# ECB digitalisation sound practices report (July 2024): Digitalisation: key assessment criteria and collection of sound practices

Source: https://www.bankingnewsai.com/ai-regulation/documents/ecb-digitalisation-key-assessment-criteria-2024
Last updated: Aug 26, 2026

On 11 July 2024 ECB Banking Supervision published 'Digitalisation: key assessment criteria and collection of sound practices', built on a 2022 survey of all significant institutions, 21 targeted reviews of digitalisation steering and 10 on-site inspections. It sets out 14 key assessment criteria across business-model impact, governance and risk management, and it is the baseline document against which JSTs judge how banks steer AI and other innovative technologies. It requires a detailed impact review of all financial and non-financial risk dimensions before deploying technologies such as AI, cloud and DLT, and expects boards to have adequate digital knowledge.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [ECB](https://www.bankingnewsai.com/ai-regulation/ecb) |
| Type | Report |
| Status | In force |
| Published | Jul 11, 2024 |
| Effective | Jul 11, 2024 |
| Applies to | Significant institutions under the SSM; used by Joint Supervisory Teams in assessing digital strategies including AI adoption. |
| Official text | https://www.bankingsupervision.europa.eu/ecb/pub/html/ssm.reportondigitalisation_202407~3f4de7a771.en.html |

## Key points

- Based on a 2022 digitalisation survey of all significant institutions, 21 targeted reviews in 2023, and 10 on-site inspections (2022–23)
- 14 key assessment criteria grouped under business model, governance and risk management
- Criterion 11: run a detailed impact review across credit, market, operational, reputational and capital risks for innovative technologies including AI, cloud and DLT
- Criterion 12: data governance framework with clear roles and record-keeping checks for any new application, including AI
- Criterion 13: review and adapt existing risk models (including credit-risk models) for behavioural changes caused by digital channels
- Boards must have adequate collective digital knowledge to understand and challenge digital and AI initiatives
- Sound practices include measuring a 'data/AI value' — the expected economic contribution of use cases — and treating AI as a risk-identification category in its own right
- The ECB later noted the underlying data collection showed a significant rise in AI adoption, especially for credit scoring and fraud detection

## What changed for banks

Before this report, ECB expectations on digital and AI strategy were scattered across SREP feedback. The report gave banks a public checklist of what JSTs assess, so an AI programme is now judged against explicit criteria on strategy, board competence, risk-impact review and data governance rather than general governance principles.

## Use cases it governs

- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)

## FAQ

### What are the ECB's key assessment criteria for digitalisation?

Fourteen criteria published in July 2024 covering business-model impact, governance and risk management, including a full risk-impact review for AI, cloud and DLT, data governance with clear roles, and board digital competence.

### Does the ECB digitalisation report cover generative AI?

Only indirectly. It treats AI as one innovative technology within a broader digital-strategy framework; generative-AI specifics came later in the November 2025 Supervision Newsletter and the 2026–28 priorities.

## Related documents

- [ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-letter-ai-enabled-cybersecurity-threats-2026) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions (Jul 7, 2026)
- [Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-elderson-operational-resilience-age-of-ai-speech-2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson (Jun 3, 2026)
- [Machado speech: 'Technology is neutral, governance is not' (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-technology-neutral-governance-speech-2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado (Feb 24, 2026)
- [Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-montagner-digital-transformation-speech-2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner (Feb 3, 2026)
- [Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-supervision-newsletter-ai-credit-scoring-fraud-2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) (Nov 20, 2025)
- [SSM supervisory priorities 2026–28](https://www.bankingnewsai.com/ai-regulation/documents/ecb-ssm-supervisory-priorities-2026-28) — ECB Banking Supervision: SSM supervisory priorities for 2026–28 (Nov 18, 2025)
- [Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-ai-and-supervision-speech-2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado (Oct 14, 2025)
- [ECB Guide to internal models (July 2025, ML section)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-guide-to-internal-models-2025-machine-learning) — Revised ECB Guide to internal models — expectations for machine-learning techniques in internal models (Jul 28, 2025)

Last reviewed Aug 26, 2026. Cite the official text (https://www.bankingsupervision.europa.eu/ecb/pub/html/ssm.reportondigitalisation_202407~3f4de7a771.en.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/ecb-digitalisation-key-assessment-criteria-2024
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.