News
Germany Gives BaFin Power to Police AI in Banks, Poland Prepares Own Oversight
Since July 29, Germany's financial regulator BaFin has been able to inspect and penalize banks and insurers over improper use of artificial intelligence. Poland is following a similar path, building its own oversight body, KRiBSI.
Contents
Germany's financial regulator BaFin has held formal powers since July 29, 2026 to check how banks and insurers use artificial intelligence. The new rules let the authority examine algorithms that decide credit approvals, insurance premium amounts, and how a company's chatbot tells a customer they are talking to a machine.
What BaFin Will Check
The German regulator's new powers stem from the EU's AI Act, but the national law spells out how BaFin is to enforce it in practice. The authority will not audit every AI system at every institution, but will instead examine samples of applications in areas considered most sensitive for customers.
Jens Obermöller, BaFin's director general for cyber and technology risk in the financial sector, said the regulator will focus on the direct link between AI and regulated financial activity. That includes, among other things, systems that calculate individual premium surcharges based on customer data.
People have to be able to trust that their fundamental rights will be protected when AI is used. BaFin will ensure, for example, that everyone has fair access to financial services and that no one is discriminated against as a result of AI - Mark Branson, President of BaFin
The regulator has the power to impose financial penalties on institutions that violate bans on AI practices, for example collecting and analyzing sensitive personal data in ways that put customers at a disadvantage. High-risk systems as defined under the EU AI Act remain a separate category, which BaFin will only start supervising from December 2027.
Poland's Supervision Model
Poland is taking a similar path, though with a different timeline and a different institutional structure. The draft law implementing the EU AI Act envisions creating the Commission for the Development and Security of Artificial Intelligence, known as KRiBSI, as the central body overseeing compliance of AI systems with national and EU regulations.
The commission is to be headed by a chairperson appointed by the Sejm (the lower house of Poland's parliament) with the Senate's consent, supported by two deputies. Its membership will include representatives of institutions that already supervise individual market sectors, including UOKiK (the consumer and competition authority), UKE (the telecoms regulator), KNF (the financial supervision authority), and KRRiT (the broadcasting regulator). A Social Council for Artificial Intelligence, made up of nine to fifteen members, is also meant to provide advice.
KRiBSI is set to receive powers similar to those BaFin already exercises in Germany: accepting individual complaints about AI systems, carrying out inspections, opening proceedings over violations, imposing financial penalties, and issuing orders to pull non-compliant systems from the market. The commission is also expected to run regulatory sandboxes to support the rollout of innovation.
Timeline Divergence
The biggest difference between the two countries concerns the pace of implementation. Germany rolled out oversight of current AI applications in banking and insurance almost immediately, giving itself extra time only for high-risk systems, until December 2027. In Poland, sector-specific rules on safety and financial market oversight of AI are not set to take effect until August 2, 2028, while high-risk systems will come under supervision from December 2, 2027.
Marcin Czugan, president of the Polish Financial Institutions Union (Związek Przedsiębiorstw Finansowych), stresses that oversight of AI in finance must be coordinated with the existing sectoral supervision system so that no jurisdictional confusion arises between the new body and institutions such as the Polish Financial Supervision Authority (KNF).
What It Means for Polish Firms
For Polish banks, insurance companies, and fintechs, the German precedent already carries practical weight today. It shows which specific areas of AI use in finance regulators across the European Union treat as priorities: credit scoring, insurance risk pricing, and transparency in customer communication through bots and virtual assistants.
Financial institutions operating in several EU countries will have to reconcile differing implementation speeds of national rules built on a single shared base regulation. Companies planning to expand into the German market should expect that BaFin can already demand explanations about their algorithms, while equivalent questions from the Polish regulator will come later.
