Supervisory structure of the AI Regulation in the financial sector
The AI Regulation (EU AI Act) has been in force since August 2024. However, it remained unclear for some time who would oversee compliance with it in Germany. This has now been clarified as of 29 July 2026, with BaFin assuming this role in the financial sector. The legal basis for this is the Act Implementing the AI Regulation, comprising the AI Market Surveillance and Innovation Promotion Act (KI-MIG) [1], [6].
BaFin’s AI market surveillance applies to banks, insurers and other financial firms under the supervision of BaFin or the ECB [2].
However, BaFin is only responsible for AI systems that are directly related to a regulated financial activity, i.e. activities for which a company requires authorisation [1], [3]. If, on the other hand, a bank uses AI in human resources management, responsibility lies with the Federal Network Agency [1].
What is already in force and what is coming from December 2027
Many obligations have been in place for some time. What is new is that, in the financial sector, BaFin is now monitoring compliance. With immediate effect, it is checking [2]:
- whether AI systems in use involve prohibited practices (effective from February 2025),
- whether transparency requirements are being met – in other words, whether people can recognise that they are, for example, communicating with a chatbot or that content has been generated using AI (effective from August 2026) [1], [2],
- whether companies are taking measures to promote AI literacy amongst their staff (effective from February 2025) [4].
From 2 December 2027, requirements for high-risk AI in banking will also apply. Within BaFin’s remit, this concerns AI systems used for creditworthiness checks and credit rating assessments of natural persons, as well as for risk assessment and pricing in life and health insurance [2]. Originally, these obligations were due to come into force as early as August 2026, but the Digital Omnibus Regulation on AI has postponed the deadline by 16 months [5]. This buys the institutions time, but offers no relief, as the requirements themselves remain essentially unchanged.
High-risk AI in banking:What the EU AI Act really means for credit institutions
How BaFin approaches AI market monitoring
BaFin explicitly defines its remit as monitoring, not supervision. Rather than scrutinising every single system, it adopts a risk-based approach and conducts random checks on applications that many financial firms use in particularly relevant areas [3]. Whether an application is scrutinised therefore depends not only on its own risk profile, but also on how widespread the solution is in the market. Commonly used standard software and models from external providers – for example, in credit scoring or in chatbots for customer communication – are therefore more likely to come under scrutiny than an in-house development used in a sub-process.
However, the authority does not determine on its own when to take a closer look. Any natural or legal person may lodge a complaint with the competent market surveillance authority if they suspect a breach of the AI Regulation [4]. An investigation may therefore also be initiated by customers. Furthermore, BaFin’s findings in this regard are not confined to market surveillance, as the authority coordinates these closely with its corporate supervision activities and utilises insights from discussions with institutions for both areas [1], [3]. Any anomalies in the use of AI can thus also be raised in the ongoing supervisory dialogue.
Where prohibited practices affect banks
Article 5 of the AI Regulation [2], [4] sets out which AI practices are prohibited. From a technical perspective, the prohibition most relevant to financial institutions is that against assessing individuals on the basis of their social behaviour or personality traits if this results in discrimination in contexts unrelated to the original data collection [4]. This becomes difficult when alternative data sources are used in scoring. Anyone who incorporates characteristics from non-credit-related sources into creditworthiness models must be able to provide a robust justification for their relevance to the credit decision.
Furthermore, AI systems must not incorporate manipulative or deceptive techniques, nor must they exploit the vulnerability of individuals [2]. In AI-supported sales and advisory processes, this also applies to the design of customer interactions, not just the model itself.
Three levers for implementing the AI Regulation in the financial sector
Lever 1: The AI inventory
As a starting point, BaFin itself recommends an overview of the AI systems in use, modelled on the inventory of information and ICT assets already provided for by DORA [2]. Our article AI Governance: A Must-Have illustrates how such an inventory can be embedded within governance.
Due to the division of responsibilities, the inventory should specify not only the purpose, risk class and role, but also which market supervisory authority is responsible, and provide a clear justification for this. Borderline cases are foreseeable, such as chatbots that serve both staff and customers, AI tools used in internal audit, or generative assistants whose outputs are incorporated into advisory documentation. This allocation should be clarified before the first enquiry from the authorities. BaFin provides a centralised list of contact details for BaFin and the Federal Network Agency on its page on AI market supervision [2].
Lever 2: Integrating governance rather than building it from scratch
The AI Regulation explicitly focuses on regulated financial institutions. Providers of high-risk systems who comply with the governance requirements of financial services law thereby essentially also fulfil the obligation to maintain a quality management system. The same applies to operators with regard to the monitoring obligation [4]. A parallel AI compliance structure would therefore duplicate work and fail to take account of the records that institutions maintain anyway.
BaFin expects companies to embed the requirements within their existing governance, risk and compliance structures, using DORA as a basis [2], [3]. It already set out this approach in December 2025 in its guidance on ICT risks associated with the use of AI [7], the implications of which for governance and processes we analysed in our article on the BaFin AI guidance.
BaFin regards a deeper understanding of how data and models interact in decision-making as a further prerequisite, as this is the only way to identify prohibited practices. These processes must be formalised by the time the high-risk requirements come into force at the latest, for example through appropriate data governance [3]. Anyone who cannot explain today how a particular characteristic influences a credit decision will find it almost impossible to demonstrate the absence of discrimination.
Lever 3: AI competence across the board
The Digital Omnibus has softened the requirement for AI competence. Organisations must support the development of competence, but are not required to guarantee a specific level for each individual [4], [5]. This does not alter the group of people affected, and it is precisely in this that BaFin sees the real novelty. The requirement covers not only model development and validation, but in principle all persons who operate or use AI systems. The specific context of use and the groups of people for whom AI is used are also decisive factors [2]. BaFin therefore recommends supplementing training programmes with AI-specific content and legal principles tailored to the target audience [2]. Those who have so far tailored training courses solely to job roles will find that an additional e-learning module is hardly sufficient and will need to align their training more closely with the context of use.
Responsibility remains with senior management
BaFin favours dialogue, for example through ‘real-world laboratories’ where companies can test new applications with early regulatory guidance. It describes fines of up to 35 million euros or seven per cent of annual turnover as extreme cases. According to BaFin, those who approach the authority at an early stage and cooperate should only face penalties in exceptional circumstances [3].
Responsibility for the use of AI lies with the supervised companies and their management, and it must remain possible for decisions to be corrected and reversed by humans [1].
Any organisation that now adds the regulatory classification to its AI inventory and embeds the AI Regulation into its existing DORA governance framework will create a robust basis for AI market supervision by BaFin.
Lisa WeinertSenior Manager | Management & Business Consulting | msg for banking
Quellen
- 1. BaFin, Überwachung von KI: BaFin erhält neue Kompetenzen (Pressemitteilung), 2026
- 2. BaFin, KI-Marktüberwachung, 2026
- 3. BaFin, „Es bleibt viel Raum für Innovation“ (Interview mit Jens Obermöller), 2026
- 4. Europäische Union, Verordnung (EU) 2024/1689 (KI-Verordnung / EU AI Act), insbesondere Art. 4, 5, 17 Abs. 4, 26 Abs. 5, 50, 70 und 85, 2024
- 5. Europäische Union, Verordnung (EU) 2026/1744 (Digital-Omnibus-Verordnung zur KI), in Kraft seit 27. Juli 2026, 2026
- 6. Bundesrepublik Deutschland, Gesetz zur Durchführung der Verordnung (EU) 2024/1689 (mit KI-MIG), 2026
- 7. BaFin, Orientierungshilfe zu IKT-Risiken beim Einsatz von KI in Finanzunternehmen, 2025
