EIOPA is the EU supervisor for insurance and occupational pensions, and its AI position for banks is indirect. Its Opinion on AI governance and risk management (EIOPA-BoS-25-360, 6 August 2025) tells national supervisors how to read Solvency II, the Insurance Distribution Directive and DORA for AI systems that are neither prohibited nor high-risk under the AI Act; it sets no new requirements and is not binding. It does not apply to banks as such, but it covers bancassurance groups and banks that sell insurance, and it is a model for how EU supervisors derive AI governance from existing sectoral rules. EIOPA also shares DORA oversight of critical ICT third-party providers with the EBA and ESMA and co-signed the ESAs' July 2026 statement on frontier AI risks.
| Full name | European Insurance and Occupational Pensions Authority |
| Role | EU insurance and pensions supervisory authority, one of the three European Supervisory Authorities |
| Force on banks | Supervisory guidance |
| Applies to | National competent authorities supervising insurers, reinsurers, insurance intermediaries and occupational pension funds; bancassurance groups and banks that distribute insurance are affected through their insurance activities. EIOPA is also one of the three ESAs that oversee critical ICT third-party providers under DORA |
| Key document | Opinion on AI governance and risk management (EIOPA-BoS-25-360, 6 August 2025) |
| Latest move | 6 August 2025 — EIOPA published its Opinion on AI governance and risk management (EIOPA-BoS-25-360) for national insurance supervisors; on 31 July 2026 EIOPA joined the EBA and ESMA in the ESAs' joint statement on ICT risks from frontier AI models (JC 2026 25). |
| Documents tracked | 1 · all documents → |
EIOPA was established in 2011 as one of the three European Supervisory Authorities with the EBA and ESMA. It builds a common supervisory culture for insurance and pensions and issues opinions, guidelines and technical standards. Its opinions are addressed to national competent authorities and are not binding, but they set expectations that national supervisors are asked to apply.
On AI, EIOPA's approach mirrors the EBA's and ECB's: rather than writing a separate AI rulebook it explains how existing sectoral law applies. Its 2025 Opinion lists expectations on proportionality, governance, fairness, data, records, explainability, human oversight and cybersecurity, excludes AI systems that are high-risk or prohibited under the AI Act, and promises a review of supervisory practices two years after publication. Under DORA, EIOPA acts with the EBA and ESMA when the ESAs designate and oversee critical ICT third-party providers.
What has the EIOPA actually published on AI?
| Date | Document | Status |
|---|---|---|
| Aug 6, 2025 | EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) — EIOPA-BoS-25-360 Opinion on AI governance and risk management | In force |
| Date | Type | Document / event |
|---|---|---|
| Aug 6, 2025 | Guidance | EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360) — EIOPA-BoS-25-360 Opinion on AI governance and risk management. EIOPA published its Opinion on AI governance and risk management (EIOPA-BoS-25-360) on 6 August 2025. source ↗ |
- EIOPA's review of supervisory practices on AI, planned two years after publication of the Opinion (around August 2027).
- Further EIOPA analysis or guidance on specific AI systems or emerging issues, which the Opinion says EIOPA envisages.
- ESA follow-up on frontier AI through DORA oversight of critical ICT third-party providers.
- How national supervisors apply the Opinion to banks that distribute insurance and to bancassurance groups.
Does EIOPA regulate AI at banks?
No. EIOPA supervises insurance and occupational pensions. Banks are covered by the EBA, the ECB and national supervisors, but EIOPA's AI Opinion is relevant to banks that distribute insurance as intermediaries and to bancassurance groups.
Is EIOPA's AI opinion binding?
No. It is an opinion addressed to national supervisors, it clarifies how existing insurance law applies to AI and it states that it sets no new requirements.
What role does EIOPA have under DORA?
With the EBA and ESMA, EIOPA is one of the European Supervisory Authorities that designate critical ICT third-party providers and oversee them through Lead Overseers; on 18 November 2025 the ESAs published the first list of 19 critical providers.
Follow every move these regulators make
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning