What fintech CTOs trust AI to do in 2026

Madalin Stefirca, CTO of Maxcode, explains that, regardless of how many firms are piloting agentic AI, only a few have shipped it into a system a regulator can audit.

Key takeaways

• Only a fraction of the 52% of financial services firms adopting agentic AI can show a regulator an auditable decision trail.

• Accountability stays with the institution and a named individual inside it; it never transfers to the AI model.

• Every autonomous decision needs a deterministic, human-readable log and hard escalation thresholds.

• Budget for model monitoring, human review, and audit infrastructure before the model itself.

According to the Cambridge Centre for Alternative Finance, 52% of financial services firms are now actively adopting agentic AI. That figure hides a wide gap between ‘we're running a pilot’ and ‘we have an AI agent making autonomous decisions inside a system a regulator can walk into and ask us to explain.’

Madalin Stefirca, CTO of Maxcode, has spent the last several years on the far side of that gap, building infrastructure that compliance-heavy fintech and healthcare clients ship into production. The Paypers spoke with him about what it costs to move fast on AI without cutting corners a regulator or a board will eventually ask about.

What the AI adoption numbers hide

‘Adopting’ AI can mean anything, Madalin points out, be it a chatbot answering FAQ tickets or an agent approving a transaction limit change with nobody in the loop. ‘The question I'd want a CEO to ask isn't are we adopting AI. It's which of our AI use cases could I put in front of a regulator today and walk them through exactly why the system did what it did.' By that measure, the share of genuinely auditable deployments sits well below the 52% headline.

The line he draws is between recommendation and action. Document verification and anomaly flagging that routes to a human are use cases he'd greenlight without hesitation. Multi-step agentic workflows that decide and act with no checkpoint are a different story. ‘Not because the model can't do it. Because most organisations haven't built the audit trail, the rollback path, or the plan for who gets called at 2am. The technology is almost always ready before the organisation is, and that gap is where the risk actually lives.’

Accountability doesn't move to the AI agent

Ask Madalin who's on the hook when an AI agent breaches a regulation, and his answer is unambiguous: it stays exactly where it always did. ‘Legally, it doesn't move to the machine; it stays with the institution, and usually a named individual inside it.’ What changes is how much harder it becomes to prove due care was exercised, and that is an engineering problem first.

His rule: never let the model be the only record of what happened. Every agentic decision needs a deterministic, human-readable log (what data it saw, what it concluded, what it triggered) captured the moment the decision is made. Hard stops matter too: thresholds where the system must escalate rather than act, no matter how confident it claims to be. ‘If a CEO and a CTO haven't had an explicit conversation about where those stops sit, the responsibility is unstructured and just hoped for.’ Put more bluntly: ‘A system that can't reconstruct its own decisions is a liability with good UX and certainly not AI governance.’

The two costs of speed

Moving too slowly costs market position, Madalin says; a competitor ships a faster onboarding flow and deals disappear. Moving too fast costs a regulatory finding and months retrofitting audit trails onto a system never built to produce them. ‘Move fast on the augmentation use cases, where a mistake is small and reversible. Move deliberately on the autonomous ones, where it isn't.’ That calculus sharpens now that fraudsters use generative AI too: ‘standing still is the losing option, not the cautious one. But treating the fact that AI is now a fraud risk as a reason to rush autonomy into production without the audit infrastructure just swaps one risk for another.’

What gets pulled forward, and what gets scrutinised

Roadmap conversations split cleanly, Madalin says. Pulled forward: anything customer-facing that speeds up a task a human was already doing and still checks. Pushed back: autonomous decisioning inside anything carrying a regulatory reporting obligation. ‘Often, the honest answer is: the model is ready, your audit infrastructure isn't, so we're building that first; a six-month conversation nobody wants to have in a board meeting, but cheaper than the alternative.’

He's equally direct about where scrutiny has already slipped: ‘a support bot quietly goes from answers questions to takes actions without anyone re-approving the risk assessment, and six months later it's initiating account changes nobody signed off on. I'd rather ship a sprint later than have that conversation during a regulator's inquiry.'

