Insurance & Pensions in Germany

Key dates

01 February 2024

- Related BaFin/Bundesbank supervisory notice on cloud outsourcing (contextual reference)

18 December 2025

- Guidance issuance date

Suggested considerations

• Develop and approve AI strategy integrated with ICT roadmap and governance.
• Embed AI in existing ICT risk framework, ensuring lifecycle coverage with safeguards (e.g., testing, monitoring, decommissioning).
• Conduct third-party due diligence and contractual reviews for AI/cloud providers, including exit/portability testing.
• Implement AI-specific testing, documentation, and incident processes proportionate to criticality.
• Ensure management accountability for oversight, training, and interdisciplinary controls.

What changed

• The guidance does not introduce new binding rules but clarifies AI as ICT systems requiring DORA-compliant treatment, including:
• AI strategy: Management-approved, aligned with overall strategy, defining responsibilities, competencies, and interdisciplinary collaboration for critical functions.
• ICT risk management integration: Cover identification, protection, detection, response, recovery, training; apply to AI lifecycle (data acquisition, development, operation, retirement).
• Development and testing: Robust standards, documentation, testing proportionate to criticality; special focus on generative AI/LLMs, open-source, and code generation risks.
• Operational processes: Asset classification, monitoring, access controls, logging, anomaly detection, business continuity, secure decommissioning.