AI Agents in Financial Services: What Banks and Insurers Can Run Under EU Rules

AI agents in financial services run today on narrow, supervised back-office work: payment repair, trade exceptions, document checks and small insurance claims, with a person still releasing the money or deciding the payout. Credit assessment of natural persons and pricing in life and health insurance are high-risk under the EU AI Act, so autonomy there is hard. The two regulator documents we searched for agent terms, BaFin’s AI guidance and the European Supervisory Authorities’ statement on frontier AI models, contain no agent-specific text. We read that as agents falling under the existing rules according to what they are used for. Everything here is stated as of November 2026, and it is an engineering reading of those documents, not legal advice.

What banks and insurers have publicly deployed

The public record is thinner than vendor material suggests, and much of it is self-reported. This is what we could trace to a named source.

Almost every entry is a bounded process with a clear case definition, and the most concrete insurance example caps claims at AUD 500. The same Sibos recap by R. Beri (October 2026) reports that no live deployment releases payments unsupervised. It is a single newsletter, so treat that as an observation and not a census. And the European names here are large groups; the status of Deutsche Bank’s Ada was unclear in that recap, and we can point to no public agent deployment with figures at a German bank.

Reversals deserve equal attention. In July 2025 Commonwealth Bank of Australia cut 45 service roles, in a move linked to AI. On 21 August 2025 it admitted an error and apologised, and the FSU union called that a major win (Information Age). If the business case for an agent rests on headcount, test the claim on real volumes before anyone announces it.

Customer-facing bots carry a separate liability lesson. In Moffatt v. Air Canada (2024 BCCRT 149), a Canadian small-claims tribunal held the airline liable for negligent misrepresentation by its chatbot and rejected the argument that the bot was a separate entity. That case concerned a chatbot and an airline, and it binds no European court. Still, we would plan on the assumption that what a bank’s agent tells a customer is what the bank told the customer.

Use cases, by where the work sits

AI agents in banking and insurance fall into a few groups once you ask who bears the consequence of a wrong step.

Operations exceptions are the strongest group. Payment repair and trade exceptions have a defined error, a known fix space and a person who can release the result. The agent gathers data, proposes a correction and hands over a complete case.

Document work comes next: checks during onboarding, extraction for trade accounting, assembling a file for a credit officer or a claims handler. An error shows up as rework, provided somebody really does read the output.

Low-value insurance claims have one public example with a human decision at the end. Project Nemo’s design also shows how narrow “agent” can be in practice: one peril, one cap, seven agents around a human payout decision.

Fraud and financial crime alerts are a good fit for investigation support, where the agent collects evidence on an alert and writes a summary. Acting on the alert, for instance by blocking an account, is a different matter because a false positive lands on a customer.

Then come the cases that touch a decision about a person: lending, insurance pricing, investment advice. Regulation addresses these most directly.

What the regulator documents say about agents

Nothing specific, in the two documents we searched. A text search of BaFin’s Guidance on ICT Risks in the Use of AI at Financial Entities found no agent section, and a text search of the European Supervisory Authorities’ statement on frontier AI models, JC 2026 25 (31 July 2026), found no agent terms. We did not run the same search on the other documents named in this article, so we make no such claim about them.

That statement covers those documents only. We could not establish that no EU regulator has written about agents anywhere, and UK, US and international supervisors are outside this article.

In practice, we would expect a supervisor or auditor to start from the function the agent performs and the ICT system it runs on. The word “agent” gives you neither an exemption nor a separate category.

The EBA’s position points the same way. Its November 2025 factsheet found “No significant contradictions” between the AI Act and banking law and no “immediate need” for new or revised EBA Guidelines, while stating that the factsheet is neither guidance nor an official position. The EBA Chair’s letter of 21 November 2025 adds that there are no AI Act derogations for human oversight, data governance and cybersecurity, and that DORA “extensively covers” cybersecurity and business continuity. ESMA said in May 2024 that MiFID II duties remain in place when firms use AI in retail investment services.

DORA: treat the agent as an ICT system

DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. The two documents we searched contain no agent rule, so we treat an agent as ICT that the entity must manage.

