What does EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) say about AI in banking?

What are the key points of EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360)?

• Status and addressees: Opinion adopted under Article 29(1)(a) of Regulation (EU) No 1094/2010, addressed to competent authorities, covering insurance undertakings and intermediaries (paragraphs 1.1-1.3); it sets no new requirements and does not change the scope of the AI Act or of insurance law (paragraph 2.8).
• Scope: AI systems that are not prohibited or high-risk under the AI Act; the AI Act's high-risk systems for life and health insurance risk assessment and pricing are excluded to avoid overlap (paragraph 2.6). It uses the AI Act definition and the Commission's AI system definition guidelines (paragraph 2.10).
• Legal basis: Articles 17, 20 and 25 of the Insurance Distribution Directive, Articles 41, 46 and 82 of Solvency II, Articles 4, 5, 6, 11 and 12 of DORA and related delegated regulations (paragraph 1.2).
• Proportionality (section 3, paragraphs 3.1-3.6): undertakings first assess the impact of each AI system, then calibrate governance measures to it; AI governance sits within the existing system of governance under Article 41 of Solvency II and the IDD.
• Risk management (paragraphs 3.7-3.11): the responsible use of AI needs a combination of measures; undertakings define and document their approach and remain responsible for AI systems, whether developed in-house or with third-party providers, and should obtain adequate information and assurances from them (paragraph 3.11).
• Fairness and ethics (paragraphs 3.12-3.17): act honestly, fairly and professionally under IDD Article 17, make reasonable efforts to remove bias including proxy discrimination, monitor outcomes and give customers redress mechanisms.
• Data governance, documentation and explainability (paragraphs 3.18-3.28): complete and accurate training and test data, records of AI system lifecycle decisions, and explanations tailored to the use and to the recipient.
• Human oversight (paragraphs 3.29-3.33) and accuracy, robustness and cybersecurity (paragraphs 3.34-3.38): trained staff and guardrails; defined accuracy levels with metrics including fairness metrics; resilience against data poisoning and adversarial attacks; and ICT continuity fall-back plans, linked to DORA Articles 6-12.
• Monitoring (section 4): EIOPA will look at supervisory practices two years after publication and may issue further analysis on specific AI systems.

What did EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) change for banks?

The Opinion is the first EU supervisory-authority text to spell out an AI governance framework for a financial sub-sector under existing sectoral law rather than the AI Act. For banks the direct effect is limited, since insurance law is its legal basis, but it shows how EU supervisors expect AI governance to be built from existing risk management, conduct and ICT rules, and it applies to the insurance side of bancassurance groups and to banks that act as insurance distributors.

What does the EIOPA Opinion on AI governance and risk management require, and does it apply to banks?

EIOPA's Opinion on AI governance and risk management (EIOPA-BoS-25-360, 6 August 2025) tells national supervisors to expect insurers and insurance intermediaries to apply proportionate AI governance built on Solvency II, the Insurance Distribution Directive and DORA: assess each AI system's impact, document the approach, remain responsible for third-party AI, test for bias, keep records, explain outcomes, ensure meaningful human oversight and secure systems against attack. It is not binding and creates no new requirements. It does not apply to banks as such, only to the insurance business of groups and to banks selling insurance as intermediaries, and it excludes AI systems classed as high-risk or prohibited under the AI Act.

The Opinion rests on insurance sectoral law, so its direct addressees are insurers, intermediaries and their supervisors. It uses DORA as one of its legal bases, which means its ICT risk and cybersecurity expectations match what banks must meet under the same Regulation, and it cross-refers to the Commission's AI system definition guidelines.

Its relevance to banking supervision is as a template. EIOPA, like the EBA and ECB, has chosen to derive AI expectations from existing governance, conduct and operational resilience rules rather than create a new AI rulebook; the EBA's AI Act factsheet reaches a similar conclusion for banking law.

For groups with both banking and insurance arms, the same AI system can be subject to the EIOPA Opinion for the insurance business and to ECB and EBA expectations for the bank, while the AI Act applies to both. EIOPA plans to review supervisory practices two years after publication.

WHAT THIS MEANS IN PRACTICE

• Bancassurance groups should check which AI systems in the insurance entities fall within the Opinion and which are high-risk under the AI Act and so excluded from it.
• Banks that sell insurance should confirm with their national supervisor how it will apply the Opinion to distribution activities, especially customer-facing chatbots and recommendation tools.
• Reuse the Opinion's structure (impact assessment, proportionate governance, data, records, explainability, oversight, security) as a cross-check on the bank's own AI governance framework.
• Align fairness and proxy-discrimination testing across banking and insurance entities in the group so that the evidence can be reused.
• Treat the Opinion as non-binding but likely to inform supervisory questions, since EIOPA plans a convergence review about two years after publication.