The line items nobody budgets for

AI's cost-saving story is real, but only in specific places: document-heavy work like KYC review and dispute triage. Those savings turn into a cost centre in three areas the original business case rarely names: model monitoring, human review, and audit infrastructure. ‘I tell CEOs to budget for those three line items before the model itself. They're the difference between a pilot and something you're actually allowed to keep running.’ A 30% saving on paper, he adds, often lands closer to break-even once those layers are funded; in his framing, that is simply the true cost of a fintech-grade AI project.

Trust as a competitive edge

Visible AI in a financial product now invites more scrutiny than it did eighteen months ago, as customers grow wary of bad chatbot experiences elsewhere. ‘People want a clear, fast path to a human when the AI gets it wrong.’ The same point answers the CEOs who worry that competitors are moving faster on autonomous AI: ‘the comparison is usually false. A competitor who looks faster is often just further from a regulator's attention; and that gap closes the moment they scale or have an incident. We built this properly is becoming a differentiator boards can point to, more than just a cost centre.’

The skills gap is mostly retraining

Asked what an AI-era engineering team needs that a traditional one did not, Madalin points first to: ‘mostly retraining. Prompting isn’t the hardest skill; actually, it's teaching engineers to build for reconstructability: designing a system assuming someone will need to explain its exact behaviour eighteen months from now, under time pressure.’ The genuine hiring gap sits at the intersection of engineering and compliance, ‘a role that barely existed three years ago,' and compliance itself needs to be in the room earlier. ‘With agentic AI, a review before launch happens too late; the architecture that makes it auditable has already been decided.’

The one decision not to defer

With regulators still catching up, Madalin's advice is to build toward where the rules are obviously heading rather than wait for the final text. That means knowing in advance what makes the institution accountable and what exposes it to an audit. Pressed for the one decision he'd tell a fintech CEO not to defer into 2027, his answer points to an audit of what is already live: ‘decide, in writing, which of your existing AI features are allowed to act autonomously today versus which ones only look like they are. That usually surfaces two or three features that quietly crossed from recommend to act without anyone deciding that on purpose.’

Across every answer, one theme repeats: in a regulated environment, the difficult work sits around the model rather than in it. Everything a company builds around the AI system makes it accountable for what the model does. That's exactly what Maxcode is now measuring through its Tech Survey 2026, gathering data from engineering, product, and compliance leaders across Europe on how AI is being deployed in production, rather than merely piloted.

Frequently asked questions

Who is accountable when an agentic AI breaches a regulation?

Accountability stays with the institution, not the machine. As Madalin puts it: ‘legally, it doesn’t move to the machine; it stays with the institution, and usually a named individual inside it.’

What does an auditable agentic AI system actually need?

A deterministic, human-readable log of every decision, and hard thresholds that force the system to escalate to a person rather than act on its own. In Madalin’s words: ‘every agentic decision needs a deterministic, human-readable log [..] hard stops matter too: thresholds where the system must escalate rather than act, no matter how confident it claims to be.’

Take part in Maxcode’s Tech Survey 2026

About Madalin Stefirca

Madalin Stefirca is CTO at Maxcode, a tailored software development company serving fintech and other regulated industries across the EU. He joined in 2011 as a full-stack developer, advancing through Team Lead and Tech Lead roles before taking on his current position, where he now leads technical strategy, security governance, and compliance for the company's teams – work grounded in certified information security practices, with a close eye on privacy and AI governance frameworks. Drawing more than 15 years in software delivery, Madalin builds high-performing teams focused on quality, and is steadily integrating AI into the company's workflows in a measured, effective way.

 

About Maxcode

Tomorrow’s world will be hyperconnected and decentralised. You need high-performant financial systems delivered fast, without compromising security or compliance. Maxcode delivers both. 

We live and breathe regulated fintech: PSD3, FIDA, DORA, and Open Banking. These aren't obstacles for us; they're how we think. Our senior engineers work directly with yours, turning complex regulation into robust, scalable software. We take ownership from start to finish. Hands-on, no blabla.

That's why banks, PSPs, and fintech providers trust Maxcode to deliver financial technology that is fast, secure, and compliant.