Our practical reading is that three questions decide how heavy this gets, and we would answer them before the first prototype:

1. Does the agent support a critical or important function? BaFin’s guidance, discussed below, uses that distinction, and an agent inside payment operations is much closer to the line than a policy search tool.
2. What are the third-party dependencies? For an agent these include the model provider, the framework, each MCP server and any SaaS tool it calls. Your ICT risk and vendor management teams will want each one on their list, including the ones a developer added for convenience.
3. What happens when it fails? The manual process has to keep working with the agent off, and somebody must be able to switch it off without a release.

For the threat side (injection, tool poisoning, credentials) see our article on AI agent security. We will not repeat it here, apart from one point that matters more at a bank: given the EBA’s remark on DORA’s coverage of cybersecurity and business continuity, we would treat a security failure in an agent as an operational resilience question as well.

EU AI Act: high risk depends on use

Two entries in Annex III matter most for this sector. Point 5(b) covers AI systems that evaluate the creditworthiness or credit score of natural persons, except systems used to detect financial fraud. Point 5(c) covers risk assessment and pricing in relation to natural persons in life and health insurance. We read those from an Annex text mirror that does not show any Omnibus changes, so confirm the wording against the Official Journal.

Some consequences follow from the wording, and each is a question to put to counsel:

• General statements that “insurance pricing is high-risk” overreach. The text names life and health. Motor and property pricing are not named in 5(c), though other rules still apply to them.
• The credit entry concerns natural persons. A corporate credit memo is outside its wording, while a sole trader may not be.
• A fraud detection system is outside 5(b). That exception says nothing about what an agent may do to the account afterwards, or about data protection.
• Human sign-off at the end does not by itself show that an agent preparing a credit file is outside 5(b). We would not assume so without advice.

Dates

The European Commission confirms the Digital Omnibus dates in the table. The regulation number and Official Journal date rest on secondary sources: Cooley (3 August 2026) and the NicFab blog (24 July 2026) give Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026. We could not read the Official Journal text directly.

Art. 50 matters for anything customer-facing. Our AI agent development article explains what the disclosure means for an agent. Separately, a credit agent also raises GDPR Article 22 on automated individual decisions, covered with DPIA and works council steps in our process article.

BaFin and the German rules

BaFin’s published material gives direction without setting expectations, and it is worth reading the status lines closely. The Guidance on ICT Risks in the Use of AI at Financial Entities (first published 18 December 2025, English version 23 January 2026) calls itself “non-mandatory”, and says it is neither a binding interpretation of DORA nor a statement of supervisory expectations. So a project plan should not claim “BaFin requires X” on the strength of this document.

It does say AI in critical or important functions needs more controls than self-service assistants under full human supervision, and it includes a case study of an LLM assistant. An agent with write access to a payment or core banking system sits further along that scale than the assistant in the case study. That last step is our inference, because the guidance has no agent section.

On the AI Act itself, a July 2026 BaFin interview describes the mandate as Überwachung, as opposed to Aufsicht, carried out through spot checks. High-risk monitoring starts in December 2027, and bank credit assessment of natural persons is the high-risk example given. AI used in HR falls to the Bundesnetzagentur, so a bank can have two authorities looking at two different agents.

MaRisk is the German text closest to the model layer. The 9th amendment, Rundschreiben 06/2026 (BA) of 30 June 2026, covers “künstliche Intelligenz” in AT 4.3.4 on models and asks for explainability. AT 7.2 is retained, DORA-covered ICT services fall outside AT 9, and directly ECB-supervised institutions leave its scope. We are not giving an application date, because we could not confirm one from a primary source; read it from the circular. Whether an agent as a whole counts as a model under AT 4.3.4 is not something we can settle from what we read. We would document it as if it does, at least for any step that influences a risk decision: which model, which version, what inputs, and why this output.

BAIT is on its way out. The Bundesbank says it is fully repealed at the end of 31 December 2026; DORA-scope institutions are already excluded, and further non-CRR institutions move to DORA on 1 January 2027. An agent project planned today should not build its control mapping on BAIT.

BaFin’s material is addressed to financial entities in general, but MaRisk and BAIT are banking texts, so insurers should not map these two across. We have not reviewed the equivalent insurance circulars for this article.

