Question 1

What is the EBA's core message about the relationship between the AI Act and existing financial regulation?

Accepted Answer

The EBA emphasizes that the AI Act is not a completely new compliance universe, but an additional layer on frameworks that have existed for years, such as CRR/CRD, DORA, PSD2, CCD2, MCD and the EBA Guidelines. It requires targeted integration, not parallel structures.

Question 2

Why does the AI Act classify AI systems for creditworthiness assessment and credit scoring as high-risk?

Accepted Answer

Annex III, point 5(b) explicitly places these systems in the high-risk category because credit decisions directly affect financial inclusion, discrimination, over-indebtedness, and the right to a dignified standard of living.

Question 3

What is the EBA's core message about the relationship between the AI Act and existing financial regulation?

Accepted Answer

There is no fundamental conflict between the AI Act and existing financial supervision law. The AI Act should mainly be 'woven into' existing governance, risk, and IT frameworks, rather than institutions having to build an entirely parallel system.

Question 4

For which AI Act requirement does the regulation NOT provide explicit derogation, but does the EBA point to extensive overlap with existing regulation?

Accepted Answer

Human oversight is an example where the AI Act does not provide explicit derogation, but the EBA shows that CRR provisions on stopping model use, documenting overrides, and IRB-RTS on human corrections already contain extensive requirements.

Question 5

Which existing regulation already covers, according to the EBA, most of the cybersecurity and business continuity requirements of the AI Act?

Accepted Answer

The EBA emphasizes that the DORA framework (Digital Operational Resilience Act) already extensively covers the cybersecurity and business continuity requirements of the AI Act.

Question 6

What should a bank NOT do, according to the EBA mapping, when implementing AI Act requirements for credit scoring?

Accepted Answer

Banks do not need to design a new quality management framework from scratch. They must expand their existing model governance, credit risk processes, and DORA-ICT frameworks and explicitly anchor AI requirements within them.

Question 7

Which CRR articles already largely cover the technical documentation requirements of Article 18 AI Act, according to the EBA?

Accepted Answer

CRR Articles 144 (documentation of rating system design rationale), 174 (model input data vetting, specification and testing), 175 (design and operational details of rating systems), and 452(f) (description of internal ratings process) already largely cover the technical documentation requirements.

Question 8

What is new in the AI Act compared to existing financial regulation, according to the EBA mapping?

Accepted Answer

New in the AI Act is the explicit requirement around AI literacy (Article 4). The EBA does link this to existing provisions on knowledge and competence requirements under CRD, CCD2, MCD, and the LOM Guidelines.

Question 9

How should banks handle DPIAs, FRIAs, and existing risk assessments, according to the EBA?

Accepted Answer

For banks, the challenge is not to treat DPIAs, FRIAs, and existing risk assessments as separate silos, but to establish an integrated assessment process in which both financial and fundamental rights risks are assessed.

Question 10

Which article of the AI Act requires the European Commission to issue Guidelines on the interplay between the AI Act and EU sectoral legislation?

Accepted Answer

Article 96(1)(e) AI Act requires the European Commission to issue Guidelines on the interplay between the AI Act and EU sectoral legislation, including EU banking and payments sector legislation. The EBA letter is addressed to the Commission to inform these Guidelines.

EBA AI Act Mapping Quiz