ECB AI governance expectations: is your inventory audit ready?

TL;DR: AI governance in European banking has moved from background concern to a core expectation, with inventories, ownership, lifecycle tracking, and audit trails now central to inspection readiness, according to Saidot’s analysis of ECB supervisory priorities. The practical test is no longer whether banks have AI policies, but whether they can prove control over every system in use.

Editorial analysis by NHI Mgmt Group, based on content published by Saidot: “What the European Central Bank expects from your AI governance from inventory to audit readiness”.

By the numbers:

• In November 2025, the ECB moved AI-related strategies, governance, and risk management from Priority 3 to Priority 2 in its 2026–2028 supervisory cycle.
• The ECB reported that AI use cases, particularly in credit scoring and fraud detection, grew significantly between 2023 and 2024.

Key questions

Q: How should banks govern AI in corporate lending without losing auditability?

A: Banks should place AI inside a controlled workflow rather than outside it.

Q: Why do AI inventories fail when organisations track only models?

A: AI inventories fail when they track only models because the real governance object is the system, not a single algorithm.

Q: What are the signs that AI governance evidence is too weak for an audit?

A: Weak evidence usually shows up when teams can only explain intent, not activity.

Practitioner guidance

• Centralise the AI system inventory Record every AI system, including embedded and third-party AI, with owner, lifecycle stage, risk class, intended use, and linked components.
• Map governance to the Three Lines Model Define first-, second-, and third-line responsibilities for registration, challenge, approval, monitoring, and independent audit of each AI use case.
• Attach evidence to each control decision Store risk assessments, control assignments, review outcomes, and sign-offs in one traceable record so the governance trail survives inspection.

Bottom line: The ECB's supervisory stance shows that AI governance in banking is now judged on traceable control, not policy intent.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →