European Central Bank (ECB) Member of the Supervisory Board Pedro Machado highlighted in a recent speech that the use of artificial intelligence within the commercial and investment banking (CIB) industry is no longer confined to experimental innovation labs or isolated analytics teams. With over 85% of large European supervised banks deploying AI across core workflows, machine learning and generative AI are embedded in the operational fabric of commercial banking, according to Machado. However, Machado also pointed out that, as AI expands horizontally from front-office sales into high-stakes credit underwriting, internal ratings-based (IRB) capital allocation and risk management, the supervisory mandate is fundamentally shifting.
European industry associations and regulators – led by the ECB, Germany’s BaFin, Switzerland’s FINMA and the European Banking Authority (EBA) – are asserting a firm supervisory baseline: technology is neutral, but governance is not. For example, under the EU AI Act, AI systems used to evaluate creditworthiness or establish credit scores for natural persons are explicitly classified as high-risk applications, according to an August 2023 EBA report.
Simultaneously, a January 2026 BaFin report explored how the EU’s Digital Operational Resilience Act (DORA) and the ECB's Risk Data Aggregation and Risk Reporting (RDARR / BCBS 239) guidelines enforce strict operational resilience, third-party risk tracking and end-to-end data lineage across the data lifecycle.
For European Chief Information Officers (CIOs), Chief Risk Officers (CROs) and Chief Data Officers, this body of regulation creates dual challenges. On one hand, CIBs face pressure to scale AI capabilities to optimise loan decisioning and credit risk differentiation. On the other hand, the rapid proliferation of accessible generative AI tools creates widespread shadow AI exposure – unmonitored end-user computing, unvetted open-source libraries and context poisoning in Retrieval-Augmented Generation (RAG) architectures.
To maintain regulatory compliance without stalling digital transformation, Tier I institutions are designing structured Human-in-the-Loop (HITL) governance models anchored in centralised oversight and auditable data lineage.
Empirical Evidence & Synthesis
Currently, the most difficult question for CIOs and CROs is what ‘good’ looks like in practice. The evidence below – drawn from ECB benchmark workshops and BaFin and FINMA supervisory reviews – shows how CIBs are working to:
- keep humans in control of credit decisions;
- bring shadow AI under central oversight; and
- trace the data behind capital models.
- HITL Architecture in Credit Scoring & Risk Assessment – Direct supervisory data from the ECB's benchmark workshops across 13 significant European institutions – spanning 9 countries and EUR 150bn to EUR 1tn+ in asset classes covered – reveals that Tier I CIBs treat human oversight as a prerequisite for high-stakes decisions. Specifically, the ECB analysis found:
- Universal HITL Enforcement in Credit Scoring – Across surveyed CIBs using AI for credit scoring, 100% maintain explicit human oversight. Specifically, 40% use AI purely as decision support where human credit officers retain ultimate approval, while 10% mandate manual human review of AI-generated decisions. Fully autonomous execution is restricted strictly to low-value, standardised retail loan originations;
- Tiered Human Oversight – Leading institutions apply a risk-proportional governance model. Higher loan volumes, complex corporate lending structures and higher-risk applicant profiles automatically trigger mandatory senior credit committee reviews; and
- Static Production Deployment vs. Self-Learning Prohibition – Regulators and bank model risk management functions strictly prohibit self-learning models in production. Model parameters are reviewed during development and testing, but post-deployment weights remain static to prevent drift and unvetted decision shifts.
- Eliminating Shadow AI & Unvetted Model Sprawl – The widespread availability of large language models and open-source machine learning code has introduced acute operational and compliance risks. Supervisory reviews by BaFin and FINMA highlight that incomplete AI inventories represent a primary vulnerability. Specifically:
- Centralised ‘Hub & Spoke’ Governance – Tier I institutions like UBS and HSBC established centralised Chief AI Offices (CAIO) or Artificial Intelligence Review Committees as the ‘hub.’ While individual business lines – the ‘spokes’ – explore use cases, all production deployments, model modifications and API connections must pass through central vetting and automated routing platforms; for example, UBS Claves;
- Centralised AI Model Inventories – To eliminate shadow AI, institutions establish mandatory “AI Funnels” and centralised model repositories. Under BaFin and DORA guidelines, CIBs must record every AI asset, mapping its data dependencies, Cloud processing locations and third-party sub-contracting chains; and
- RAG Context Verification & Rollback Protocols – To prevent “knowledge poisoning” in generative assistants, CIBs implement strict data release controls, automated testing procedures and version control systems that enable immediate rollback to previous stable model iterations in the event of unexpected behaviour.
