A Keynote Published by ECB Banking Supervision Says AI Does Not Dilute Responsibility, and If Anything Raises the Bar

ECB Banking Supervision published a keynote speech titled Technology is neutral, governance is not, given on February 24, 2026, on the adoption of AI in banking "from a supervisory perspective." It is a speech, not a rule or a guide. Parts of it follow, not the whole.

ECB Banking Supervision's annual data collection on innovative technologies across large banks under European supervision, the speech says, "shows that more than 85% of them already use AI in some form." Supervisory attention, it says, has traditionally focused on AI in areas such as credit risk assessment, fraud detection and transaction monitoring. In February, the speech said AI, and especially generative AI, was increasingly being deployed in IT operations, in legal and document analysis, and in front-line applications such as customer support, relationship management and internal knowledge tools.

Accountability, Oversight and Challenge

On governance, the speech says supervisors have seen encouraging developments as banks have put in place AI policies, dedicated committees or centers of expertise and clearer internal processes for approving and deploying AI use cases. That said, it said governance "remains uneven across institutions and use cases," and that banks still needed to do more in three main areas: "clear and unambiguous accountability for AI-driven decisions," effective senior management oversight, and "robust challenge mechanisms have to be in place, involving risk management, compliance and internal audit."

One concern the speech says supervisors continue to encounter is fragmented ownership, "with responsibility split across IT, data science teams, business lines and control functions, without a clear accountability framework." From a supervisory standpoint, it calls this problematic. "AI does not dilute responsibility. If anything, it raises the bar."

Fragmented ownership is a question about people, not models. Could a bank point, for each AI use case, to who answers for the decisions it drives?

The speech asks for AI to be governed "as a core business and risk topic, not as a technology side project." That includes the risks from AI use being clearly reflected in the risk appetite, decisions on material AI use cases being subject to appropriate pre-implementation assessment and "robust risk assessments performed by the second line of defence," and post-implementation monitoring and internal reporting that allow senior management to retain effective oversight.

Risk Management Frameworks

On risk management frameworks, the speech says three areas warrant particular attention. The first is explainability, which it says "is not just a matter of offering technical explanations or model documentation." It is about ensuring that decision-makers understand what drives model outputs, that risk managers can challenge them, that internal auditors can independently review them and that senior management can take responsibility for how they are used. "If a bank cannot explain why an AI model behaves the way it does, in terms that are meaningful for decision-making, then it cannot truly control that model."

The second is model governance and lifecycle management. AI models, particularly machine learning-based ones, "can evolve over time as data change," and the speech says that makes monitoring, validation and change management more complex. Supervisory concerns about model management, it says, become even more relevant "to ensure that model performance can be monitored continuously and to detect drift and unintended effects, with clear escalation and remediation processes in place for when models behave unexpectedly." The third is data quality and data governance, where representativeness, lineage and safeguards against bias "are all critical."

A Step Change in Dependencies

Generative AI, the speech says, brings a step change in dependencies. Such systems "are often sourced from a small number of major third-party providers," rely heavily on cloud infrastructure, and are built on large general-purpose models that are not fully transparent to users. From a supervisory perspective, that raises concerns about concentration risk, vendor lock-in, data confidentiality and security, operational resilience and exit strategies, as well as legal and reputational risks.

Generative AI, the speech says, "sits at the intersection of technology risk, operational resilience and strategic dependency risk." It gives that as one reason why supervisors intend to take a more targeted approach to generative AI applications in the future.