# How does the Basel Committee regulate AI in banking?

Source: https://www.bankingnewsai.com/ai-regulation/basel-committee
Last updated: Oct 5, 2026

The Basel Committee has not issued AI-specific standards for banks — it monitors AI under its digitalisation-of-finance workstream and addresses the risks through existing prudential channels. Its May 2024 digitalisation report analyzed AI/ML among the technologies reshaping banking, and its 2025–26 work programme keeps AI under watch, including a June 2026 report on ICT risk-management practices and ongoing attention to AI's implications for bank cybersecurity.

## At a glance

| Field | Value |
| --- | --- |
| Full name | Basel Committee on Banking Supervision (BCBS) |
| Jurisdiction | Global (28 jurisdictions) |
| Role | Global banking standard-setter |
| How binding | Non-binding standards |
| Applies to | Internationally active banks, via national implementation of Basel standards |
| Key document | Digitalisation of finance report (May 2024) |
| Latest move | Oct 1, 2026: following its 28–29 September meeting, the Committee agreed to review the operational risk framework's 'event type' loss categories with a focus on cyber risk and AI developments, its first step toward amending an existing hard standard because of AI; June 2026 ICT risk-management report |

## Overview

The Committee's posture is deliberate patience: rather than write AI rules that member jurisdictions would implement unevenly, it tracks how AI changes the risk profile of banks — operational resilience, third-party dependence, cyber threat, and strategic risk — and lets existing Basel standards (operational risk, outsourcing principles) carry the load.

Two documents anchor the current position: the May 2024 'Digitalisation of finance' report, which assessed AI/ML alongside APIs, DLT, and cloud, warning about new vulnerabilities and system-wide interconnection; and the June 2026 range-of-practices report on ICT risk management, produced under a work programme that explicitly monitors AI developments and their cybersecurity implications. If the FSB's 2026 sound-practices work hardens into expectations, the Basel Committee is the likely channel for turning them into supervisory standards.

## Documents (8)

- Jun 2, 2026 — [BCBS ICT Risk Management Report (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-ict-risk-management-range-of-practices-2026): Information and communication technology risk management: range of practices (Final)
- Jan 6, 2026 — [BCBS 239 Implementation Newsletter (Jan 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-newsletter-bcbs239-implementation-2026): Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) (Final)
- Dec 10, 2025 — [BCBS Third-Party Risk Principles (Dec 2025)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025): Principles for the sound management of third-party risk (In force)
- Feb 4, 2025 — [BCBS Work Programme 2025–26](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-work-programme-2025-26): Basel Committee work programme and strategic priorities for 2025/26 (In force)
- May 16, 2024 — [BCBS Digitalisation of finance report (May 2024)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-digitalisation-of-finance-2024): Digitalisation of finance (Final)
- Mar 16, 2022 — [BCBS AI/ML Newsletter (March 2022)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-newsletter-ai-ml-2022): Newsletter on artificial intelligence and machine learning (Final)
- Mar 31, 2021 — [BCBS Principles for Operational Resilience (2021)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-principles-operational-resilience-2021): Principles for Operational Resilience (In force)
- Jan 9, 2013 — [BCBS 239](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-239): Principles for effective risk data aggregation and risk reporting (In force)

