The ECB supervises AI at large euro-area banks through its existing prudential toolkit — model approvals, operational-resilience expectations, and on-site inspections — rather than AI-specific rules. AI is embedded in its supervisory priorities for 2026–28, with a sharpened focus on generative AI, and supervisors have made governance the central message: banks are accountable for AI outcomes regardless of how the technology performs.
| Full name | European Central Bank — Banking Supervision (SSM) |
| Role | Prudential supervisor |
| Force on banks | Supervisory guidance |
| Applies to | The ~110 significant euro-area banking groups directly supervised under the SSM |
| Key document | SSM supervisory priorities 2026–28 (AI under the operational-resilience priority) |
| Latest move | Feb 2026 supervisory speech on AI governance; 2026–28 priorities single out generative AI |
The ECB's involvement runs on two tracks. For regulatory-capital models (IRB), any machine-learning component passes through the ECB's internal-model approval and the EBA's ML-for-IRB expectations. For everything else — fraud detection, customer service, coding assistants, generative AI — the ECB supervises through operational resilience and governance expectations, now formalized in its 2026–28 supervisory priorities under the digitalisation and ICT priority.
ECB supervisors have been increasingly vocal in 2026: a February 2026 speech ('Technology is neutral, governance is not') captures the house view that AI adoption is welcome but board-level accountability, data quality, and control frameworks decide whether it is safe. The ECB is not the AI Act's market-surveillance authority — that falls to national authorities — but it factors AI Act readiness into its assessment of banks' governance.
| Date | Type | Document / event |
|---|---|---|
| May 1, 2024 | Report | Financial Stability Review examines AI in the financial system. ECB analysis of AI adoption, concentration among providers, and potential herding in euro-area finance. |
| Nov 1, 2025 | Guidance | SSM supervisory priorities 2026–28 published. AI monitoring continues under the operational-resilience and ICT priority, with a more focused approach to generative-AI applications, credit scoring, and fraud detection. |
| Feb 24, 2026 | Speech | Speech: 'Technology is neutral, governance is not'. ECB supervision sets out its expectations for AI adoption in banking: accountability, data quality, and governance over any specific technology choice. |
- How the ECB folds EU AI Act readiness into SREP governance scores for significant institutions
- Supervisory attention to generative AI in customer-facing and credit processes under the 2026–28 priorities
- Potential ECB guide or expectations document dedicated to AI, consolidating the speech-level messaging
Does the ECB approve banks' AI models?
Only models used for regulatory capital (internal models under IRB) go through formal ECB approval, including any ML components. Other AI systems — fraud detection, chatbots, generative AI tools — are supervised through governance and operational-resilience expectations rather than pre-approval.
Is the ECB responsible for enforcing the EU AI Act on banks?
No. AI Act market surveillance is assigned to national authorities. The ECB supervises prudential soundness — but it assesses whether a bank's governance and risk management adequately cover its AI use, which in practice includes AI Act readiness.
What are the ECB's supervisory priorities on AI for 2026–28?
AI sits under the operational-resilience and ICT priority: continued monitoring of AI adoption with a more focused approach to generative-AI applications, and particular attention to AI in credit scoring and fraud detection.
Follow every move these regulators make
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →