%201%20(1).png)
There is no doubt that AI is now firmly embedded in European banking. More than 90% of banks directly supervised by the European Central Bank (ECB) use AI, yet many still struggle to translate individual productivity gains into measurable financial returns. Simultaneously, growing investment requirements and dependence on a small number of technology providers are raising wider questions about the competitiveness and resilience of European banking.
These challenges were at the centre of Zango's Madrid Regulatory Forum, hosted in partnership with IE University on 6 November 2026 at Club Financiero Génova. The event brought together senior leaders from across the financial services sector, including speakers from the ECB, Banco de España, the Spanish Banking Association (AEB), Santander, BBVA and CaixaBank, to discuss the next phase of AI transformation in European banking.
Three key themes emerged from the discussions:
- First, banks are moving towards AI transformation at scale, raising new questions about how they operate. Institutions are already seeing productivity gains, but realising the full potential of AI requires more fundamental changes to their processes. As Pedro Machado of the ECB highlighted, growing investment in AI and cybersecurity is also changing the economics of banking, increasing the importance of scale and cooperation.
- Second, governance must evolve alongside adoption, without becoming a barrier to innovation. Supervisors emphasised the need for clearer accountability and stronger oversight, while industry representatives called for greater regulatory proportionality and consistency. A recurring theme was the need to combine centralised governance with flexibility in how AI is deployed.
- Third, technological sovereignty and operational resilience are becoming central to banks' AI strategies. Dependence on a small number of technology providers raises concerns about concentration risk and operational continuity. Banks must make deliberate choices about which capabilities to retain in-house and how to maintain control over those they source externally.
These themes point to the need for financial institutions to fundamentally rethink their core processes and governance structures to realise the benefits of AI while maintaining the resilience and trust on which banking depends.
Below, we explore some of the key insights from each session.
Opening remarks: Luis Maldonado, Professor, IE Business School
Luis Maldonado opened the forum by tracing AI's evolution from IBM's victory over Garry Kasparov at chess to AlphaGo's famous victory over Lee Sedol, illustrating how the technology has moved from computation to increasingly sophisticated reasoning and action.
Maldonado highlighted how AI could fundamentally change the relationship between banks and their customers. As AI agents become capable of acting on people's behalf, banks may increasingly interact with customers' agents rather than customers themselves, changing how financial products are discovered, compared and distributed.
Yet Maldonado cautioned that the benefits of AI will not necessarily be immediate. Drawing an analogy with electricity, he argued that industry was transformed not when electric motors simply replaced steam engines, but when factories were redesigned around the new technology. Banks face a similar challenge today: replacing individual tasks with AI will not deliver the same benefits as fundamentally redesigning processes.
This requires banks to move from individual to institutional intelligence. Early productivity gains often came from employees developing their own prompts and ways of working. But sustainable transformation requires organisations to capture, test, approve, deploy and measure these improvements systematically, rather than leaving knowledge in individual employees' chat histories.
Maldonado also explored technological sovereignty, drawing on NVIDIA CEO Jensen Huang's description of the AI technology stack, from energy and chips to models and applications. Sovereignty does not mean isolation, he argued, but understanding which parts of that infrastructure an institution controls and where it depends on external providers.
Keynote: Pedro Machado, Member of the Supervisory Board, ECB
Pedro Machado, member of the European Central Bank's Supervisory Board, explained in his keynote that AI has become core infrastructure for European financial institutions. Its potential extends across the entire value chain, from fraud detection and cybersecurity to credit assessment, compliance, customer support and market analysis. The ECB's recent data shows that more than 90% of directly supervised banks now use AI. Some 85% already use generative AI, and 64% use AI for fraud and cybercrime prevention.
Yet widespread adoption has not necessarily translated into transformation. Machado warned that many banks are caught in a "micro-productivity trap", automating isolated tasks without the gains adding up across the institution. Most banks the ECB supervises still struggle to quantify the financial value they are getting from AI.
AI has helped to steadily turn banking into a high fixed-cost industry, Machado argued. In the US, fixed costs have risen from 37% of banks' non-interest expenses in 1995 to more than 60% today, while marginal costs have fallen, because a fraud model or cyber defence system costs roughly the same to build whatever the size of the bank. Research on US banks shows that return on equity falls by around four percentage points in the years immediately after adopting generative AI, with a decline four times greater for the smallest banks.
Consolidation is one response to this trend, but not the only one. Machado described cooperation and buying capabilities from specialised providers as a rational route to the frontier, particularly for smaller institutions. However, that comes with its own implications, as the question turns from scale to third-party risk and operational resilience.
Operational resilience is now a first-order risk alongside capital. A bank can be well capitalised and still unable to operate, as the power failure in a single Google Cloud zone in London on 20 October showed when it disrupted banking apps and card payments across the UK for several hours.
Frontier AI is making cyber risk more urgent by shrinking the time between a vulnerability being found and exploited from weeks to hours. In July, the ECB asked the CEOs of significant institutions to submit action plans addressing these risks. Its Joint Supervisory Teams will now discuss each plan with the banks, and further workshops, inspections or deep dives may follow.
Machado was clear that this sits with boards: "It is institutions themselves that stand on the front line, and responsibility rests first and foremost with management bodies. This is not a matter for technology departments alone. The supervisory message is simple: act early, invest wisely now, and do not wait for the next incident to discover whether you are on the right path."
