What does BaFin BDAI principles paper say about AI in banking?

What are the key points of BaFin BDAI principles paper?

• Published 15 June 2021; 16 pages in five chapters: conceptual framework; key principles; specific principles for the development phase; specific principles for the application phase; inclusion of the principles in international regulatory projects.
• Working definition: AI is the combination of big data, computing resources and machine learning. BaFin says no clear line can be drawn between AI and traditional statistical processes, and the principles apply particularly to algorithms with considerable complexity, short recalibration cycles and a high level of automation.
• Chapter I: BaFin does not grant a general approval for algorithm-based decision-making processes; it examines them in a risk-oriented way, with the exception of internal models used to determine regulatory capital, where methodology, calibration and validation are examined. Supervision follows 'same business, same risk, same rules' — risk-oriented, proportional and technology-neutral.
• Chapter II key principles: clear management responsibility (senior management must have sufficient technical expertise and responsibility for decisions based on algorithms); appropriate risk and outsourcing management; preventing bias; ruling out types of differentiation prohibited by law, including through proxies.
• Chapter III development phase: data strategy and data governance; data protection compliance; accurate, robust and reproducible results; documentation of model selection, calibration and training, and validation; appropriate validation processes performed or examined by an independent function; relevant and representative data for calibration and validation.
• Chapter IV application phase: putting the human in the loop (involvement must bring real benefits, not mere approval of every decision); in-depth approval and feedback processes, for example a threshold-based process with a final 'stopping rule'; contingency measures for mission-critical applications; ongoing validation, overall evaluation and appropriate adjustments.
• Worked use cases in the paper: telematics-based insurance rates, NLP analysis of annual reports for credit ratings with random-forest models, sanctions screening for money laundering detection, and algorithm-assisted fund management.
• Chapter V: BaFin positions the principles as input to the European Commission's Digital Finance Strategy, the European Supervisory Authorities and global standard-setters (FSB, BCBS, IAIS, IOSCO).

What did BaFin BDAI principles paper change for banks?

The paper was the first consolidated statement by a German supervisor of what it expects from algorithmic and AI-based decision-making, and it was published before the EU AI Act was adopted. It does not add new legal requirements; it specifies how existing regulation and administrative practice apply to complex, fast-recalibrating algorithms, and it remains the reference text for BaFin's technology-neutral position that is later built on in the 2022 machine-learning results paper and the December 2025 DORA guidance.

What do BaFin's principles for algorithms in decision-making processes require of banks?

BaFin's 15 June 2021 paper expects banks that use algorithms in decision-making to ensure clear management responsibility with sufficient technical expertise at senior management level, to build risk and outsourcing management suited to algorithmic processes, and to prevent bias and legally prohibited differentiation, including through proxies. For the development phase it expects a verifiable data strategy and data governance, data protection compliance, accurate, robust and reproducible results, documentation of model selection, calibration and validation, independent validation before use and relevant, representative calibration data. For the application phase it expects real human involvement, threshold-based in-depth approval and feedback processes, contingency measures for mission-critical applications and ongoing validation with an overall evaluation. The paper is non-binding and describes itself as preliminary ideas for minimum supervisory requirements, but it states that supervised entities can already use it as guidance.

The paper sits between model risk management and data governance. It asks banks to look at the whole algorithm-based decision-making process from data source to business process rather than at the algorithm alone, which is also how BaFin says it supervises: it grants no general approval for algorithms, examines processes in a risk-oriented way, and approves methodology only where it must, such as internal models for regulatory capital.

Its principles recur in later work. The February 2022 results paper on machine learning in risk models, issued by BaFin and the Bundesbank, positions itself alongside the BDAI principles, and the December 2025 guidance on ICT risks in the use of AI adds the DORA operational-resilience layer. Internationally, BaFin offered the paper as input to the European Commission, the ESAs and global standard-setters.

The paper is guidance, not law. It says it does not rule out stricter rules or administrative practices for particular regulated activities, in which case those take precedence, and it is not an exemption from existing legal and supervisory provisions.

WHAT THIS MEANS IN PRACTICE

• Map algorithm-based decision processes end to end — data source, model, human review, business process — and assign management-level ownership with technical expertise.
• Document model selection, calibration and validation, including the reasons for choosing a complex model over a simpler one.
• Have an independent function validate models before use and define both periodic and event-driven re-validation triggers.
• Design human review that adds real value (threshold-based escalation and stopping rules) rather than rubber-stamping every output.
• Test for bias and for proxy variables standing in for characteristics that may not be used, and keep contingency procedures for mission-critical algorithmic processes.