AI Act and Banking: What German Banks Need to Know
Banking was using AI before most industries knew what machine learning meant. Credit scoring, fraud detection, algorithmic trading—these aren’t new. What’s new is that the EU now regulates them.
The AI Act hits banking hard. Creditworthiness assessment is explicitly high-risk. So is any AI that determines access to essential financial services.
Credit Decisions Are High-Risk
If AI influences whether someone gets a loan, a credit card, or a mortgage, it’s high-risk under the AI Act. Full stop. That means risk management systems, bias testing, transparency obligations, human oversight, and technical documentation.
For German banks, this layers on top of existing BaFin requirements and the SCHUFA framework. The AI Act doesn’t replace these—it adds to them.
Fraud Detection Lives in a Gray Area
Fraud detection AI isn’t automatically high-risk, but it can trigger issues. If your fraud system blocks someone’s access to their account or essential services, you’re in high-risk territory. If it just flags transactions for human review, you’re probably fine. The distinction matters.
Customer Service and Chatbots
Banking chatbots face transparency requirements. Customers must know they’re interacting with AI. If the chatbot handles complaints or makes decisions affecting the customer relationship, additional obligations may apply.
What This Means Practically
German banks need to audit their AI systems now. Credit scoring models need the full high-risk treatment. Fraud detection needs careful classification. Customer-facing AI needs transparency mechanisms. BaFin will be watching, and they’ve already signaled they’ll coordinate with AI Act enforcement.
How Compound Law Helps
- AI system inventory and classification
- Credit scoring compliance frameworks
- BaFin and AI Act integration
- Bias testing and documentation
- Customer transparency policies
Frequently Asked Questions
Is all credit scoring high-risk? Yes. Any AI used to assess creditworthiness of natural persons is explicitly listed as high-risk in the AI Act.
What about internal risk models? Models used for regulatory capital or internal risk management aren’t automatically high-risk unless they affect individual credit decisions.
How does this interact with SCHUFA? SCHUFA-based scoring still needs AI Act compliance. The Act doesn’t exempt established systems—it regulates them.