Panel one: AI governance, supervisory expectations and industry readiness
The first panel brought European and national supervisors together with the banking industry. Ángel Gavilán, a Partner at aimTFP Inteligencia Económica and former Chief Economist at Banco de España, moderated. The panellists were Mercedes Olano, Director General of Banking Supervision at Banco de España, María Abascal, Director General of the Spanish Banking Association, and Pedro Machado of the ECB.
On the state of industry adoption, María Abascal observed that the sector has moved from pilots to AI deployed across thousands of employees. She cited an IIF survey of 65 financial institutions, which found that 98% reported measurable benefits from AI. Consequently, she argued, effective governance is now a strategic question for boards, requiring clarity over who is responsible for each system and how decisions are made.
Fragmentation emerged as a key supervisory concern. Machado said many banks' governance arrangements were not built for AI, with use cases spreading across business lines and responsibilities sometimes unclear between business and technology functions. Supervisors want to see second- and third-line functions that can understand what the bank's AI is producing and challenge it effectively.
Mercedes Olano explained that Banco de España supervises how banks use AI, rather than the technology itself. Supervisors examine each use case: why the bank uses it, how material it is, how much autonomy the system has and what risks it creates. She emphasised that proportionality should depend on the risks of individual use cases, rather than simply the size of the institution.
María Abascal welcomed the AI Act's risk-based approach but called for greater legal certainty over what counts as AI. She also argued that AI oversight of banks should sit with financial supervisors rather than being split across Spain's AI authority AESIA, the EU AI Office and data protection authorities. She warned against repeating the caution that slowed cloud adoption.
Concentration risk was another prominent theme. Machado said DORA register data shows that 41% of banks under ECB supervision are concentrated across three cloud providers, and many are now planning how to maintain minimum operations if one fails. The ECB has applied the same logic to itself, choosing a European cloud provider for its integrated reporting framework despite the higher cost.
The panel agreed that collaboration is absolutely essential, particularly in areas such as cybersecurity and quantum computing. Panellists noted that when shared infrastructure fails, even the largest banks can be as exposed as the smallest.
Panel two: scaling AI in banking, strategy and implementation
The second panel looked at how two of Europe's largest banking groups are taking AI from pilot to production. It was moderated by Ritesh Singhania, CEO and Co-founder of Zango. The panellists were Gloria Sánchez, Group Chief Data and AI Officer for General Secretariat at Santander, and Mario Pardo, Global Head of Institutional Engagement at BBVA.
The discussion highlighted how banks are combining top-down strategic priorities with bottom-up adoption. AI tools are now being deployed widely across organisations, with BBVA rolling out access to around 120,000 employees. Applications discussed included fraud detection, know-your-customer checks and the processing of legal and administrative communications, alongside significant benefits in customer service and software development.
A recurring theme was that getting from pilot to production requires fundamentally redesigning processes, rather than simply adding AI to existing ones. Pardo drew parallels with the digital transformation of banking a decade ago, describing an approach focused on making processes faster, safer and more flexible while building on existing governance and controls. Sánchez emphasised the importance of prioritising use cases that create measurable value and scaling successful applications across the organisation.
Both speakers also discussed technological sovereignty and the question of which capabilities banks should retain in-house. Pardo described an approach in which critical components, including guardrails, connectors, client data and memory, remain under the bank's control, while models are sourced from multiple providers. He also highlighted the importance of safeguards such as zero data retention.
The discussion also touched on the challenges of navigating overlapping regulatory frameworks, particularly for banks operating across multiple jurisdictions. Panellists highlighted the importance of proportionality and consistency in supporting responsible AI adoption, alongside the need for greater attention to cybersecurity and emerging risks from AI agents providing financial services outside traditional supervision.
Closing address: Pere Nebot, Chief Lending Transformation Officer, CaixaBank
Pere Nebot closed the morning by emphasising the importance of focusing AI investment on the right use cases. He noted that AI can reduce productivity when applied to tasks beyond its capabilities, so banks need to be selective about where they deploy it and concentrate on scaling what works.
CaixaBank's work in lending provides an example of this approach. AI supports credit risk analysts by gathering data, calculating ratios and preparing a consolidated credit memo, while the final lending decision remains with a human.
Nebot also argued for centralised governance with decentralised execution. Three years ago, CaixaBank appointed a Chief AI Officer and initially focused on six transformation projects. That central function now helps oversee AI deployment, including compliance with the AI Act and the management of data shared with external model providers.
He emphasised that while execution can be decentralised, governance cannot be fragmented. Banks need a central function with visibility over AI deployment and the associated risks, including concentration, data privacy and bias.
His conclusion reflected the recurring theme throughout the forum that as AI becomes more deeply embedded in banking operations, institutions need central visibility over how it is being used and the risks involved.
Guests continued the discussion over coffee on the terrace overlooking Madrid.
Looking ahead
The discussions in Madrid highlighted the scale of the changes AI is bringing to European banking, and the importance of ensuring that governance keeps pace. It was encouraging to see such open exchanges between banks, supervisors and academia on the challenges ahead, particularly where greater industry collaboration will be essential.
Zango's AI governance research report
To find out more about the topics explored in this event, read the report The Future of AI Governance & Compliance in Financial Services, which draws on interviews with 27 senior executives from UK and European financial institutions.
