A mortgage application arrives. Documents are collected, identity is checked, income and obligations are reconciled, affordability is tested against the bank’s policy, and a complete case is prepared for review. An AI agent can increasingly coordinate all of that, without anyone copying a number from one screen to another.
Then it finds a contradiction. Declared income does not match a source document, or the case falls outside the policy the agent was given. What should happen next?
That moment reveals what we call a bank’s distance to autonomy: the gap between what an AI agent can technically do and what the bank can responsibly, legally and safely let it do.
Having AI that can perform a task is very different from having an organization that is ready to let it. The distance to autonomy is the space between the two, and it differs by process: a bank may be close in document preparation and far away in credit exceptions. Closing it safely takes more than a better model. The bank has to decide what the agent may do, what evidence it must leave behind, when a person must step in, and who remains accountable.
Microsoft describes a “Frontier Firm” as an organization that rethinks how work gets done around AI, with employees directing agents and teams organized around outcomes. Its banking blueprint describes a progression from employees using AI assistants, to human–agent teams and, in some areas, human-led, agent-operated work.
Banks will sit at different points on that progression in different functions. The distance to autonomy is what determines how fast a regulated bank can move along it, where it can safely stop and how it can reduce the gap without weakening control. Frontier Banking is how Cegeka helps banks make that move in practice: redesigning how people, AI agents, data and existing banking systems work together so that more of the end-to-end process can be automated safely.
The goal is not a bank where every decision is made by a machine. It is a bank that can delegate real work without turning trust into a leap of faith. For the business, that means:
The ambition is not maximum autonomy. It is maximum useful autonomy within boundaries the bank can enforce, monitor and safely adjust.
Each addresses a condition for reducing the distance safely, and each comes with a question a business leader should be able to answer.
Policy must be explicit, versioned, testable and executable, not left in manuals and employees’ memories. A deterministic policy service applies the approved rules; the agent works within them and must never invent or rewrite them. Authority is granted per action, by impact and reversibility: an agent may request a missing document or prepare a standard case, and prepare an exception for review, but never approve it itself.
An agent acts through its own identity and narrowly scoped permissions, not a shared credential with broad access to core banking. A person must step in when evidence conflicts, policy requires judgement or the potential impact on the customer is material. Reviewers need the information, competence, time and authority to challenge the proposed action, change the outcome or stop the workflow. If their only option is to click “approve”, the bank has moved a click, not created meaningful control.
The bank keeps a traceable record of the evidence behind each material action: the sources, rules, results, exceptions and human interventions. A model’s own explanation is not a substitute. After deployment, it monitors errors, overrides and customer outcomes, and it can suspend an agent, narrow its permissions or return work to people. Autonomy that cannot be observed or withdrawn is not a safe operating capability.
The agent gathers documents and prepares the case, a policy service applies the bank’s fixed rules, and the evidence record links the result to its sources and policy version. If information conflicts or the case falls outside the mandate, the workflow pauses and a qualified reviewer takes over. That pause is not a failure of automation. It is what makes delegation responsible.
Regulation will not fix fragmented data or unclear decision rights, but it does set the boundaries within which banks can use AI. Under the EU AI Act, AI used to assess the creditworthiness or credit score of individuals is considered high-risk, except when used for detecting financial fraud. These systems are not prohibited, but they must meet stricter requirements around areas such as risk management, data governance, transparency and human oversight.
The good news is that banks do not have to navigate two entirely conflicting regulatory worlds. The EBA found no significant contradictions between the AI Act and existing EU banking and payments legislation, although bringing the different requirements together will still take work.
GDPR adds another important consideration: where does the actual decision sit? The SCHUFA judgment showed that simply putting a person or another party at the end of the process is not necessarily enough. If an automated credit score strongly influences whether a customer gets access to a product or service, Article 22 may still apply. What matters, therefore, is not only who formally makes the decision, but also how much influence the automated output has on it.
This makes human oversight more than a governance checkbox. For high-risk AI, the AI Act requires effective human oversight. In practice, the people overseeing these systems need to understand what the AI can and cannot do, interpret its output and remain alert to automation bias.
And finally, DORA adds the operational-resilience perspective. As AI becomes embedded in banking processes, banks also need to consider ICT risk, resilience and their dependency on third-party technology providers.
Taken together, the message is not that regulation prevents banks from using AI. It is that moving from AI that advises to AI that acts requires much clearer control over data, decisions, human accountability and operational resilience.
Map one real process as it actually runs: handovers, systems, exceptions, decisions. For each step, decide what an agent can safely execute, what it may prepare for approval and what must be escalated. Test routine and difficult cases, set a baseline for decision time, rework and cost, and reduce the distance to autonomy safely, and only when the evidence shows the bank can detect, explain and correct failures.
Defining what a bank may delegate is the first half of the question. The second is whether it can turn what it knows into the right, authorized action fast enough for the customer to notice.
In the next article, we follow an SME facility renewal in which KYC, Credit and Operations each do their job correctly, and the customer is still waiting. We look at decision-to-action capacity: how a bank separates understanding, deciding and acting, and improves the whole journey rather than a single step.
Safely reducing the distance reaches beyond AI: modern applications and data, integration with specialist engines for core, KYC and AML, enforceable controls, secure hybrid platforms and a team that can run the service. Cegeka’s Frontier Banking position connects these needs through Controlled Modernization & Lifecycle, Regulated Process Transformation and Resilient Hybrid & Sovereign Operations. Microsoft provides the platforms; Cegeka brings the banking process architecture, integration, controls and managed operations that turn them into working solutions. For the bank, that means a bridge from platform capability to safely delegated work, while retaining control over risk appetite, customer and credit decisions, model and agent approval, and data rights.
Banks are already moving agents into consequential workflows; ING’s public mortgage pilot keeps an employee responsible for the final decision. A bank closes the distance to autonomy safely each time it turns a human workaround into explicit policy, a delegated task into bounded authority and an AI action into auditable evidence. That is an inspiring frontier: more work moving at machine speed, while safety, control and human judgement stay where they matter.
Pick a process where complexity, manual work and judgement come together. In a half-day working session, we map that workflow end to end: where AI can already take on work safely, where the boundaries to autonomy sit, and what needs to change to move them responsibly. You leave with a one-page view of your distance to autonomy and a proposed first step.
One workflow. Half a day. A concrete view of your distance to autonomy.
Discover your bank’s distance to autonomy
Start with one workflow. In a half-day working session, we map where AI can already take on work, where the boundaries to autonomy sit today, and what needs to change to move those boundaries responsibly.