BaFin AI Governance Banking: German Financial Supervisory Authority AI Guidance, DORA AI Anchoring, and MaRisk Compliance

MaRisk's AI-specific amendments, DORA's ICT asset register pulling AI systems into incident reporting, and BaFin stepping into the EU AI Act sectoral authority role from August 2026 — no other European financial regulator holds this much integrated AI oversight over one bank's systems.

BaFin occupies a position unlike any other European financial supervisor: it enforces MaRisk as prudential regulator, oversees DORA's ICT risk regime, and — from August 2026 — enforces the EU AI Act for German financial institutions as the country's designated sectoral authority. [Note: confirm BaFin's EU AI Act sectoral designation and the precise scope of the December 2025 AI-ICT guidance against BaFin's published materials before publication; both describe late-2025/2026 developments that should be checked against the live source.] That concentration matters operationally, not just descriptively — a German bank facing a BaFin examination from 2026 onward should expect DORA, MaRisk, and EU AI Act compliance to be assessed against the same AI systems in the same review, not as three separate audits spread across the year.

The practical question BaFin's guidance resolved was one every German bank had been managing under genuine ambiguity: is a foundation model accessed through an API an "ICT asset" for DORA purposes? BaFin's answer was yes, and that single determination cascades into real obligations — every AI system, including ones a bank doesn't own outright, needs an entry in the DORA ICT asset register, needs its incidents evaluated against DORA's major-incident criteria, and needs to sit inside DORA's resilience testing scope.

MaRisk: What AT 7.2 and AT 8.2 Actually Require You to Produce

MaRisk's 7th amendment (effective January 2024) added explicit ML-system model risk requirements that earlier versions didn't have. AT 7.2 requires that IT risk management cover AI systems as a defined category — not folded into generic IT risk language. AT 8.2 requires that AI sourced from third parties go through BaFin-compliant outsourcing governance, which in practice means a due diligence file, contract terms with real audit rights, and ongoing performance monitoring, not just a vendor onboarding checklist. BTO/BTR modules extend the same rigor to AI used in credit, market, and operational risk management specifically. A bank that treats these as separate IT and outsourcing conversations is missing BaFin's actual point: for AI, they're the same conversation.

BDAI: Explainability, Fairness, and Auditability as a Single Supervisory Test

BaFin's Big Data and AI guidance sets three principles that function as one combined test in practice. Explainability means a bank has to produce, on request, an explanation of an AI decision to a customer, a regulator, or its own audit function — BaFin's supervisory view treats unexplainable AI in consequential decisions as simply not acceptable, not as a gap to be managed over time. Fairness means Germany's AGG anti-discrimination law and EU non-discrimination rules apply directly to AI-driven credit and insurance pricing decisions — a disparate outcome isn't excused because a model produced it rather than a human underwriter. Auditability means model documentation, training data records, validation findings, and monitoring data all need to be available on demand for internal audit, external auditors, and BaFin itself — "available in principle" is different from "available when the examiner actually asks," and BaFin's examinations test the second one.

DORA: Your AI Vendor List Is Now a Regulatory Disclosure

Every AI system in the DORA ICT asset register needs its function and criticality classification, vendor or development source, CTPP dependencies, and operational resilience controls documented — and for the designated critical third-party providers (the major cloud and AI platform firms among them), German banks have to report their AI service usage as part of their own CTPP exposure reporting. An AI system failure gets evaluated against DORA's major incident criteria the same way any ICT incident would: if it disrupts service for a significant number of users or causes significant financial harm, DORA's clock starts — four-hour initial notification, seventy-two-hour detailed report, one-month final report. A bank that hasn't pre-classified what counts as an AI "major incident" will burn part of that four hours just deciding whether the clock has started.

EU AI Act: One Examination, Three Frameworks

From August 2026, BaFin's EU AI Act examination for high-risk systems — credit scoring, AML screening, insurance risk assessment under Annex III — checks conformity assessment completion, Annex IV technical documentation, EU AI database registration, and Article 14 human oversight mechanisms. Because BaFin examines all three frameworks together, a German bank's most efficient move is a single documentation and governance infrastructure built to satisfy DORA, MaRisk, and the EU AI Act at once, rather than three separate compliance programs that each produce overlapping but slightly different evidence for the same underlying AI systems.

AI Vendor Risk: MaRisk AT 8.2 Meets DORA Concentration

MaRisk AT 8.2's outsourcing governance and DORA's CTPP concentration framework both apply to the same AI vendor relationship, and BaFin has specifically connected the two: if a bank's reliance on a single AI vendor creates systemic risk, that concentration needs managing as an outsourcing risk under AT 8.2 and reporting under DORA's CTPP framework simultaneously. For AI vendors specifically, BaFin-compliant governance requires documentation of the vendor's development and validation practices, contract terms giving BaFin examination access to that documentation, assessment of the vendor's data security practices, and an actual exit plan — not a contractual clause, but a real operational answer to how the bank would replace the vendor's AI service if the relationship ended.

India Context: Dual-Clock Incident Response for German Branches

State Bank of India, ICICI Bank, Bank of Baroda, Bank of India, Canara Bank, Punjab National Bank, and Bank of Maharashtra all run German branches under BaFin's host-country supervision, each independently subject to MaRisk, DORA, and — from August 2026 — EU AI Act requirements for the German operation specifically. As branches rather than subsidiaries, they sit outside direct ECB SSM supervision, but BaFin coordinates with RBI through the EBA's supervisory college mechanism.

The incident-response detail that actually trips up dual-jurisdiction banks: CERT-In's six-hour initial reporting requirement and DORA's four-hour major-incident notification aren't the same clock, and DORA's is the tighter one. An AI security incident touching both the India parent and the German branch simultaneously needs a response playbook that triggers both notifications in parallel from the start — treating DORA's four hours as "CERT-In plus a buffer" is how a bank misses the binding constraint.

Action Checklist: One Program for Three Frameworks

1. Classify every AI system (including API-accessed foundation models) in the DORA ICT asset register — don't leave vendor-hosted AI out because the bank doesn't own the infrastructure.
2. Pre-define what counts as an AI "major incident" under DORA's criteria before an incident happens, so the four-hour clock doesn't start with a classification debate.
3. Audit AI vendor contracts for AT 8.2-compliant audit rights and exit plans — a documented exit plan, not just an exit clause.
4. Build EU AI Act Annex IV documentation into the same governance infrastructure as MaRisk and DORA evidence, not as a separate program.
5. Build dual CERT-In/DORA incident playbooks for German branches now, with DORA's four-hour window as the binding deadline for any incident touching both jurisdictions.