BaFin Gains Powers to Supervise AI Across German Finance
Germany has given financial regulator BaFin responsibility for supervising banks’ and financial institutions’ use of artificial intelligence.
The authority will monitor compliance with transparency obligations, controls for high-risk systems and prohibited practices under the EU’s AI framework, Public reporting indicates that .
AI governance enters mainstream supervision
Financial institutions use AI in credit, fraud detection, transaction monitoring, customer service and internal decision support. These applications may create regulatory risk when data quality is weak, outputs cannot be explained or automated decisions affect customers unfairly.
Firms should maintain an inventory of AI systems, classify their risk and identify accountable owners. High-impact models require documented testing, human oversight, change management and monitoring for drift or bias.
BaFin’s new role means AI controls will increasingly be examined alongside traditional governance and risk management. German institutions should be prepared to demonstrate not only what a model does, but why its use is lawful, proportionate and reliably supervised.
Interaction with existing financial regulation
AI supervision will sit alongside requirements for operational resilience, outsourcing, data protection and model risk. A system may comply with one framework while still creating problems under another, particularly where customers are denied a service or investigators cannot explain an automated recommendation.
Institutions should link their AI inventory to existing risk registers and incident reporting. Compliance, technology, legal and business owners need a shared approval process. Procurement should not begin before the institution knows the system’s risk classification, required documentation and level of human oversight.
Documents firms should be ready to provide
- An inventory and risk classification for every material AI system.
- Testing results, data lineage and records of model changes.
- Human-oversight procedures and escalation thresholds.
- Incident records showing how harmful or inaccurate outputs were handled.
Next focus: BaFin guidance and early supervisory reviews will clarify documentation expectations for different uses. Firms should monitor whether transaction monitoring, credit and customer-facing systems receive different levels of scrutiny.
