On 11 July 2024 ECB Banking Supervision published 'Digitalisation: key assessment criteria and collection of sound practices', built on a 2022 survey of all significant institutions, 21 targeted reviews of digitalisation steering and 10 on-site inspections. It sets out 14 key assessment criteria across business-model impact, governance and risk management, and it is the baseline document against which JSTs judge how banks steer AI and other innovative technologies. It requires a detailed impact review of all financial and non-financial risk dimensions before deploying technologies such as AI, cloud and DLT, and expects boards to have adequate digital knowledge.
| Document | ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices |
| Issued by | European Central Bank — Banking Supervision (SSM) |
| Type | Report |
| Status | In force |
| Published | Jul 11, 2024 |
| Effective | Jul 11, 2024 |
| Applies to | Significant institutions under the SSM; used by Joint Supervisory Teams in assessing digital strategies including AI adoption. |
| Official source | bankingsupervision.europa.eu ↗ |
| Use cases | AI governance (general) · Model risk management · Data & privacy · Third-party & vendor AI |
What are the key points of ECB digitalisation sound practices report (July 2024)?
- Based on a 2022 digitalisation survey of all significant institutions, 21 targeted reviews in 2023, and 10 on-site inspections (2022–23)
- 14 key assessment criteria grouped under business model, governance and risk management
- Criterion 11: run a detailed impact review across credit, market, operational, reputational and capital risks for innovative technologies including AI, cloud and DLT
- Criterion 12: data governance framework with clear roles and record-keeping checks for any new application, including AI
- Criterion 13: review and adapt existing risk models (including credit-risk models) for behavioural changes caused by digital channels
- Boards must have adequate collective digital knowledge to understand and challenge digital and AI initiatives
- Sound practices include measuring a 'data/AI value' — the expected economic contribution of use cases — and treating AI as a risk-identification category in its own right
- The ECB later noted the underlying data collection showed a significant rise in AI adoption, especially for credit scoring and fraud detection
What did ECB digitalisation sound practices report (July 2024) change for banks?
Before this report, ECB expectations on digital and AI strategy were scattered across SREP feedback. The report gave banks a public checklist of what JSTs assess, so an AI programme is now judged against explicit criteria on strategy, board competence, risk-impact review and data governance rather than general governance principles.
What are the ECB's key assessment criteria for digitalisation?
Fourteen criteria published in July 2024 covering business-model impact, governance and risk management, including a full risk-impact review for AI, cloud and DLT, data governance with clear roles, and board digital competence.
Does the ECB digitalisation report cover generative AI?
Only indirectly. It treats AI as one innovative technology within a broader digital-strategy framework; generative-AI specifics came later in the November 2025 Supervision Newsletter and the 2026–28 priorities.
| Date | Document | Status |
|---|---|---|
| Jul 7, 2026 | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions | In force |
| Jun 3, 2026 | Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson | Final |
| Feb 24, 2026 | Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado | Final |
| Feb 3, 2026 | Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner | Final |
| Nov 20, 2025 | Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) | Final |
| Nov 18, 2025 | SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 | In force |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →