2026). https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
- CMS, The Mills Review: FCA sets out vision for AI-enabled financial services by 2030 (July 2026). https://cms.law/en/gbr/legal-updates/the-mills-review-fca-sets-out-vision-for-ai-enabled-financial-services-by-2030
- Praxikon, The Digital Omnibus and the postponement of high-risk obligations to December 2027. https://www.praxikon.com/en/posts/digital-omnibus-high-risk-postponement-december-2027
