AI in regulated industries: BofA and S&P on the huge gains to be had, and the risks of rushing in

Bank of America's chief technology and information officer said one of the most common AI mistakes is reaching for it first. His bank also plans to double its AI budget next year.

"One of the biggest mistakes we see us and others doing is rush to AI as a solution," Hari Gopalkrishnan said at Fortune 's AIQ Summit in New York, "when deterministic models do a plenty good job."

Gopalkrishnan appeared with Sally Moore , S&P Global's chief client officer and co-head of Kensho Data & Platforms. Fortune Editorial Director Andrew Nusca moderated.

Gopalkrishnan said the bank starts with what clients need and a "process inventory" of the steps behind their requests. It often decides against AI — "plenty of times," he said. A mobile app or a real-time decision rule can be the better answer.

Every AI project also goes through a review that covers 16 "pillars" of risk, including privacy, bias, workforce impact and intellectual property. "We're not going to implement a chatbot that only answers to certain accents," he said.

He said the bank has used AI for more than a decade, starting with fraud models. Its Erica virtual assistant has handled 3.6 billion transactions, he said, and without it the bank would need 11,000 more people to answer the calls. A March bank press release counted Erica's client interactions at more than 3.2 billion.

The caution comes with heavy spending. CEO Brian Moynihan said in September that about 140 AI uses cost $400 million and generate $800 million in benefit, and that the AI expense budget will double next year.

That spending is routed carefully, and Gopalkrishnan said the bank is model-agnostic. An orchestration layer (called Orchestra, naturally) sends simple classification tasks to approved open-weight models running on the bank's own GPUs, and harder reasoning to proprietary models. He said this also helps control token costs. In wealth management, advisors can now prepare for client meetings in "seconds and minutes," work that used to take days and weeks, he said.

On agents, the bank isn't hurrying toward autonomy. "There is so much juice to be squeezed right now with assistive agents that are actually working with humans in the loop," he said. The bank will go further as control infrastructure improves.

He also addressed security, and said AI models are getting better at finding software vulnerabilities, so patching and secure development matter whether or not a company uses AI. The stakes go beyond any one bank, he said: if a small bank somewhere has a problem, people lose faith in the financial system.