## Timeline

- Oct 1, 2026 — [Committee agrees to review operational-risk loss categories for AI and cyber risk](https://www.bis.org/media-releases/20261001-basel-committee-meets-advance-supervisory-and-regulatory-initiatives-and-discuss-risks-and) — Meeting in Indonesia on 28–29 September 2026, the Committee said AI developments 'have continued to evolve at a remarkable speed' since its May meeting and that frontier AI's integration into critical financial functions 'will require careful governance, robust risk management and ongoing supervisory attention.' It agreed to review the sufficiency and adequacy of the operational risk framework's existing 'event type' loss categories, with a focus on cyber risk and AI developments — the Committee's first concrete step toward amending an existing hard standard because of AI, short of a new standard itself.
- Jun 2, 2026 — [BCBS ICT Risk Management Report (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-ict-risk-management-range-of-practices-2026): BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices — The Basel Committee published its 23-page range-of-practices report on ICT risk management on 2 June 2026, produced under the 2025–26 work programme and focused on non-malicious ICT incidents affecting critical bank operations, complementing its 2018 cyber-resilience report.
- May 20, 2026 — [Committee flags frontier AI models as a cyber-risk accelerant](https://www.bis.org/media-releases/20260520-basel-committee-agrees-publish-report-information-and-communication-technology-risk-0) — At its 19–20 May 2026 meeting the Basel Committee noted that frontier AI models could help banks and supervisors find cyber vulnerabilities, but that their malicious use 'may materially change the speed and scale of cyber incidents'; it committed to keep monitoring AI developments and exchanging supervisory insights.
- Jan 6, 2026 — [BCBS 239 Implementation Newsletter (Jan 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-newsletter-bcbs239-implementation-2026): BCBS 239 Implementation Newsletter (Jan 2026) — Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) — On 6 January 2026 the Basel Committee issued a newsletter on the state of BCBS 239 implementation, more than a decade after the 2013 principles.
- Dec 10, 2025 — [BCBS Third-Party Risk Principles (Dec 2025)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025): BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk — On 10 December 2025 the Basel Committee published 12 Principles for the Sound Management of Third-Party Risk, finalising a July 2024 consultation and replacing the 2005 Joint Forum outsourcing paper for banks.
- Feb 4, 2025 — [BCBS Work Programme 2025–26](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-work-programme-2025-26): BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 — The Basel Committee's 2025–26 work programme, endorsed by the Group of Governors and Heads of Supervision and published in February 2025, sets four themes: Basel III implementation, risk assessment and safeguarding resilience, digitalisation of finance, and liquidity.
- May 16, 2024 — [BCBS Digitalisation of finance report (May 2024)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-digitalisation-of-finance-2024): BCBS Digitalisation of finance report (May 2024) — Digitalisation of finance — The Basel Committee's 46-page 'Digitalisation of finance' report of 16 May 2024 assesses APIs, AI/ML, distributed ledger technology, and cloud computing, updating its 2018 fintech work, and sets out eight implications for banks and supervisors.
- Mar 16, 2022 — [BCBS AI/ML Newsletter (March 2022)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-newsletter-ai-ml-2022): BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning — On 16 March 2022 the Basel Committee published a newsletter summarising its internal discussions on banks' use of artificial intelligence and machine learning.
- Mar 31, 2021 — [BCBS Principles for Operational Resilience (2021)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-principles-operational-resilience-2021): BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience — On 31 March 2021 the Basel Committee published seven Principles for Operational Resilience, aimed at banks' ability to withstand events such as pandemics, cyber incidents, technology failures, and natural disasters.
- Jan 9, 2013 — [BCBS 239](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-239): BCBS 239 — Principles for effective risk data aggregation and risk reporting — BCBS 239, published by the Basel Committee on 9 January 2013, sets 14 principles for how banks govern, aggregate, and report risk data, covering governance and IT infrastructure, data accuracy, completeness, timeliness and adaptability, and supervisory review.

## What to watch next

- Whether the Committee's review of operational-risk 'event type' loss categories for AI and cyber risk, agreed October 1, 2026, produces a proposed revision to the operational risk framework
- Whether FSB sound practices on AI (final report expected October 2026, not yet published) get translated into Basel supervisory expectations
- Treatment of AI third-party concentration under Basel outsourcing and operational-resilience principles
- Any further move from monitoring to standard-setting as agentic AI enters core banking processes

## FAQ

### Has the Basel Committee issued AI regulations?

No. The Committee monitors AI under its digitalisation workstream and addresses risks through existing standards on operational risk and resilience. Its most relevant publications are the 2022 AI/ML newsletter, the May 2024 digitalisation-of-finance report, and the June 2026 ICT risk-management report.

### How does Basel Committee work reach actual banks?

Through national implementation: the Committee's 28 member jurisdictions translate Basel standards and guidance into local regulation. Its AI observations shape how the ECB, PRA, OCC, and other supervisors examine banks even without a dedicated AI standard.

### Which Basel Committee standards actually bind a bank's AI program today?

None is AI-specific, but three apply directly through national implementation: BCBS 239 (2013) governs the risk data that feeds AI models, the March 2021 Principles for Operational Resilience cover AI-driven ICT and dependency risk, and the December 2025 Principles for the Sound Management of Third-Party Risk cover vendor AI models, cloud hosting, and nth-party concentration.

Related authorities: [FSB](https://www.bankingnewsai.com/ai-regulation/fsb), [ECB](https://www.bankingnewsai.com/ai-regulation/ecb), [OCC](https://www.bankingnewsai.com/ai-regulation/occ).

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/basel-committee
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.