The EBA is the EU body translating the AI Act into banking practice. Its November 21, 2025 factsheet and AI Act mapping exercise found no significant contradictions between the Act and EU banking law and no immediate need for new EBA guidelines; its September 2025 adoption report found 92% of EU banks already deploying AI. On July 31, 2026 the EBA, EIOPA and ESMA jointly told financial entities to adjust their DORA ICT-risk frameworks without delay for cyber threats from frontier AI models. Its 2021–23 machine-learning-for-IRB workstream still governs how ML enters regulatory capital models.
| Full name | European Banking Authority |
| Role | EU banking standard-setter |
| Force on banks | Supervisory guidance |
| Applies to | All EU credit institutions and payment providers, via national competent authorities |
| Key document | Factsheet on the AI Act's implications for banking and payments (Nov 2025) |
| Latest move | Jul 31, 2026: joint ESA statement (JC 2026 25) on ICT risks from frontier AI models — banks told to adjust DORA ICT-risk controls around prevention, detection and management without delay |
| Documents tracked | 9 · all documents → |
The EBA has worked on bank AI longer than most: a 2020 report on big data and advanced analytics set early governance expectations, and its 2021–23 workstream on machine learning for internal ratings-based (IRB) models defined how banks may use ML in capital models without losing explainability and supervisability.
With the AI Act now applicable to high-risk banking use cases, the EBA's role has shifted to implementation: mapping AI Act duties onto the existing CRD/CRR and guidelines framework so banks are not regulated twice or inconsistently, promoting supervisory convergence among national competent authorities, and participating in the AI Board's financial-services subgroup. Its 2025 adoption report — covering credit scoring, fraud detection, customer support, and general-purpose AI — is the best official snapshot of what EU banks actually deploy.
What has the EBA actually published on AI?
| Date | Document | Status |
|---|---|---|
| Jul 31, 2026 | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models | In force |
| Nov 21, 2025 | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector | Final |
| Nov 21, 2025 | EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT | Final |
| Oct 1, 2025 | EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities | In force |
| Sep 25, 2025 | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector | Final |
| Aug 4, 2023 | EBA follow-up report on machine learning for IRB models (EBA/REP/2023/28) — Machine Learning for IRB Models — Follow-up report from the consultation on the Discussion paper on machine learning for IRB models | Final |
| Nov 11, 2021 | EBA discussion paper on machine learning for IRB models — Discussion Paper on machine learning for IRB models | Superseded |
| May 29, 2020 | EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring | In force |
| Jan 13, 2020 | EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics | Final |
| Date | Type | Document / event |
|---|---|---|
| Jul 31, 2026 | Guidance | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models. On July 31, 2026 the EBA, EIOPA and ESMA published joint statement JC 2026 25 on ICT risks from frontier AI models, warning that highly capable AI models sharply accelerate vulnerability discovery and exploitation and could create systemic cyber risk. source ↗ |
| Nov 21, 2025 | Guidance | EBA factsheet: AI Act implications for the EU banking and payments sector — AI Act: implications for the EU banking and payments sector. The EBA's factsheet 'AI Act: implications for the EU banking and payments sector', published November 21, 2025, reports the results of its 2025 mapping of AI Act high-risk obligations — focused on credit scoring of natural persons, high-risk under Annex III(5)(b) — against the CRD, CRR, DORA, Consumer Credit Directive, Mortgage Credit Directive, PSD and EBA guidelines on loan origination, internal governance and PD/LGD estimation. source ↗ |
| Nov 21, 2025 | Letter | EBA Chair letter to the Commission on the AI Act mapping exercise (EBA/2025/D/5384) — Outcome of EBA's AI Act mapping exercise — letter to DG FISMA and DG CNECT. On November 21, 2025 EBA Chair José Manuel Campa wrote to the Commission's DG FISMA and DG CNECT (EBA/2025/D/5384) with the outcome of the EBA's AI Act mapping exercise. source ↗ |
