On 31 March 2021 the Basel Committee published seven Principles for Operational Resilience, aimed at banks' ability to withstand events such as pandemics, cyber incidents, technology failures, and natural disasters. The principles cover governance, operational risk management, business continuity, mapping of critical operations, third-party dependency management, incident response and recovery, and resilient ICT including cyber security. They are the Basel-level channel through which AI-driven operational and third-party risks are supervised today.
| Document | BCBS Principles for Operational Resilience (2021) — Principles for Operational Resilience |
| Issued by | Basel Committee on Banking Supervision (BCBS) |
| Type | Guidance |
| Status | In force |
| Published | Mar 31, 2021 |
| Effective | Mar 31, 2021 |
| Applies to | Internationally active banks, via national implementation; issued alongside the revised Principles for the Sound Management of Operational Risk (d515) |
| Official source | bis.org ↗ |
| Use cases | AI governance (general) · Third-party & vendor AI · Cybersecurity |
What are the key points of BCBS Principles for Operational Resilience (2021)?
- Seven principles: governance (1), operational risk management (2), business continuity planning and testing (3), mapping interconnections and interdependencies of critical operations (4), third-party dependency management (5), incident management (6), and resilient ICT including cyber security (7).
- Published the same day as the revised Principles for the Sound Management of Operational Risk (PSMOR, d515), which the resilience principles build on.
- Requires banks to identify critical operations and map the internal and external dependencies, including technology and vendors, that support them.
- Principle 7 expects ICT to be 'subject to protection, detection, response and recovery programmes' that are regularly tested.
- Consolidates earlier Basel guidance on corporate governance, outsourcing, business continuity, and risk management into a single principles-based approach.
- 12-page document; non-binding, implemented through national supervisory frameworks such as the UK operational-resilience regime and US interagency guidance.
What did BCBS Principles for Operational Resilience (2021) change for banks?
Before 2021 the Committee's guidance on outsourcing and continuity was scattered across documents dating to 2005–06. The resilience principles gave supervisors one framework to ask how a bank would keep critical operations running through a technology failure, which is now the lens applied to AI: an AI-dependent fraud engine, chatbot, or underwriting pipeline is a critical-operation dependency to be mapped, tested, and made recoverable. The Committee's 2026 ICT risk-management report and its December 2025 third-party principles both sit under this framework.
Do the Basel operational resilience principles mention AI?
Not by name. They address technology failures, cyber incidents, ICT, and third-party dependencies generically, and supervisors apply them to AI systems that support critical operations.
How do these principles relate to the 2025 third-party risk principles?
Principle 5 of the 2021 resilience principles requires banks to manage dependencies on third parties; the December 2025 Principles for the Sound Management of Third-Party Risk expand that into 12 detailed principles for banks and supervisors.
| Date | Document | Status |
|---|---|---|
| Jun 2, 2026 | BCBS ICT Risk Management Report (June 2026) — Information and communication technology risk management: range of practices | Final |
| Jan 6, 2026 | BCBS 239 Implementation Newsletter (Jan 2026) — Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) | Final |
| Dec 10, 2025 | BCBS Third-Party Risk Principles (Dec 2025) — Principles for the sound management of third-party risk | In force |
| Feb 4, 2025 | BCBS Work Programme 2025–26 — Basel Committee work programme and strategic priorities for 2025/26 | In force |
| May 16, 2024 | BCBS Digitalisation of finance report (May 2024) — Digitalisation of finance | Final |
| Mar 16, 2022 | BCBS AI/ML Newsletter (March 2022) — Newsletter on artificial intelligence and machine learning | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →