Most AI conversations, even today, talk about the potential, the benchmarks, and what a model can do.
But what rarely gets discussed is what it actually takes to move AI out of labs and into the daily operations of a large regulated institutions, like a bank.
David Villalon, Cofounder & CEO of Maisa, and José Palacio, Chief Data and AI Officer and Head of Global AI Adoption at Santander, have been working together for a year on bringing AI inside high stakes banking operations at Santander.
At Revolution Banking 2026 in Madrid, they got on stage to share what they have learned during this journey.
Here are the six major lessons that came out of that conversation.
Lesson #1: Scaling AI in banking is more difficult than most other industries
Everyone has seen impressive demos of what AI can do. So the assumption is that going from a proof of concept to full production should be a natural next step.
But it is not that easy. David opened the conversation by calling it out.
"When you finally face the reality of scaling AI in production and do things that go beyond conversational agents, you realize it is not so pretty."
This is because banking is one of the most regulated industries in the world. So every decision an AI system makes inside a bank has to be explainable, traceable, and documented in a way that holds up under regulatory scrutiny.
A system that gets the answer right ‘almost all the time’ may work for most industries, but banks need to be able to show exactly how every decision is made, every time, with 100% reproducibility.
This requirement alone changes everything about how you build and deploy AI in this industry, and why Santander chose to work with Maisa which guarantees full traceability for all decisions.
Lesson #2: We hold AI to a higher standard than we ever held humans
In banking, when a process is carried out by humans, the error rate is a part of the process. Provisions are created to account for them in advance.
But the moment you introduce AI into that same process, that tolerance disappears. And the reason for this is hallucination.
AI models can produce confident, well-structured answers that are simply wrong. This is a problem for banks because it lead to a wrong lending decision, a compliance breach, or a regulatory outcome that cannot be undone.
This is why banks are right to hold AI to a stricter standard.
Instead of just asking if the model is impressive and can do a lot of things very fast, they need to know whether a system is built around the same model to make it resistant to hallucinations, ensuring that incorrect decisions are stopped in time.
Lesson #3: ROI has to be built in from day one, not figured out later
José described seeing a post on LinkedIn that captured something he has heard many times in practice. A CEO says they want AI. Someone asks why. The answer is, “I don’t know, but we need it.”
That is how a lot of AI projects start. And it is also how a lot of them fall apart.
The cost structure of running AI at scale is something many teams discover later than they should. There is the infrastructure cost, the token costs, the support team, the change management, and the adoption work. Each of these has a price. And once you are running at any real scale, they add up fast.
At Santander, every use case is evaluated against three specific criteria: does it increase revenue, does it reduce cost, or does it reduce risk?
If a business case cannot be clearly tied to at least one of these 3, it does not move forward.
Working with Maisa gave Santander an added advantage on this front. Since Maisa is not tied to any model, they could define a process once using a more capable model, and then switch the execution to a lighter, faster, and cheaper model once everything was defined. This made a measurable difference in keeping ROI in check.
Lesson #4: The right team for AI in a bank does not come from one place
José mentioned that when they started exploring AI at Santander, there was no playbook for what an AI team inside a bank should look like. They have been figuring it out as they go.
What has become clear is that you need a combination that most organizations do not naturally have sitting in one place.
You need people who understand the business deeply, who know how the processes actually work and why decisions get made the way they do. You also need people who come from outside the institution, from startups, from more dynamic environments, who bring a different way of seeing problems. And then you need the technical specialists: data engineers, AI scientists, people who understand deployment and connectivity at a system level.
There is also a governance layer. Someone has to know how to quantify the risk that AI introduces into a process and how to put the right controls in place. Without that, you are not managing risk, you are just hoping nothing goes wrong.
At Santander, one of the things that worked in their favor was that Maisa is built for exactly for this collaborative environment. Business users, people with real process expertise and no technical background, could create and configure digital workers themselves. The people who understood the work most deeply were also the ones building the automation around it. This made a real difference in how quickly and accurately the deployments came together.
Lesson #5: Data quality is where new AI use cases succeed or fail before they even start
When José was asked where to begin with a new AI use case, his first response was not about the model or the technology. It was about the data.
What data do you have? What is its quality? How available is it, and how well connected is it to the process you are trying to automate? Because: garbage in, garbage out.
A use case built on poor or fragmented data will not perform well, no matter how capable the model is.
This matters more in banking than in most industries because the data often sits across legacy systems that were never designed to talk to each other. Getting it into a shape that an AI system can actually use requires foundational work that takes time. Teams that skip this step and go straight to building the use case almost always end up rebuilding it later.
Lesson #6: 3 must-have requirements for every new AI project in enterprises
When José was asked what every enterprise needs to get right over the next two to three years, he gave three answers.
#1: Data: Having clean and connected data that is ready to be used across systems is essential. In most large banks, data sits in silos that were never designed to talk to each other. Until that is addressed, any AI deployment built on top of it will have a ceiling.
#2: Governance: José calls it governance, risk, and compliance, and he means all three together. In a regulated industry like banking, a regulator can stop an AI deployment that does not have the right risk and control framework in place. The costs of fixing it later are far higher than building it in from the beginning.
#3: Transformation mindset: This is the hardest one. AI done properly is not about taking the process you have today and running it faster. It is about stepping back and asking whether that process is the right one in the first place. That requires people who are willing to question how things have always been done, and leadership that gives them permission to do it.
None of these three things is a technology problem. They are organizational challenges that require real commitment and the right people working on them.