# How does the BaFin regulate AI in banking?

Source: https://www.bankingnewsai.com/ai-regulation/bafin
Last updated: Oct 5, 2026

BaFin has no AI-specific rulebook for banks: it supervises AI under existing, technology-neutral requirements and has published three non-binding papers — the June 2021 principles for algorithms in decision-making (BDAI), the February 2022 results of its machine-learning-in-risk-models consultation with the Bundesbank, and, on 18 December 2025, guidance on ICT risks in the use of AI under DORA. It does not approve algorithms as such; the exception is internal models used to calculate regulatory capital. BaFin's own pages state that it is also the market surveillance authority for AI systems used in direct connection with regulated financial activity under the EU AI Act, monitoring prohibited practices (Article 5), transparency (Article 50) and AI literacy (Article 4) now and high-risk requirements from 2 December 2027.

## At a glance

| Field | Value |
| --- | --- |
| Full name | Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), Germany's Federal Financial Supervisory Authority, working with the Deutsche Bundesbank |
| Jurisdiction | Germany (banks, insurers and other financial entities supervised by BaFin or, for significant banks, the ECB) |
| Role | Technology-neutral prudential and conduct supervisor that issues non-binding AI guidance and, under the EU AI Act, acts as Germany's market surveillance authority for AI systems used in regulated financial activity |
| How binding | Supervisory guidance |
| Applies to | Banks, insurers, asset managers and other financial entities supervised by BaFin; for AI Act purposes, financial companies supervised by BaFin or the ECB and certain other entities listed in Section 2(3) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG) |
| Key document | Guidance on ICT Risks in the Use of AI at Financial Entities (18 December 2025; English translation published 30 January 2026), alongside the 2021 BDAI principles paper and the 2022 ML risk-models results paper |
| Latest move | 29 July 2026: BaFin published its page on market surveillance of AI systems, stating that it monitors Article 5 prohibited practices, Article 50 transparency obligations and Article 4 AI literacy now, and high-risk AI systems from 2 December 2027 (including creditworthiness assessment of natural persons) |

## Overview

BaFin's approach rests on the principle it states in its BDAI paper: same business, same risk, same rules — a risk-oriented, proportional and technology-neutral supervision of algorithmic decision-making. Its 2021 principles paper calls itself 'preliminary ideas for minimum supervisory requirements' that already serve as guidance, covering management responsibility, risk and outsourcing management, bias, data governance, documentation, validation, human involvement and contingency measures. The 2022 results paper, issued jointly with the Bundesbank, applies the same logic to machine learning in Pillar 1 internal models and Pillar 2 risk management: no definition of ML, but supervisory intensity tied to the characteristics of the method, with model approval retained for internal models.

The December 2025 guidance moves from model governance to operational resilience. It is non-mandatory advice on how DORA's ICT risk management and ICT third-party risk requirements (Articles 5 to 15 DORA, with the RTS on ICT risk management and on subcontracting) apply along the AI lifecycle, and it says it does not define supervisory expectations or bind BaFin's interpretation of DORA. Separately, BaFin's July 2026 page describes its AI Act role: it monitors AI systems used in direct connection with regulated financial activity, while AI used for purposes such as human resources falls to the Federal Network Agency (BNetzA), according to a BaFin official interviewed on the page's publication date.

## Documents (3)

- Dec 18, 2025 — [BaFin guidance on ICT risks in the use of AI](https://www.bankingnewsai.com/ai-regulation/documents/bafin-ai-ict-risk-guidance-2025): Guidance on ICT Risks in the Use of AI at Financial Entities (Final)
- Feb 18, 2022 — [BaFin/Bundesbank ML in risk models results](https://www.bankingnewsai.com/ai-regulation/documents/bafin-bundesbank-ml-risk-models-2022): Machine learning in risk models – Characteristics and supervisory priorities: Responses to the consultation paper (Final)
- Jun 15, 2021 — [BaFin BDAI principles paper](https://www.bankingnewsai.com/ai-regulation/documents/bafin-ai-principles-2021): Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes (Final)

