Barclays plans to extend Claude Code to half its developers

Barclays plans to extend Anthropic's Claude Code to half of its developers by 31 December 2026, and to a majority of its software engineers during 2027, according to an announcement Anthropic published on 1 October 2026. The bank already has a Claude-powered internal knowledge tool in use by more than 16,000 colleagues, and it uses Claude models to handle roughly 120,000 incoming emails a day in its Global Markets business.

The rollout matters to UK readers because Barclays UK employees use the knowledge assistant to support more than 20 million UK retail customers, and because the bank says Claude will be applied to software development, legacy-platform modernisation, testing, cyber security and technology operations. None of this means customers interact with Claude directly, and the announcement does not say they do. But a UK high-street bank widening its reliance on an external AI supplier, inside core engineering and operational workflows, raises questions about third-party dependency, cyber risk and operational resilience that go beyond the headline adoption target.

This is a company and supplier announcement, not an independent audit. Anthropic's statement discloses activity volumes and forward targets but no baseline performance figures, no measured productivity or software-quality results, and no detail on the controls Barclays says it applies. Readers should treat the promised efficiency gains as stated intentions rather than demonstrated outcomes.

What Barclays is deploying

Three strands of the collaboration are described in the announcement:

• Claude Code, a coding tool, is being extended across Barclays' developer population, with a target of 50% adoption by the end of 2026 and a majority of software engineers during 2027. Barclays' total developer headcount, its current Claude Code adoption rate, and the number of people the 50% figure represents were not disclosed.
• The Colleague Knowledge Assistant, live since 2025, uses Claude in a retrieval-augmented generation setup, meaning the model is given information from an approved knowledge source before it answers a query. More than 16,000 colleagues have adopted it, and it had handled over one million searches as of 1 October 2026.
• In Global Markets, Claude models classify, enrich and route approximately 120,000 incoming emails a day.

The 16,000-plus figure applies specifically to the knowledge assistant. It should not be read as a combined total across every AI tool Barclays uses.

What the numbers do and do not show

The disclosed figures are activity measures: how many people have adopted a tool, how many searches it has handled, how many emails pass through it. They are not evidence of time saved, defect rates, cost reduction or improved customer service.

Barclays and Anthropic say the deployments cut routine work, manual handling and information-retrieval time. The announcement provides no controlled study, hours-saved figure, defect-rate comparison, cost saving or return-on-investment estimate to support that. Anthropic also says Barclays applies governance, security controls and human oversight to its AI use cases, but the announcement does not describe what those controls are, how they were tested, or whether any independent body has reviewed them.

Questions the announcement leaves open

Several practical governance questions are not answered in the source material:

Whether a human reviews every Claude-generated code change before it reaches production, and what automated testing is mandatory, is not disclosed. Nor is how Barclays checks generated code for security vulnerabilities, fabricated software packages, intellectual-property issues or open-source licence obligations. The announcement does not state what source code, production systems, customer information or market-sensitive data Claude can access, where that data is processed, how long it is retained, or whether Barclays' prompts and outputs are used to train Anthropic's models.

For the knowledge assistant, the underlying knowledge base, its accuracy rate, whether it cites its sources, and what happens when it cannot answer reliably are not described. For the Global Markets email workflow, no error rate, misrouting rate or human-review rate was given.

It was also not established whether any Claude use case makes or materially informs a regulated decision affecting credit, pricing, eligibility or complaints handling. If a future use case did touch those areas, different and more specific regulatory obligations would be engaged.

The UK regulatory position

The Financial Conduct Authority (FCA) has said it does not intend to introduce a separate set of AI-specific rules. Instead, it applies existing outcomes-focused frameworks, including the Consumer Duty and the Senior Managers and Certification Regime, to AI as it does to any other technology or process. That means AI use at a UK bank is not unregulated, but accountability runs through existing senior-management and consumer-outcome rules rather than through a bespoke AI regime.

Where a Claude deployment falls within the scope of the Prudential Regulation Authority's (PRA) model-risk framework, Supervisory Statement SS1/23 applies. The current version has been in force since 23 April 2026 for in-scope UK banks with specified internal-model approvals, and it sets expectations on model identification and classification, governance, development and use, independent validation, and risk mitigants. Whether any particular Claude Code or knowledge-assistant use case counts as a model under SS1/23 depends on Barclays' own internal classification and the permissions held by the relevant legal entity — it is not automatic, and the announcement gives no basis for assuming it applies uniformly.

Where Claude systems process personal data, UK data protection law continues to apply. Information Commissioner's Office (ICO) guidance covers lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. The ICO has said this guidance is under review following the Data (Use and Access) Act, so the current detail should be checked against the latest published version.

On 15 May 2026, the FCA, the Bank of England and HM Treasury jointly told regulated firms to maintain protective, detective, containment and recovery capabilities against frontier-AI cyber risks, including risks arising through third parties and supply chains. The three bodies described this as reinforcing existing expectations rather than creating new ones.

Sector-wide survey evidence gives some sense of how seriously these questions are already being taken. A 2024 Bank of England and FCA survey of 118 regulated firms found that 84% reported having an accountable person for their AI framework, and 72% said executive leadership was accountable for AI use cases. The same survey found firms ranked cybersecurity as the highest potential systemic AI risk, with critical third-party dependencies second and common datasets or models third — concerns relevant to a bank that is expanding its use of an external model provider across coding, knowledge-management and email-processing workflows, though the packet does not establish how Barclays has assessed these specific deployments against that risk framework.

What to watch next

Barclays has set a date-bound target — 50% Claude Code adoption by 31 December 2026 — against which progress can eventually be checked, even though the current adoption rate and developer headcount are not public. What is not yet available is any independently verifiable measure of whether the deployment is improving software quality, cutting costs or changing customer outcomes, or any detail on how Barclays' governance and human-review controls actually work in practice. Readers wanting the primary detail on Barclays' plans should refer to Anthropic's announcement; readers wanting the regulatory framework that would apply should consult the FCA's published approach to AI, the current PRA Supervisory Statement SS1/23, and ICO guidance on AI and data protection, noting that the ICO guidance is under review.