BaFin guidance on ICT risks in the use of AI at financial entities

What it is

BaFin, Germany’s Federal Financial Supervisory Authority, published its Orientierungshilfe zu IKT-Risiken beim Einsatz von KI in Finanzunternehmen on 18 December 2025, followed by an English version, Guidance on ICT Risks in the Use of AI at Financial Entities, at the end of January 2026. It draws on BaFin’s discussions with financial firms about their use of AI.

The guidance starts from a simple position. DORA does not treat AI as a separate category. An AI system, as defined in Article 3(1) of the EU AI Act, is a subset of the network and information systems DORA already covers, and the model itself is an ICT asset. So the security and resilience of an AI system have to be ensured across its whole lifecycle, from data acquisition and model development to operation and retirement, inside the firm’s existing ICT risk management framework.

Who it applies to

The guidance is written for financial entities supervised by BaFin that must meet the ICT risk management requirements in Articles 5 to 15 of DORA, in particular banks under the Capital Requirements Regulation and insurers under Solvency II. It applies DORA’s risk-based approach and proportionality. AI that supports critical or important functions needs more extensive controls than, for example, a self-service assistant that is fully under human supervision and plays no part in decisions.

What it covers

Governance and organisation. Many firms adopt an AI strategy approved by the management body and aligned with their risk and digital operational resilience strategies. The management body keeps ultimate responsibility for ICT risk and must have enough knowledge to understand it. Responsibilities should be defined, including for using AI-generated results in decisions, and the ICT risk, control and internal audit functions should be involved according to each system’s criticality. Staff training on AI forms part of DORA’s skills requirements.

The ICT risk management framework. AI systems are integrated into identification, protection and prevention, detection, response and recovery, learning and communication under Articles 8 to 14 of DORA. Vulnerabilities in model training, data pipelines and inference are identified, and measures such as adversarial training or monitoring of model drift are documented and reviewed.

Development and testing. AI built in-house follows the firm’s standard development, change management and version control processes, including for end-user computing. Training data should come from trustworthy sources, libraries should be free of known vulnerabilities and the training process should be documented and versioned. Testing is proportionate to criticality and, depending on the system, can include adversarial testing such as data poisoning and evasion attacks, AI-specific penetration testing and stress testing. One challenge BaFin names is spotting applications that call external AI models through APIs, which can turn ordinary software into an AI system.

Operation and retirement. Components of AI systems, from training data sets and model implementations to libraries, are identified, classified, documented and monitored as ICT assets. Firms are encouraged to log AI decisions, model versions and training data on a risk basis, set thresholds for misbehaviour in critical systems, include AI in business continuity planning and remove retired models so they cannot be misused.

Cloud and third parties. Drawing on BaFin and the Bundesbank’s statement on cloud outsourcing, the guidance asks for a risk assessment before contracting that also covers changes the provider makes to the model, clear rules on subcontracting such as specialised libraries and GPU capacity, and service level and security agreements for AI that supports critical or important functions.

Cyber and data security, and incidents. The guidance closes with cyber and data security across the lifecycle, the reporting of major ICT-related incidents, and a case study on operating an LLM-based AI assistant.

Key dates

• 17 January 2025. DORA applies.
• 18 December 2025. German version of the guidance published.
• 30 January 2026. English version published.
• 29 July 2026. The KI-MIG enters into force, making BaFin the AI Act market surveillance authority for AI used in connection with its supervised firms’ regulated activities.
• 2 December 2027. AI Act high-risk obligations apply, including to AI for credit scoring and for life and health insurance pricing.

How it relates to other frameworks

The guidance sits alongside two other regimes. The EU AI Act, applied in Germany through the KI-MIG, sets duties by risk tier, and BaFin monitors it for the firms it supervises. German data protection law applies to any model that processes personal data, and from 20 November 2026 BDSG section 37a sets specific rules for scoring.

For a bank or insurer the work overlaps. One inventory of AI systems, models and providers serves DORA’s asset management, the AI Act’s classification and the GDPR’s records. Firms that structure their AI governance on ISO/IEC 42001 or the NIST AI RMF will find that the lifecycle controls BaFin describes map onto those frameworks.

A note on this page

This is Aicura’s reading of BaFin’s guidance. It is not legal advice and it is not the guidance itself. Read the document published by BaFin, and take advice on how DORA and the AI Act apply to your firm.