The EBA's factsheet 'AI Act: implications for the EU banking and payments sector', published November 21, 2025, reports the results of its 2025 mapping of AI Act high-risk obligations — focused on credit scoring of natural persons, high-risk under Annex III(5)(b) — against the CRD, CRR, DORA, Consumer Credit Directive, Mortgage Credit Directive, PSD and EBA guidelines on loan origination, internal governance and PD/LGD estimation. It found no significant contradictions, judged the AI Act complementary to existing banking law, and identified no immediate need for new or revised EBA guidelines. The EBA will instead promote a common supervisory approach among national competent authorities and market surveillance authorities in 2026–27 and feed the AI Office and the AI Board Subgroup on Financial Services.
| Document | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector |
| Issued by | European Banking Authority |
| Type | Guidance |
| Status | Final |
| Published | Nov 21, 2025 |
| Applies to | EU credit institutions and payment institutions using AI for creditworthiness assessment or credit scoring of natural persons; also relevant to non-bank creditors under the CCD and MCD |
| Official source | eba.europa.eu ↗ |
| Use cases | Credit scoring & underwriting · Model risk management · AI governance (general) · Fair lending & discrimination · Cybersecurity |
What are the key points of EBA factsheet: AI Act implications for the EU banking and payments sector?
- Published November 21, 2025; mapping workstream established January 2025.
- Scope: AI Act requirements on high-risk systems, centred on creditworthiness assessment and credit scoring of natural persons (Annex III(5)(b)).
- Frameworks mapped: CRD, CRR (SA and IRB), DORA, CCD, MCD, PSD, EBA Guidelines on loan origination and monitoring, internal governance, and PD/LGD estimation.
- Findings: no significant contradictions; AI Act is complementary; some integration effort needed; balancing fundamental-rights goals with sectoral objectives; multiple supervisors (prudential/conduct and market surveillance authorities) make cooperation essential.
- Classifies each AI Act obligation as fully aligned, complementary, partially aligned, or not present in financial-services law.
- Notes the Commission was mandated to issue guidelines on high-risk classification by February 2, 2026 and on the interplay with sectoral law under Article 96(1)(e).
- Conclusion: no immediate need for new or revised EBA guidelines; 2026–27 follow-up via supervisory convergence and AI Office input.
- Explicitly not guidance or a legal position; subject to revision as AI Office and AI Board guidance evolves.
What did EBA factsheet: AI Act implications for the EU banking and payments sector change for banks?
The factsheet told EU banks that AI Act compliance for credit scoring is primarily an integration exercise on top of CRD/CRR, DORA and the loan-origination guidelines, not a separate rulebook — and that the EBA would not add guidelines of its own. The practical burden shifts to documenting how existing governance, model-risk, data and ICT controls satisfy each AI Act obligation, and to dealing with two supervisors: the prudential/conduct authority and the market surveillance authority.
Did the EBA find conflicts between the AI Act and EU banking rules?
No. Its November 21, 2025 factsheet found no significant contradictions, described the AI Act as complementary to CRD, CRR, DORA and consumer-credit law, and said some effort is needed to integrate the two frameworks.
Will the EBA issue new guidelines on AI for banks?
As of the November 2025 factsheet, the EBA has not identified any immediate need to introduce new or revise existing EBA guidelines. It is instead working on a common supervisory approach among national authorities in 2026–27 and providing input to the EU AI Office.
Which bank AI use is high-risk under the AI Act?
AI used to evaluate creditworthiness or establish credit scores of natural persons (Annex III(5)(b)). The EBA's mapping exercise focused on this use case.
| Date | Document | Status |
|---|---|---|
| Jul 31, 2026 | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models | In force |
| Nov 21, 2025 | EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT | Final |
| Oct 1, 2025 | EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities | In force |
| Sep 25, 2025 | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector | Final |
| Aug 4, 2023 | EBA follow-up report on machine learning for IRB models (EBA/REP/2023/28) — Machine Learning for IRB Models — Follow-up report from the consultation on the Discussion paper on machine learning for IRB models | Final |
| Nov 11, 2021 | EBA discussion paper on machine learning for IRB models — Discussion Paper on machine learning for IRB models | Superseded |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →