EBA — AI Act: implications for the EU banking and payments sector (Chair letter)

Tag: S-2025-11-eba-ai-act-mapping Type: report Author(s): European Banking Authority — Chair letter to Mr Berrigan and Mr Viola, communicating the outcome of the EBA’s AI Act mapping exercise. Date of source: 2025-11 (published November 2025; addressed in the EBA’s republished 2026 Work Programme) Date ingested: 2026-05-17 (consolidated from multiple Open Brain restatements 18 Mar – 7 May 2026) Authority weight: high — formal EBA position to the European Commission. Raw file: Open Brain corpus snapshot at /_raw_sources/open-brain-2026-05-17-corpus.md.

What it claims

EBA confirms that the existing CRR / CRD governance and risk management requirements are technology-neutral and can be leveraged for AI supervision of banks. Firms should therefore map AI controls into existing model risk, operational risk, ICT and outsourcing frameworks rather than build parallel AI governance structures. The letter forms part of the EBA’s broader AI Act mapping exercise and is referenced in the EBA’s 2026 Work Programme, which prioritises AI Act mapping and DORA oversight, and signals a 2026–2027 supervisory convergence programme rather than immediate new guidelines. EBA also notes that only about half of EU banks have introduced dedicated policies or committees to oversee AI, and that second- and third-lines of defence are inadequate at most firms.

Notable quotes

None captured verbatim; ingestion relied on WebSearch summary of eba.europa.eu.

What’s speculative vs. asserted

• Asserted: technology-neutral framing of CRR/CRD; existing-framework reuse stance; “half of EU banks” and “2LoD/3LoD inadequate” findings.
• Forward-looking: the 2026–2027 supervisory convergence programme is committed but the specific control expectations beyond the November 2025 factsheet are still pending.

Topics this feeds

• EBA Supervisory Direction on AI and Governance
• Model Risk Management and Agentic AI
• Three Lines of Defence for AI

Open questions raised

• What concrete control expectations EBA will publish during the supervisory convergence programme.
• Whether the “technology-neutral” framing holds once high-risk AI systems (Annex III) deployed in banking become subject to the AI Act’s own obligations under the 2 August 2026 applicability date.

Ingestion note

Consolidates Open Brain thoughts dated 5/7, 4/28, 4/25, 3/18, and the EBA-Work-Programme references in thoughts dated 4/26, 4/24.