Before the Copilot, the Bank Had to Fix Its Plumbing

M&T Bank first blocked employees from using AI at all. Eight years of unglamorous infrastructure work later, 15,000 of them are using it every day.

Welcome Back,

M&T Bank has deployed AI copilots to more than 15,000 employees as the US regional bank applies AI to internal operations, customer service, software development, and risk management, according to AI News. The bank uses AI to analyse call-centre conversations, draft reports, generate code, identify customer needs, and flag portfolio risks, and is also examining agentic AI applications in cybersecurity and fraud detection.

Here's the detail that makes this story genuinely more interesting than a routine "bank adopts AI" headline, M&T didn't start by embracing generative AI. Before the wider rollout, the bank initially restricted employee access to public large language models entirely. Chief data officer Andrew Foster told American Banker that M&T blocked the tools because employees could potentially enter sensitive company information into public-facing services.

Today we look at how a bank goes from blocking ChatGPT outright to deploying AI across a third of its workforce, the eight-year infrastructure overhaul that had to happen first, the specific data-governance work that made the whole rollout possible, and how M&T's approach compares to what JPMorgan Chase and Bank of America are doing with their own employees.

🚫 The Bank That Said No First

It's genuinely worth sitting with the fact that M&T's AI story starts with a ban, not a rollout. Blocking employee access to public LLMs is a reasonable, common-sense first move for any regulated financial institution, the risk of an employee pasting a customer's account details or a confidential internal memo into a public chatbot is real and specific, not hypothetical.

M&T later evaluated enterprise providers and selected Microsoft Copilot, starting with a pilot involving about 800 employees before expanding access across the organisation. American Banker reported in September 2025 that 16,000 of M&T's roughly 22,000 employees were already using Microsoft Copilot for tasks including drafting emails and reports and summarising call-centre conversations, a genuinely significant chunk of the entire workforce.

Six minutes per call sounds modest in isolation, but multiplied across a bank's entire call-centre volume, that's a genuinely large, measurable efficiency gain, exactly the kind of concrete, unglamorous result that tends not to make headlines but does show up clearly on an internal operations dashboard.

AI-generated call summaries save roughly six minutes per call, a small gain that compounds across an entire call center's volume.

🏗️ Eight Years of Unglamorous Groundwork

M&T's AI deployment follows a technology overhaul that began all the way back in 2018, years before ChatGPT existed. The bank said more than half of its technology specialists were external workers at the time, compared with an 80% in-house technology workforce today. M&T now has about 2,000 technologists working across more than 300 agile teams, and has hired more than 1,000 technology specialists during the programme.

The bank has also replaced dozens of older platforms, and technology outages have fallen by more than 80% since 2018, while the number of system upgrades completed annually has increased by 300%. Technology spending exceeded $1.2 billion in 2025, nearly three times its 2017 level, and annual technology releases increased from about 15,000 in 2018 to 65,000 in 2025, according to what Wisler, M&T's senior executive vice-president for technology and operations, told Forbes.

🔍 "Data Lineage": Knowing Where Every Number Actually Came From

M&T's data programme developed alongside the broader technology overhaul. Foster, who joined the bank in 2023, began building a data-lineage programme to track where information originates, how it is used, and how it moves between systems. He told American Banker that this work was not created in response to generative AI, he described it as a core capability for understanding M&T's data estate.

That "not created in response to generative AI" detail is genuinely worth flagging. Foster is essentially saying the data governance discipline that AI now depends on would have been built anyway, for entirely separate operational reasons, and AI simply became one more, particularly high-profile beneficiary of work that was already underway.

Data-lineage tracking lets M&T trace exactly where an AI-generated answer's underlying information actually came from.

📚 An Internal Encyclopedia Called Edison

The bank also established a Data Academy focused on data governance and data skills, with around 2,000 employees participating. M&T has created an internal repository called Edison containing authoritative documents and information on bank policies, and the bank uses data-lineage software from Solidatus and Monte Carlo to trace information as it passes through databases, applications, and business-intelligence systems.

That combination, retrieval-augmented generation plus a governed, well-documented internal knowledge base like Edison, is a genuinely sound architecture for a regulated industry. Rather than relying on a language model's general training data, which can be outdated or simply wrong about internal policy specifics, the AI is grounded in the bank's own current, authoritative documents before it generates an answer.

That's the technical answer to a question that should worry anyone using AI at a bank, "how do I know the AI's answer about a policy is actually correct and current?" Grounding the model in a governed, traceable internal source is a genuinely stronger answer than simply trusting the model's own general knowledge.

👀 The Rule That Never Gets Waived

Software developers at the bank use GitLab tools to generate code, while employees remain responsible for reviewing AI-generated work, a rule that isn't just a soft internal expectation, it's written directly into policy. M&T's human-review requirement is reflected in its 2026 Code of Business Conduct and Ethics, which requires employees to use approved AI tools and prohibits confidential, proprietary, customer, employee, or regulated information from being entered into unapproved systems.

That three-route framework, described by Wisler to Forbes, is a genuinely clear-headed way for a large, complex organisation to think about AI adoption, rather than one single top-down mandate, M&T is layering general-purpose tools, vendor-embedded AI it doesn't have to build itself, and custom systems built for its own specific, highest-value problems.

Developers use AI to generate code, but remain formally responsible for reviewing it under the bank's written policy.

🧠 AI Spotlight Analysis

M&T's approach is genuinely worth comparing against what other large US banks are doing, because the pattern that emerges is remarkably consistent, and instructive. JPMorgan Chase launched its internal LLM Suite platform to more than 200,000 employees in 2024, and by 2025, more than 65,000 employees in its Corporate and Investment Bank were actively using the platform, with more than 90% of its engineers using AI coding assistants. The bank also said AI-based transaction screening allowed it to review more than twice the previous transaction volume while reducing manual operator checks by half.

Bank of America is using a generative AI-enabled system called EricaAssist with more than 18,000 customer service employees, summarising why a customer is calling, retrieving relevant information, and recommending possible next steps, while keeping the employee responsible for the interaction. The bank said in July 2026 that EricaAssist can deliver contextual guidance in under three seconds and has reduced average call times by nearly one minute.

The common thread across all three banks, M&T, JPMorgan, and Bank of America, is that human oversight is preserved as a formal, structural feature at every one of them, not an informal courtesy. Employees stay responsible for reviewing AI-generated code, for the accuracy of a customer interaction, for the final call on a flagged transaction. That consistency across three separate, competing institutions suggests it's less a matter of individual company caution and more an emerging industry norm for how regulated finance is choosing to deploy AI at scale.

🔗 Sources and Further Reading

Thanks for reading AI Spotlight.

Our mission is simple: deliver clear, trustworthy, and actionable AI insights that help professionals stay ahead without the hype.