| Oct 1, 2025 | Framework | EBA Work Programme 2026 — EBA Work Programme 2026 — AI Act implementation and digital-finance priorities. The EBA Work Programme 2026, published in October 2025 as part of the Single Programming Document 2026–2028, makes artificial intelligence and machine learning one of three digital-finance thematic priorities for 2026 alongside crypto-assets/DLT and value-chain evolution. source ↗ |
| Sep 25, 2025 | Report | EBA report: Rising application of AI in EU banking and payments (Sep 2025) — Rising application of AI in EU banking and payments sector. The EBA's September 25, 2025 report 'Rising application of AI in EU banking and payments sector' is the official snapshot of AI use in EU banks: 92% of EU banks are deploying AI and 8% are piloting or discussing use cases. source ↗ |
| Aug 4, 2023 | Report | EBA follow-up report on machine learning for IRB models (EBA/REP/2023/28) — Machine Learning for IRB Models — Follow-up report from the consultation on the Discussion paper on machine learning for IRB models. The EBA's follow-up report on machine learning for IRB models (EBA/REP/2023/28), published August 4, 2023, closed out the 2021 consultation. source ↗ |
| Feb 11, 2022 | Milestone | Consultation on the ML-for-IRB discussion paper closes. Deadline for industry feedback on the EBA's November 2021 discussion paper on machine learning for IRB models; the feedback fed the August 2023 follow-up report. |
| Nov 11, 2021 | Consultation | EBA discussion paper on machine learning for IRB models — Discussion Paper on machine learning for IRB models. On November 11, 2021 the EBA published a discussion paper on machine learning for internal ratings-based (IRB) models, open for comment until February 11, 2022. source ↗ |
| May 29, 2020 | Guidance | EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06) — Guidelines on loan origination and monitoring. The EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), published May 29, 2020 and applicable from June 30, 2021, are the EU's standing rulebook for how banks use automated and technology-enabled models in creditworthiness assessment and credit decisions. source ↗ |
| Jan 13, 2020 | Report | EBA Report on Big Data and Advanced Analytics (EBA/REP/2020/01) — Report on Big Data and Advanced Analytics. The EBA's Report on Big Data and Advanced Analytics (EBA/REP/2020/01), published January 13, 2020, is the EU's foundational statement of what supervisors expect from bank use of machine learning. source ↗ |
- European Commission guidelines on the interplay between the AI Act and EU sectoral (banking) law under Article 96(1)(e), informed by the EBA's mapping annex
- Supervisory-convergence output for national competent authorities and market surveillance authorities enforcing the high-risk regime on credit scoring
- DORA oversight of critical ICT third-party providers embedding frontier-AI risk in the 2027 Oversight Plan, following the July 2026 ESA statement
- Whether ML-for-IRB expectations get updated for the AI Act era
What has the EBA said about the AI Act for banks?
Its November 2025 factsheet explains how AI Act obligations — particularly the high-risk classification of credit scoring — interact with the existing EU banking framework, and its 2026–27 workplan focuses on getting national supervisors to apply the Act to banks consistently.
Can EU banks use machine learning in capital (IRB) models?
Yes, within the expectations set by the EBA's machine-learning-for-IRB workstream (2021 discussion paper and 2023 follow-up): banks must preserve explainability, human understanding of model drivers, and supervisability. The ECB applies these expectations in model approvals.
How common is AI in EU banking?
The EBA's 2025 adoption report found AI in production across most EU banks — dominated by fraud detection, credit scoring, and customer support, with general-purpose AI spreading fast in internal productivity use cases.
What did the ESAs say about frontier AI models in July 2026?
On July 31, 2026 the EBA, EIOPA and ESMA published joint statement JC 2026 25 warning that frontier AI models sharply accelerate vulnerability discovery and exploitation. It asks financial entities to adjust ICT risk management under DORA along three strategies — prevention, detection and management — proportionately to their size and risk profile (DORA Art. 4), and says the Lead Overseers are embedding AI-related risk into the oversight of critical ICT third-party providers for 2027.
Follow every move these regulators make
the daily brief · six sourced stories · in your inbox by 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning