BaFin AI market supervision since July 2026: analysis

The most important AI document in a bank is rarely the model card. It is the governance file someone can actually produce when a supervisor asks who approved the system, what it does, and what happens when it fails. Since July 2026, that question in Germany has had a sharper institutional owner: BaFin. For financial firms, AI compliance has moved from abstract EU architecture to the duller, more expensive work of inventories, controls, vendor files, and board level accountability.

BaFin is now in the room

Banking.Vision reported on Oct. 27, 2026 that BaFin has held responsibility for AI market supervision in the financial sector since July 2026. That matters because banks and insurers already live inside dense supervisory regimes, so AI oversight will not arrive as a separate novelty box. It will be read through risk management, outsourcing, controls, and documented accountability. The practical translation is simple: if an AI system supports regulated financial activity, the compliance file needs to look like supervision can touch it.

The timing sits inside a broader legal sequence. The EU Artificial Intelligence Act site says the EU AI Act was published in the Official Journal of the European Union on 12 July 2024. Germany’s Federal Law Gazette then published the national implementation law for Regulation (EU) 2024/1689 as “BGBl. 2026 I Nr. 223 vom 28.07.2026,” identifying it as the law implementing the EU regulation on harmonised AI rules. That is the part LinkedIn tends to skip: a directly applicable EU regulation still needs national machinery for who supervises, where complaints go, and how enforcement is routed.

@title Financial AI supervision clock
@source EU AI Act Bundesgesetzblatt
@source Banking Vision BaFin speech

  12 July 2024 ··· EU AI Act published
  July 2026 ······ BaFin AI role
  28 July 2026 ··· German law published
  1 Jan 2027 ····· WpI MaRisk applies

@caption Four dates financial AI teams should calendar now.

What changes before the first inspection letter

Banking.Vision’s German report puts the uncomfortable point plainly, saying “Viele Pflichten gelten für Banken und Versicherer schon heute.” In English: do not wait for a ceremonial enforcement season to begin basic compliance work. For banks and insurers, the useful question is not whether a model is impressive. It is whether the institution can classify its use, document the controls, show human oversight where required, and explain dependencies on third party providers.

That means AI inventories need to become operational records rather than innovation theater. A credit workflow using AI support, an insurance claims triage tool, or a customer service assistant touching regulated processes should have an owner, a purpose, input and output documentation, monitoring criteria, and escalation procedures. Vendor contracts need the boring clauses: access to documentation, incident and performance reporting, change notification, subcontractor visibility, and audit cooperation. If your procurement team cannot get those terms, the model may still be clever, but the deployment is not ready for a supervisor.

Risk management is the bridge

BaFin’s own language on investment firms points in the same direction. In an Oct. 26, 2026 speech, executive director Thorsten Pötzsch said the new WpI MaRisk for investment firms apply from Jan. 1, 2027. He also said the framework brings governance, risk steering, control functions, and outsourcing into one rulebook. That is not an AI rule as such, but it tells builders where BaFin expects controls to live.

For fintech teams selling into German finance, this is the map. A buyer will ask less often for a manifesto about responsible AI and more often for evidence that plugs into its existing risk management process. Can the system be monitored? Can the bank explain model changes? Can an insurer trace a disputed output back to the data, process, and responsible control function? If the answer is “our lawyers are reviewing it,” translate that as not yet deployable in a regulated workflow.

The compliance file to build now

The Federal Law Gazette confirms Germany’s implementation law is tied to EU Regulation 2024/1689, while Banking.Vision identifies BaFin’s financial sector role since July 2026. Put those together and the immediate obligation is not to predict every future fine. It is to make AI use legible to the supervisor already responsible for the sector.

The minimum practical package is unglamorous. Maintain an AI use register by business process, not by experimental team. Classify systems against AI Act categories and financial regulation impact, with the reasoning saved. Attach governance approvals, vendor terms, monitoring metrics, incident paths, and retirement criteria. Separate marketing claims from the actual control evidence, because supervisors do not grade adjectives.

The next thing to watch is how BaFin describes its inspections and findings once financial AI supervision matures. Until then, banks, insurers, and fintech suppliers should treat the current scrutiny as an implementation roadmap. The firms that do the paperwork early will not make AI risk disappear. They will at least know where it is, who owns it, and what evidence they can hand over when the polite email from supervision arrives.