What does AFM and DNB report on the impact of AI say about AI in banking?

What are the key points of AFM and DNB report on the impact of AI?

• Published 9 April 2024 jointly by the AFM and DNB; the aim is to 'formulate criteria and areas of attention when shaping AI supervision', and the report says it does not provide ready-made answers.
• AI is defined as in the EU AI Act (OECD-based definition); Dutch institutions use AI for fraud prevention and detection, anti-money-laundering, creditworthiness assessment and identity verification, and most are cautious with generative AI.
• Risks: data quality, data protection, explainability, incorrect results, discrimination and exclusion, dependence on third parties, inadequate governance frameworks and energy consumption.
• Key message: supervision objectives and standards are technology-agnostic and apply when AI is used; institutions must set up proper risk management for AI, and standards on duty of care, product development and distribution and excessive borrowing also apply (Chapter 2.2.1).
• Chapter 2.2.2: AI is explicit in sector rules for algorithmic trading (MiFID II/MiFIR, citing Articles 17, 18, 26, 27, 45, 47 and 48 of MiFID II), the revised Consumer Credit Directive (CCD2, which the report says is to apply from 20 November 2026, including a right to human intervention in Article 18) and automated advice rules.
• Internal models: the report notes that CRR internal-model requirements, such as consistency and understandability of obligor classification (CRR Article 171) and 'plausible and intuitive' projections (Article 179), may make some AI models difficult to use, and that the framework may need clarification.
• Chapter 2.3: under the AI Act, AI used to check the creditworthiness of natural persons and for risk assessment and pricing in life and health insurance is high-risk; the AFM and DNB support voluntary compliance with high-risk requirements by other AI applications; the AI Act's supervisory role is assigned in principle to existing financial regulators.
• Next steps and supervision: DNB's 2024 thematic examination of AI use by insurers; the authorities said they would hold symposiums and round-table discussions with the sector later in 2024.

What did AFM and DNB report on the impact of AI change for banks?

The report moved Dutch AI supervision from DNB's 2019 principles to a joint, AI-Act-aware position: no new AI rulebook, but a clear statement that responsible-use expectations and existing financial rules apply in full, a mapping of where AI is already regulated, and a signal that the AFM and DNB will step up supervision of AI risk management.

What do the AFM and DNB expect from banks using AI?

The AFM and DNB's 9 April 2024 report expects financial institutions to use AI responsibly: AI must not jeopardise the financial soundness and integrity of institutions, harm customers' interests or damage the integrity of relationships between market players. The objectives of supervision and the standards institutions must meet are technology-agnostic, so existing requirements apply to AI, including proper risk management that covers AI risks, sound and ethical operational management, the duty of care, product development and distribution standards and rules against excessive borrowing. The more important AI becomes in decision-making and the greater the potential consequences, the higher the bar for responsible, explainable use. For credit scoring of natural persons, the AI Act adds high-risk requirements. The report itself sets no new rules.

The report builds on DNB's July 2019 SAFEST paper and a 2019 joint AFM and DNB paper on AI in insurance, and treats the AI Act as the future framework for high-risk applications while arguing that sector-specific clarification should preferably happen in a harmonised way at European level.

Subsequent AFM publications show the supervisory direction: the AFM Agenda 2026 (19 January 2026) says it is expanding AI supervision and asks institutions to map AI applications, strengthen model risk management and data quality, record decision-making logic and report incidents. DNB's 2024 thematic examination covered insurers' use of AI.

WHAT THIS MEANS IN PRACTICE

• Embed AI inside existing risk management rather than creating a separate regime; check input data, models and outputs for discrimination.
• Check customer-facing AI against duty-of-care and product-governance standards.
• For IRB or other internal models using ML, test the approach against CRR requirements such as consistency, plausibility and explainability.
• Inventory AI-based creditworthiness tools for AI Act high-risk compliance and fundamental-rights impact assessment.
• Keep traceable records of AI decision logic and report AI-related incidents.