EBA letter on outcome of EBA's EU AI Act mapping exercise against EU banking and payments regulation

The European Banking Authority (EBA) has published a letter sent to the European Commission (EC) with the outcome of its EU AI Act mapping exercise. In January 2025, the EBA established a dedicated workstream to map the requirements on high-risk AI systems under the EU AI Act against relevant provisions in EU banking and payments regulation, with a focus on the use of AI for creditworthiness and credit scoring. The EBA confirms that, although the EU AI Act identifies overlaps between some requirements on high-risk AI systems and EU financial sector law and envisages targeted derogations and other ways to address this (such as integration or combination of requirements), it does not envisage such derogations for other requirements on high-risk AI systems (e.g. human oversight, data governance, cybersecurity) which are already widely regulated under EU financial services law.

The EBA highlights that the Digital Operational Resilience Act framework extensively covers the cybersecurity and business continuity requirements set out in the EU AI Act and that the Capital Requirements Regulation and Capital Requirements Directive IV requirements already provide a comprehensive and technology-neutral governance and risk management framework that can be applied to supervising the use of AI tools. The EBA sets out in an annex to its letter, a table identifying how EU financial services law already addresses relevant EU AI Act requirements. The EBA believes the table will be useful to the EC when producing the guidelines under Article 96(1)(e) of the EU AI Act on the interplay between the EU AI Act and EU financial services law and managing any regulatory overlaps.

Return to main website.