What does BCBS 239 say about AI in banking?

What are the key points of BCBS 239?

• 14 principles in four groups: overarching governance and infrastructure (Principles 1–2), risk data aggregation capabilities (3–6), risk reporting practices (7–11), and supervisory review, tools and cooperation (12–14).
• Principle 1 makes the board and senior management accountable for risk data aggregation and reporting; Principle 2 requires IT and data architecture that supports the capabilities in normal times and in stress.
• Principles 3–6 require risk data to be accurate and reliable, complete across business lines and legal entities, timely, and adaptable to ad-hoc requests including in crisis.
• Compliance deadline: G-SIBs designated in November 2011 or 2012 by the beginning of 2016; D-SIBs three years after national designation.
• Written after the 2007–09 crisis, when many banks could not aggregate exposures or identify concentrations 'fully, quickly and accurately'.
• A 6 January 2026 Basel Committee newsletter (bcbs_nl36) reports data-driven culture, data lineage, and ad-hoc reporting still 'a work in progress' and notes that AI and advanced automation depend on the same high-quality data.

What did BCBS 239 change for banks?

BCBS 239 predates the current AI wave, but it is the standard examiners reach for when reviewing model inputs: data lineage, ownership, quality controls, and the ability to trace a number from a report back to source. Banks building AI governance programs typically map training-data and feature-pipeline controls onto BCBS 239 principles rather than inventing a new framework, and the ECB, PRA, and US agencies have all leaned on it in data-quality findings that increasingly concern AI/ML use.