As generative and agentic AI systems rapidly expand across financial services, institutions face a growing and poorly understood risk landscape. This research introduces a specific framework to help financial services organizations better identify, classify and measure AI-related incidents, bringing greater transparency, consistency and accountability to AI risk management.

Why this research matters

Without a consistent way to identify, measure and disclose AI incidents, financial institutions face increasing exposure to operational failures, governance gaps and adversarial misuse risks. Current public disclosures and incident repositories only partially capture these events, thereby limiting the ability of firms, regulators and investors to accurately assess the true risk and cost.

This research proposes an AI incident taxonomy that can serve as the foundation for future research into this area and can strengthen governance, improve risk modeling and support more responsible and resilient adoption of advanced AI technologies.

Key Findings

• AI incidents are largely absent from public disclosures: Analysis of SEC filings shows no explicit references to AI-related incidents, despite growing AI adoption and emerging evidence of material impacts.
• Transparency lags rising AI risk: AI risk mentions are increasing, but disclosures remain generic, lack detail and fail to capture real-world incidents especially in confidential sectors like finance.
• An AI incident taxonomy is essential: The research proposes a tailored AI incident taxonomy that organizations can adapt for their own needs, covering five core incident types –
  • Operational failures,
  • Decision-support errors,
  • Trading anomalies,
  • Fraud and misuse and
  • Compliance and privacy failures

Who should read this

• Financial services executives and board members
• Risk, compliance and audit leaders
• Technology, AI and data leaders
• Regulators, policymakers and investors