## Timeline

- Dec 2, 2027 — [BaFin begins monitoring high-risk AI system requirements](https://www.bafin.de/EN/unternehmen-maerkte/aufsicht/alle-unternehmen/ki-marktueberwachung/ki-marktueberwachung_en.html) — BaFin states that from 2 December 2027 it will also monitor compliance with the requirements for high-risk AI systems, which under Annex III(5)(b) and (c) of the AI Act include systems evaluating the creditworthiness or credit score of natural persons (except fraud detection) and risk assessment and pricing for life and health insurance.
- Jul 29, 2026 — [BaFin sets out its role as AI Act market surveillance authority for financial services](https://www.bafin.de/EN/unternehmen-maerkte/aufsicht/alle-unternehmen/ki-marktueberwachung/ki-marktueberwachung_en.html) — BaFin's page on market surveillance of AI systems states that BaFin is the market surveillance authority for AI systems in the financial sector, that Section 2(3) KI-MIG defines its remit, and that it monitors compliance with Article 5 (prohibited practices), Article 50 (transparency) and Article 4 (AI literacy) of the EU AI Act. A BaFin official interviewed the same day said the monitoring is pragmatic and risk-based, with sampling of widely used AI applications rather than review of every system.
- Dec 18, 2025 — [BaFin guidance on ICT risks in the use of AI](https://www.bankingnewsai.com/ai-regulation/documents/bafin-ai-ict-risk-guidance-2025): BaFin guidance on ICT risks in the use of AI — Guidance on ICT Risks in the Use of AI at Financial Entities — BaFin's 'Guidance on ICT Risks in the Use of AI at Financial Entities' (German original dated 18 December 2025; English version dated 23 January 2026 and published on 30 January 2026) explains how DORA's ICT risk management and ICT third-party risk requirements apply to AI systems.
- Feb 18, 2022 — [BaFin/Bundesbank ML in risk models results](https://www.bankingnewsai.com/ai-regulation/documents/bafin-bundesbank-ml-risk-models-2022): BaFin/Bundesbank ML in risk models results — Machine learning in risk models – Characteristics and supervisory priorities: Responses to the consultation paper — On 18 February 2022 BaFin and the Deutsche Bundesbank published the responses to their joint consultation paper 'Machine learning in risk models – Characteristics and supervisory priorities', which the Bundesbank dates 15 July 2021 as Consultation 11/2021.
- Jun 15, 2021 — [BaFin BDAI principles paper](https://www.bankingnewsai.com/ai-regulation/documents/bafin-ai-principles-2021): BaFin BDAI principles paper — Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes — BaFin's paper 'Big data and artificial intelligence: Principles for the use of algorithms in decision-making processes', published on 15 June 2021, sets out BaFin's supervisory principles for algorithmic decision-making at financial entities.

## What to watch next

- From 2 December 2027: BaFin's monitoring of high-risk AI systems, including AI used to assess the creditworthiness of natural persons
- Whether BaFin updates the ICT-risk guidance, which it describes as a living document to be adapted to technological progress and new regulatory developments
- How BaFin's DORA-based AI guidance interacts with the ESAs' July 2026 statement on ICT risks from frontier AI models (JC 2026 25)
- The regulatory sandboxes and real-world testing environments that BaFin's AI Act interview describes as planned, in which firms can obtain supervisory guidance early

## FAQ

### Does BaFin have specific AI rules for banks?

No binding AI-specific rules. BaFin applies existing technology-neutral requirements and has published non-binding papers: the June 2021 BDAI principles, the February 2022 results of the machine-learning-in-risk-models consultation (with the Bundesbank) and the December 2025 guidance on ICT risks in the use of AI under DORA. Separately, the EU AI Act applies directly, and BaFin is the market surveillance authority for AI systems used in regulated financial activity.

### Does BaFin approve AI models?

Not as such. BaFin's 2021 paper says it does not generally approve algorithm-based decision-making processes and examines them in a risk-oriented way. The exception is internal models used to calculate regulatory own funds requirements, where supervisors examine and approve the methodology, calibration and validation, including where machine learning is used.

### What will BaFin monitor under the EU AI Act?

According to BaFin's July 2026 page, it monitors AI systems used in direct connection with regulated financial activity for prohibited practices under Article 5, transparency obligations under Article 50 and AI literacy measures under Article 4, and from 2 December 2027 the requirements for high-risk AI systems. HR-related AI falls to the Federal Network Agency instead.

Related authorities: [ECB](https://www.bankingnewsai.com/ai-regulation/ecb), [EBA](https://www.bankingnewsai.com/ai-regulation/eba), [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act), [DNB / AFM](https://www.bankingnewsai.com/ai-regulation/dnb), [ACPR](https://www.bankingnewsai.com/ai-regulation/acpr), [FINMA](https://www.bankingnewsai.com/ai-regulation/finma).

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/bafin
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.