← Back to updates
ECB

ECB

Low Impact

ECB publishes observational annex on 2025 AI workshops with banks

Published

Sep 22, 2026

Effective

Aug 2, 2026

Topics

Artificial intelligence, Credit scoring, Fraud detection, Model risk management, EU AI Act, Data governance, Third-party risk, Operational resilience

Executive Summary

The ECB’s November 2025 annex reports anonymised, self-reported findings from 13 supervised banks that joined 2025 workshops on AI, focused mainly on credit scoring and fraud detection. The ECB explicitly says the material is observational, informational and not a supervisory assessment, so it does not create new binding requirements, templates or deadlines. For business purposes, however, it is a useful supervisory signal: participating banks are embedding AI into existing risk and model frameworks, keeping humans in key decision loops, using established machine-learning techniques rather than GenAI for these use cases, and building AI Act inventories and self-assessments. The annex also highlights uneven maturity in explainability, third-party dependency management, fallback arrangements and the adaptation of data governance standards to AI. Significant institutions and their AI vendors should treat the publication as a benchmark against existing model risk, outsourcing, operational resilience and RDARR controls. The main regulatory horizon remains the EU AI Act, under which most provisions apply from 2 August 2026, while the ECB notes it is not the AI Act market surveillance authority.

What Changed

newObservational ECB benchmark on bank AI use

Previous

No 2025 ECB workshop annex was available for banks to benchmark these specific AI use cases.

New

The annex provides non-prescriptive, informational findings and explicitly states that it is not a supervisory assessment.

newCredit scoring and fraud detection practices documented

Previous

The annex does not establish a previous binding benchmark for these use cases.

New

The ECB identifies common patterns: internal development, coexistence with traditional models, regular monitoring and continued human involvement.

newAI governance maturity observations

Previous

No uniform AI governance operating model is prescribed by the annex.

New

The ECB notes that the effectiveness of emerging AI governance structures is still to be measured.

newAI Act readiness signal

Previous

AI Act readiness was not complete across the observed sample.

New

Banks are progressing readiness work, and the EU AI Act separately provides that most provisions apply from 2 August 2026.

newControl gaps highlighted for data and dependencies

Previous

Existing model, data and outsourcing controls were not consistently adapted to AI-specific risks across the observed sample.

New

The ECB frames these as emerging risk management areas, particularly for data quality, explainability, cybersecurity, operational resilience and third-party risk.

Business Impact

Who is affected

Directly affected

ECB-supervised significant institutions using or planning AI in credit scoring, loan origination, credit monitoring or fraud detection.

Indirectly affected

EU bank technology, cloud, model-as-a-service, data, fraud analytics and credit analytics providers supporting those AI use cases.

Jurisdictions

Banking Union, European Union

Business processes

AI use-case approval and inventory management, Credit scoring model development, validation and monitoring, Fraud detection alert generation and investigation workflows, Human oversight and explainability controls, Third-party, cloud and outsourcing risk management, Risk data aggregation, data quality and AI data lineage controls, EU AI Act readiness and system classification

Estimated effort

Medium

Compliance risk

Medium

Affected Reports

AI systems inventory and AI use-case production funnelAI model validation, explainability and performance-monitoring packCredit scoring and loan origination model governance controlFraud detection model monitoring and alert-investigation controlAI third-party dependency and cloud-hosting assessment
FieldValidation rule

Recommended Actions

7 suggested next steps· derived from source analysis
  1. 1
    AI generatedStep 1 of 7

    Treat the annex as a supervisory benchmark, not a binding rule, and map its observations to existing AI, model risk, outsourcing and data governance controls.

  2. 2
    AI generatedStep 2 of 7

    Refresh the AI systems inventory and use-case intake process to capture credit scoring, credit monitoring and fraud detection tools, including ownership, model type, deployment status, provider involvement and human oversight.

  3. 3
    AI generatedStep 3 of 7

    Review EU AI Act self-assessments and risk classifications, particularly for creditworthiness-related AI, against Regulation (EU) 2024/1689 and retain evidence of classification rationale.

  4. 4
    AI generatedStep 4 of 7

    Strengthen model validation evidence for AI credit and fraud models, including explainability approach, performance metrics, bias/error review, monitoring frequency and fallback procedures.

  5. 5
    AI generatedStep 5 of 7

    Reassess cloud, vendor, open-source library and model-as-a-service dependencies for AI use cases, including continuity, cybersecurity, chain outsourcing and data privacy controls.

  6. 6
    AI generatedStep 6 of 7

    Integrate AI data inputs into RDARR and data-quality governance, including golden-source usage, lineage, exception approval and data fitness for model purpose.

  7. 7
    AI generatedStep 7 of 7

    Prepare concise supervisory-dialogue evidence, including AI governance roles, committee mandates, policies, KPIs, dashboards and examples of human-in-the-loop operation.

Timeline

other

2025

The ECB identifies digitalisation and new technologies as a 2025 supervisory priority, continuing previous supervisory work on digitalisation and machine learning in internal models.

other

Aug 1, 2025

ECB AI workshops were held with participating banks in three to four-hour remote or hybrid meetings.

publication

Nov 1, 2025

ECB published the annex summarising anonymised, self-reported information from the 2025 AI workshops with banks.

implementation

Date not specified

The annex reports that some banks that had not yet performed AI Act self-assessments planned to do so by 2025 year-end.

effective date

Aug 2, 2026

Most provisions of Regulation (EU) 2024/1689, the EU AI Act, apply from this date, subject to the Act’s specific exceptions and phased application provisions.

Sources

AI-generated analysis is based on the following primary sources. Always verify against the official publication.

Related Evidence

Verified source support for this analysis

The evidence agent checks whether the drafted finding is supported by official publications and relevant public source material.

Receive updates like this by email

Get AI-generated analysis for the regulators and topics you care about.

Pulse is built by Datox. Datox automates AIFMD Annex IV and SEC Form PF reporting end to end.

See the Datox platform