Enterprise AI buyers in financial services have a new variable to model: the possibility that UK regulators will demand powers over the models themselves. On 30 September 2026, Bank of England Governor Andrew Bailey said that regulating AI is "not the right place to start" and called for a "right to intervene" as the technology poses growing threats, according to BBC News (bbc.co.uk) and The Guardian (theguardian.com). The remarks set the tone for UK AI oversight and signal that financial regulators may seek powers over AI models used in critical operations. For operators, the practical question is not whether AI will be regulated, but how to structure contracts and budgets so that regulatory intervention does not become an unmodelled cost.
What Bailey actually said
Bailey's position is nuanced. He did not call for a new AI-specific regulator. Instead, he argued that regulating AI is "not the right place to start" and that existing regulators should have a "right to intervene" when AI systems pose risks. This matters because it suggests a sectoral approach: the Bank of England, the Financial Conduct Authority and other bodies would use existing powers rather than a new AI Act-style regime. For enterprise buyers, that means the regulatory risk is not a single future law but a patchwork of interventions that could arrive through supervisory guidance, rule changes or individual enforcement. The timing is significant. The comments came as AI adoption in financial services accelerates, from credit scoring to fraud detection to customer service. The Bank's concern is that AI models can be opaque, difficult to audit and capable of causing systemic harm if they fail or behave unexpectedly. A "right to intervene" would give regulators the ability to demand access to models, require changes to how they operate, or even restrict their use in certain contexts.Why this creates procurement uncertainty
For enterprise AI buyers, the immediate challenge is contractual. Most AI procurement contracts are built around service levels, data protection and liability. They rarely include clauses that give a regulator the right to access a vendor's model, audit its training data or force changes to its behaviour. If the Bank of England or another regulator demands such powers, buyers could find themselves caught between a vendor that cannot or will not comply and a regulator that insists on intervention. The uncertainty is compounded by the fact that AI models are often black boxes. Even vendors may not fully understand how a model reaches a particular decision. That makes it difficult to promise a regulator that the model will behave in a certain way, or to guarantee that an intervention can be implemented without disrupting service. Buyers should therefore model scenarios where a regulator requires changes to a model mid-contract, and consider who bears the cost and risk of those changes.A decision framework for AI buyers
Operators can use a simple framework to assess their exposure. First, map which AI systems are used in critical operations. Not all AI is equally risky. A chatbot that answers routine queries is different from a model that makes credit decisions or detects fraud. The Bank's focus is likely to be on the latter. Second, review existing contracts for clauses on model access, audit rights and change control. If these are missing, buyers should seek to add them before renewal or new purchases. Third, assess vendor readiness. Ask vendors how they would respond to a regulatory request for model access or intervention. Do they have the technical capability and legal willingness to comply? Fourth, build a regulatory contingency into budgets. This could mean setting aside a reserve for compliance costs or negotiating a price adjustment mechanism if regulatory changes materially affect the service.Contract clauses to prioritise
Three clauses deserve particular attention. The first is audit rights. Buyers should ensure they have the right to audit, or to require the vendor to audit, the AI model's performance and compliance with agreed standards. This should extend to sub-processors and third-party model providers. The second is model access. If a regulator demands access to the model, the buyer needs a contractual right to require the vendor to provide it. This may include access to model weights, training data or documentation. The third is intervention powers. If a regulator orders a change to the model, the contract should specify who is responsible for implementing it, how quickly, and who pays. Without these clauses, buyers could face service disruption or unexpected costs.Commercial impact
The commercial impact is twofold. First, AI vendors may need to invest in compliance capabilities, which could increase prices. Vendors that can demonstrate regulatory readiness may gain a competitive advantage. Second, buyers may need to adjust their budgets. A multi-year AI contract that does not account for regulatory intervention could become more expensive than expected. Finance teams should stress-test AI business cases against scenarios where regulatory changes require model modifications or additional oversight.Risks and unknowns
The biggest unknown is the precise form that the "right to intervene" will take. Bailey's comments are a signal, not a detailed policy. It is not clear whether the Bank will seek new statutory powers or rely on existing ones. Nor is it clear how quickly any changes would be implemented. There is also a risk that a sectoral approach leads to inconsistent requirements across regulators, increasing compliance complexity for firms operating in multiple jurisdictions. Finally, there is the risk that vendors resist intervention clauses, particularly if they involve access to proprietary models. Buyers should be prepared for negotiation.FY Outlook
Expect the Bank of England and other UK financial regulators to clarify their approach to AI oversight in the coming months. The direction of travel is towards greater intervention powers, but the specifics will matter. Enterprise AI buyers should not wait for final rules. They should begin now by reviewing contracts, engaging vendors and building regulatory scenarios into their AI strategies. The cost of inaction could be significant, both financially and operationally.Sources and References
- BBC News: Regulating AI 'not the right place to start' says Bailey (bbc.co.uk)
- The Guardian: We need ‘right to intervene’ in AI amid growing threat, says Bank of England boss (theguardian.com)
Why It Matters
The Bank of England Governor's call for a 'right to intervene' in AI signals that UK financial regulators may seek powers over AI models used in critical operations. This creates regulatory uncertainty for enterprise AI buyers, who must now model contract clauses on model access, audit rights and intervention powers before committing multi-year budgets. The intervention sets the tone for UK AI oversight and could affect vendor contracts, compliance budgets and the viability of certain AI deployments in financial services.The reporting and evidence for this briefing were checked against bbc.co.uk (bbc.co.uk) and theguardian.com (theguardian.com).
