This guidance document serves as non-mandatory advice. It is designed to help financial entities (in particular CRR institutions and Solvency II insurance undertakings) to implement the relevant regulatory requirements under the Digital Operational Resilience Act (DORA)1 when using artificial intelligence (AI).2
In particular, it addresses ICT risk management and ICT third-party risk management, including the Delegated Regulation on ICT risk management3 (RTS RMF) and the Delegated Regulation on subcontracting of ICT services supporting critical or important functions (RTS Subcontracting)4.
This guidance is therefore aimed in particular at those entities supervised by BaFin that are required to comply with the ICT risk management requirements set out in Articles 5 to 15 of DORA. The requirements for the simplified ICT risk management framework (Article 16 of DORA) must be considered separately and are not the subject of the present analysis.
Among other things, the guidance is based on discussions with financial entities and does not constitute a binding interpretation of DORA by BaFin.
Financial entities are deploying AI along their entire value chain. They are doing so for a variety of reasons: a key driver for the use of state-of-the-art AI technology is the desire to achieve greater efficiency and optimised processes; likewise, complex mathematical models enable risks to be assessed more accurately. To illustrate the range of applications for AI at credit institutions and insurance undertakings, it is useful to examine examples from the value chains of these entities.
Credit institutions are using AI in sales to predict customer migration. In lending operations, AI applications can help staff review annual financial statements. In fund management, AI is being used to summarise large volumes of analyst reports on investment instruments.
Insurance undertakings are using interactive AI assistants (chatbots) in sales and customer communication to inform employees or customers about product features. Product pricing can be tailored more precisely to the insured risks by means of complex models and, potentially, using real-time data (dynamic pricing or telematics). In underwriting, AI applications can support risk assessment. Automated input management allows a large number of incoming documents to be routed efficiently. In claims administration, insurers are using AI applications to support loss adjusters in claims adjustment, for example in the automatic payment of small claims. Furthermore, AI applications are being used to detect fraud in claims processing. Currently, applications dominate in areas where the greatest efficiency gains can be achieved, i.e. in particular in customer communication, claims administration and claims processing.
In compliance functions, AI is being used to monitor regulatory developments. Corporate communications can use AI to automatically create social media posts. AI is also being used in risk models to more accurately determine capital requirements.
The widespread use of AI assistants is also evident. These are mostly large language models that process and generate unstructured data, such as text and images. Such assistant systems can be used across a wide range of applications, for example to create presentations, source code or videos.