- Guaranteeing Data Lineage & Explainability in IRB Credit Models – A May 2024 ECB report highlights how data quality and explainability form the core intersection between AI governance and prudential capital requirements under CRR / CRD and BCBS 239. Specifically:
- Upstream Data Lineage (RDARR / BCBS 239) – The ECB's supervisory focus has moved upstream from model algorithms to data origins, Supervisory Member Machado said in his February 2026 speech. CIBs are establishing “golden data sources” feeding centralised AI repositories, requiring explicit approvals for exceptions. This ensures that input data for Probability of Default and Loss Given Default models maintain documented provenance across the full data lifecycle, according to the ECB and EBA.
- Explainability in Practice – While 46% of supervised banks consider their credit scoring AI fully explainable, institutions achieve this not through simple black box outputs, but by partnering with validation teams to decompose overall predictions into individual feature-level contributions; for example, feature attribution scores.
- Addressing Model Drift & Bias – Under EBA IRB guidelines, CIBs utilise ML challenger models such as Random Forests and Gradient Boosted Trees during annual reviews to validate traditional regression models and detect statistical bias or overfitting before capital calculations are affected.
Executive Takeaways
For senior IT leaders, CROs and digital transformation heads in European commercial banking, establishing resilient AI governance requires four decisive actions:
- Formalise Tiered HITL Escalation Matrixes – Define explicit operational thresholds where AI transitions from automated processing to mandatory human approval. Ensure that credit decisions affecting natural persons or commercial counterparties above defined exposure limits require documented human sign-off.
- Deploy Centralised AI Hubs to Eliminate Shadow AI – Establish a centralised CAIO function and AI model inventory. Mandate that all GenAI tools, LLM prompts and open-source ML libraries route through enterprise API gateways with automated audit logging, context verification and version control.
- Bridge AI Model Risk Management with BCBS 239 / RDARR – Upgrade data governance frameworks to track non-structured and high-velocity data inputs. Ensure every data input feeding credit decision engines links back to approved ‘golden data sources’ with clear ownership across all three lines of defense.
- Enforce Static Production Deployment with Continuous Drift Monitoring – Prohibit adaptive self-learning models in live banking environments. Combine static model weights with real-time monitoring dashboards and challenger models to detect performance drift, statistical bias or data anomalies.
Toward Auditable Autonomy: How AI Governance in European Banking May Mature by 2029
The evidence reviewed here suggests that European commercial banks have largely resolved whether to deploy AI in high stakes decisioning and now face the harder question of how to evidence control over it. With over 85% of large, supervised CIBs already deploying AI across core workflows, the central supervisory concern has shifted from model performance to governance, inventory and data provenance. Over the next one to three years, the practices that today distinguish Tier I institutions are likely to become the expected baseline across the sector.
Three developments appear probable. Specifically:
- Tiered HITL escalation is likely to move from internal policy to an auditable standard –Given that all surveyed institutions already maintain human oversight in credit scoring, supervisors may increasingly expect documented thresholds, sign-off records and evidence that autonomy is confined to low-value, standardised decisions;
- Centralised AI inventories and 'hub and spoke' oversight models are likely to become a precondition of operational resilience under DORA, as incomplete inventories remain a primary supervisory vulnerability.
- Data lineage may become the principal point of supervisory scrutiny, with 'golden data sources' and documented provenance extending from credit models to the generative and retrieval-augmented systems now entering production.
Explainability is also likely to mature. With fewer than half of supervised CIBs currently regarding their credit scoring AI as fully explainable, feature-level attribution and challenger-model validation may evolve from specialist techniques into routine components of model risk management.
Taken together, these shifts indicate that competitive advantage in the near term is unlikely to depend on the speed of AI adoption. It will depend on the ability to demonstrate, to supervisors and customers alike, that every automated decision is traceable, explainable and subject to effective human control.