Realistic now, and what regulators make hard

This is our judgement, and your supervisor and counsel may place a given case differently.

For hard cases, a conventional, validated model is often the correct tool already. Credit scoring is a prediction problem and rarely benefits from an open-ended tool loop. Our credit scoring project was machine learning work, not an agent, and that is usually the right shape for this type of task.

Building an agent that survives a review

A review in a regulated firm goes better when the file answers specific questions without an engineer in the room. These decisions shape that file.

The approval point follows from the risk. OpenAI’s A practical guide to building agents names payments and large refunds among high-risk actions that are “sensitive, irreversible, or have high stakes”, which fits what the public deployments do: a person holds the release. Make the approval meaningful, with the exact payment instruction or claim decision displayed, and record who approved and what they saw.

Keep the record per case. For each run: the input, retrieved documents, each model and tool call, model version, policy decisions and the human action. Reviewers can then reconstruct one case months later, which also gives you the material for explaining a model-driven step.

Measure against the current process. Allianz’s 80% figure is a statement about time on one claim type. Your own number needs a baseline taken before the pilot and an error rate alongside it. Our article on AI agents for business has a scoring table for choosing the first case.

Frequently asked questions

Are there EU rules written specifically for AI agents in finance?

Not in the two documents we searched: BaFin’s AI guidance and the ESAs’ JC 2026 25 statement. We make no claim about other documents.

Is credit scoring with an AI agent high-risk?

Evaluating the creditworthiness or credit score of natural persons is listed in Annex III 5(b), whatever the architecture. The European Commission gives 2 December 2027 as the application date for Annex III obligations.

Is all insurance pricing high-risk under the AI Act?

No. Annex III 5(c) names risk assessment and pricing in life and health insurance. Other lines are not named there, though other rules apply to them.

Has BaFin set expectations for AI agents?

Its AI guidance calls itself “non-mandatory” and says it sets no supervisory expectations, and it has no agent section. It does say AI in critical or important functions needs more controls than self-service assistants under full human supervision.

Which AI agent use cases in banking are realistic today?

Payment repair, trade exceptions and document checks, with a person releasing or approving the result. The Sibos 2026 recap we cite reports no live deployment that releases payments unsupervised.

Working with AI Superior

AI Superior is an AI engineering company in Darmstadt, Germany, founded in 2019 by AI scientists. We build LLM applications, RAG systems and AI agents for B2B clients. For sector context, see our pages on AI in finance and AI in insurance. To scope an agent for a supervised process, start with our AI agent development services.

Sources and further reading

• Regulation (EU) 2022/2554 (DORA); EIOPA, Digital Operational Resilience Act page.
• Annex III of the EU AI Act, text mirror at artificialintelligenceact.eu (does not show any Omnibus changes).
• European Commission, regulatory framework for AI page, Digital Omnibus dates.
• Cooley, note on the Digital and AI Omnibus, 3 August 2026; NicFab blog, 24 July 2026.
• BaFin, Guidance on ICT Risks in the Use of AI at Financial Entities, 18 December 2025, English version 23 January 2026.
• BaFin, interview with Obermöller on the AI Act, 29 July 2026.
• BaFin, Rundschreiben 06/2026 (BA), 9th MaRisk amendment, 30 June 2026.
• Deutsche Bundesbank, page on BAIT and DORA.
• EBA, factsheet on AI Act implications for the EU banking sector, November 2025; letter from the EBA Chair, 21 November 2025.
• ESMA, statement on AI in retail investment services, 30 May 2024.
• European Supervisory Authorities, Toward a consistent and risk-based approach for ICT risks from frontier AI models, JC 2026 25, 31 July 2026.
• CNBC, report on BNY, 9 February 2026.
• American Banker, report on Goldman Sachs, 13 February 2026.
• The Fintech Times, report on Lloyds Banking Group, 5 February 2026.
• Beri, R., Sibos 2026 recap, 2 October 2026.
• Allianz, article on Project Nemo, 3 November 2025.
• Information Age, report on Commonwealth Bank, 2025.
• Moffatt v. Air Canada, 2024 BCCRT 149; McCarthy Tétrault summary, 19 February 2024.
• OpenAI, A practical guide to building agents, 2025.