BaFin Begins Monitoring Financial Firms' AI Use
Germany's BaFin began monitoring AI use by banks, insurers and other financial entities on July 29 after legislation expanded its authority under the EU AI Act. Reuters reports that the regulator can impose fines and will examine transparency obligations, prohibited practices and certain systems used for creditworthiness assessment. BaFin's Jens Obermoller said high-risk AI monitoring begins in December 2027.
Germany's Federal Financial Supervisory Authority, BaFin, began monitoring AI systems used by banks, insurers and other financial entities in regulated financial activities on July 29. Reuters reports that German legislation expanding the regulator's authority took effect the same day, giving BaFin power to order fines as it enforces relevant EU AI Act requirements.
BaFin's remit is limited to AI connected directly with regulated financial services, according to an interview with Jens Obermoller, the regulator's director-general for cyber risks and technology in the financial sector. A bank's creditworthiness assessment system is within BaFin's remit, while an AI tool used for recruiting staff falls under the Federal Network Agency, he said.
What BaFin will examine
According to BaFin, its monitoring will focus on compliance with AI Act transparency requirements, prohibited AI practices and measures to promote AI literacy among employees. Reuters reports that this includes firms' disclosure obligations for customer-facing chatbots and systems used to assess creditworthiness.
BaFin President Mark Branson told Reuters: "People have to be able to trust that their fundamental rights will be protected when AI is used. BaFin will ensure, for example, that everyone has fair access to financial services and that no one is discriminated against as a result of AI."
The regulator will take a sample-based, risk-based approach rather than inspect every AI system at every financial institution, Obermoller said in BaFin's interview. He distinguished this activity from full supervision, stating that the AI Act requires market monitoring.
High-risk systems arrive later
BaFin stated that it will begin addressing high-risk AI in December 2027. The regulator identified life and health insurance risk assessment and pricing systems as examples. For banks and other financial institutions, systems evaluating the creditworthiness and credit scores of natural persons generally fall into the high-risk category, Obermoller said.
The sequencing matters because models used in lending and insurance pricing can affect access to essential financial products and the terms offered to individuals. The EU AI Act's risk-based structure places more extensive obligations on high-risk use cases than on many general-purpose or lower-risk deployments.
BaFin's published 2026 risk outlook describes banks' and insurers' AI usage as expanding from chatbots to risk modelling. That breadth means governance programs may need to cover both customer-facing applications and internal decision systems, while recognizing that regulatory responsibility can differ by use case and competent authority.
The new monitoring regime does not establish that every banking AI application is high risk or that BaFin will review every deployment. Its practical effect, based on the regulator's description, is a targeted enforcement channel for AI Act rules where AI is used in authorised financial activities.
Key Points
- 1BaFin now monitors regulated financial AI use, creating a German enforcement channel for EU AI Act transparency and prohibited-practice requirements.
- 2Creditworthiness systems and insurance pricing are central use cases because their outputs can shape individuals' access to financial services.
- 3Sample-based monitoring means BaFin will review selected applications rather than every system, while firms are expected to address transparency and AI literacy.
Scoring Rationale
The announcement activates a sector-specific AI Act monitoring role for Germany's banks and insurers, including potential fines. It is directly relevant to firms operating regulated financial AI systems, although its immediate jurisdiction is national and sector-specific.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
