What does DNB SAFEST AI principles say about AI in banking?

What are the key points of DNB SAFEST AI principles?

• Published 25 July 2019 as a discussion paper; comments were invited by 18 October 2019, and DNB said it would report on the outcome during 2020.
• Six aspects under the SAFEST acronym, partly inspired by the Monetary Authority of Singapore's FEAT principles: soundness (4.1), accountability (4.2), fairness (4.3), ethics (4.4), skills (4.5), transparency (4.6).
• Soundness (principles 1 to 5): general compliance, including 'compliance-by-design' and fall-back plans; mitigation of financial and prudential risks with domain experts and documented metrics; special attention to model risk for material applications, with human-in-the-loop or human-on-the-loop review; data quality and archiving of training data; control over procured and outsourced AI.
• Accountability (6 to 8): final accountability for AI applications assigned at board level, integration into the risk management framework, and operationalised accountability to external stakeholders; model complexity or third-party reliance should never limit accountability.
• Fairness (9 and 10): define and operationalise fairness (group or individual fairness) and review outcomes for unintentional bias.
• Ethics (11 and 12): an ethical code, criteria for suitable use of AI and alignment of outcomes with legal obligations, values and customer interests.
• Skills (13 to 15) and transparency (16 and 17): board and management understanding, training of risk and compliance staff, awareness across the organisation; transparency about AI policy and decisions, plus traceability and explainability of AI-driven outcomes and 'after the fact' reviews.
• Proportionality (chapter 4, Figure 5): applicability depends on the materiality of the AI application for business continuity and customers and on its purpose in decision-making (descriptive, diagnostic, predictive, prescriptive or automation).

What did DNB SAFEST AI principles change for banks?

DNB's paper was one of the earliest supervisory statements on AI in finance, and its SAFEST framework became a reference for later Dutch work: the AFM and DNB 2024 report cites it as a prior publication. It added no new legal duties but told Dutch firms how DNB read existing requirements for sound and controlled business operations in an AI context.

What do DNB's SAFEST principles require of banks using AI?

DNB's SAFEST principles, published in a discussion paper on 25 July 2019, set out 17 principles under six headings for financial firms using AI. Under soundness, firms should ensure compliance by design, mitigate prudential risks, pay special attention to model risk for material applications, safeguard data quality and stay in control of procured or outsourced AI. Under accountability, final responsibility sits with the board of directors and is integrated in risk management. Fairness requires firms to define fairness and review outcomes for unintentional bias; ethics requires an ethical code; skills requires board, risk, compliance and staff competence; and transparency requires explainability and traceability of AI-driven outcomes. The principles are non-binding and apply in proportion to the materiality and purpose of each AI application.

DNB frames the principles within controlled and sound business operations under articles 3:10, 3:17 and 3:18 of the Financial Supervision Act, and its heat map (Figure 5) lets firms scale the principles to the materiality of an AI application and its purpose in decision-making. The paper also says it expects more AI-specific regulatory responses at EU level, citing the European Commission and the EBA.

After 2019 the Dutch position developed through the AFM and DNB's joint 2024 report, which cites the SAFEST paper and applies the same technology-agnostic approach, and through AFM's 2026 supervisory agenda on AI.

WHAT THIS MEANS IN PRACTICE

• Assign a named board member as ultimately accountable for each material AI application.
• Define in writing what fairness means for each customer-facing model and measure it, for example with false-positive and false-negative rates.
• Apply the same AI policy to vendor models as to in-house ones.
• Train risk and compliance staff to challenge AI outputs, not just operate them.
• Record reasons when accuracy is preferred over explainability and have that choice approved at the right level.