What does ACPR discussion document on AI governance say about AI in banking?

What are the key points of ACPR discussion document on AI governance?

• Authors: Laurent Dupont, Olivier Fliche and Su Yang of the ACPR Fintech-Innovation Hub; follows a December 2018 public consultation and exploratory works launched in March 2019 with voluntary financial institutions.
• Three exploratory topics: AML-CFT (ML alert generation alongside rule-based systems), internal models (specifically credit scoring) and customer protection.
• Evaluation (Chapters 3 and 4): four criteria — appropriate data management (including regulatory compliance and ethics/fairness), performance, stability (robustness, model drift, generalisation, re-training) and explainability.
• Explainability (Section 3.4): four levels of explanation — observation, justification, approximation and replication — scaled to the audience (customers, internal users, validators) and the business risk.
• Governance (Chapter 5): integration in business processes, human/algorithm interactions, security and outsourcing, initial validation, continuous validation and audit.
• Audit: a dual approach combining analytical (source code and data analysis, documentation standards) and empirical methods (explanations plus black-box testing with challenger models and benchmarking datasets); supervisors will need data-science expertise and a dedicated AI supervision toolkit.
• Human intervention is described as beneficial or even necessary but carrying new risks, such as bias in explanations and a stronger feeling of responsibility when contradicting the algorithm than when confirming it.
• Chapter 6: public consultation questionnaire covering ML experience, the explainability principle and governance; the ACPR invited comments from financial actors, researchers, providers and authorities.

What did ACPR discussion document on AI governance change for banks?

The paper gave French financial institutions an operational vocabulary for explainability and audit of ML and made the ACPR's expectation clear that AI governance should start at design. It is the foundation for the ACPR's later work on AI evaluation methodology, the 2026 algorithmic fairness consultation and its preparation for the EU AI Act.

What does the ACPR recommend for the governance and evaluation of AI in finance?

The ACPR's June 2020 discussion document recommends evaluating AI algorithms against four interdependent criteria — appropriate data management, performance, stability and explainability — and governing them from the design phase. Governance should address integration into business processes (including whether the AI component is critical and whether the engineering process is reproducible and auditable), human/algorithm interactions, security and outsourcing, initial and continuous validation, and audit. The ACPR proposes four levels of explanation (observation, justification, approximation, replication) matched to audience and business risk, and an audit approach combining analysis of code and data with empirical tests such as challenger models and benchmarking datasets. The document is a discussion paper submitted to public consultation, not binding guidance.

The paper is a product of the ACPR's Fintech-Innovation Hub and a two-year exploration: a December 2018 consultation, exploratory works from March 2019 and a June 2020 discussion document. It uses ML as its working definition of AI and addresses both institutions and supervisory practice.

The ACPR's later AI work builds on it. In 2025 it ran working meetings with industry on AI Act readiness, and on 1 July 2026 it launched a public consultation on algorithmic fairness, part of an evaluation methodology intended to become a reference framework for institutions and the supervisor.

WHAT THIS MEANS IN PRACTICE

• Define for each model who needs an explanation (customer, operator, validator) and which of the four levels satisfies that need.
• Build ML lifecycle documentation that supports reproducibility and audit, including training data provenance.
• Plan continuous validation tooling for drift, data quality and explanation validity, not just initial validation.
• Use challenger models and benchmark datasets as independent checks during audit.
• Review outsourcing of model development and hosting for AI-specific third-party and attack risks.