BaFin has no rule written for AI agents, but its expectations already reach the people who oversee them. German supervised firms must have a proper business organisation, adequate staff with suitable qualifications, and clear responsibility for every decision. Once an agent drafts or executes work, the staff who review and stop it need provable competence for that task.
What does BaFin expect, in plain words?
German supervisory practice rests on a simple idea: a firm must be organised so that it can manage its risks. In substance that means sound risk management, clear allocation of responsibilities, enough staff with the right qualifications for the tasks they perform, and IT systems that are governed, tested and documented. Supervision has always looked at people as part of that organisation, not only at systems.
BaFin has also published supervisory thinking on algorithm-based decision-making. Its themes are familiar: responsibility stays with the firm's management, people must be meaningfully involved where decisions matter, results must be explainable to the degree the use requires, and the process must be documented. It does not ban automation. It asks who answers for it, and whether that person can, which is the core of AI literacy and certification for people who work with agents.
On top of national practice sit EU rules that BaFin supervises or applies. DORA, which applies across the EU from 17 January 2025, expects ICT risk management, incident reporting, resilience testing and third-party oversight, and includes staff awareness and training. The EU AI Act adds Article 4 on AI literacy and, for high-risk systems such as credit scoring of individuals, Article 14 on human oversight and Article 26 on deployer duties. The GDPR, including Article 22 on solely automated decisions, applies to the data.
Which firms and which people does this reach?
BaFin supervises banks, financial services institutions, payment and e-money institutions, insurers and investment firms. For the largest banks, ECB banking supervision leads, with BaFin taking part. The expectations above apply in proportion to size and risk, so a small payment institution and a large bank answer the same questions at different depths.
Inside the firm, five groups need distinct competence:
- Management board members, who remain responsible for decisions an agent prepares or executes.
- Reviewers, who approve or decline actions the platform holds for them.
- Process owners, who set each agent's limits within the firm's risk appetite.
- The second line, risk control and compliance, who test whether the human controls work.
- Internal audit, who must be able to reconstruct any decision from the record.
There is one German feature worth planning for early. Introducing systems that can monitor how employees work usually involves the works council, and an agent workspace that records every review decision by name is such a system. The AI Act's deployer duties also expect workers' representatives to be informed before a high-risk system is put into use at work. Bring the works council in with the training plan, not after it.
What changes when the system is an agent that acts?
German supervisors are used to models that score and people who decide. A governed agent shifts that line, because it can execute routine work within bounds at depth 3 or prepare payments and hard-to-undo actions at depth 4. The question "who decided?" now has a precise answer in the record: the verdict, the bound that decided it, and the named person who approved a held action.
That precision cuts both ways. If an approver had no relevant training, the record shows that too. Staff who oversee agents need to understand:
- Depth, and the depth each action needs, because one agent may read customer files at depth 1 and draft notices at depth 2.
- The minimum chain: role scope, the agent's certificate, its sources, the firm's own limits and the platform guardrails. The lowest bound wins, and the verdict names it.
- Held, refused and withheld are different outcomes with different responses. Only held actions are the reviewer's to decide.
- Certificate lapse: an agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day. Staff must be ready to take the work back.
How do you meet these expectations?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Adequate, qualified staff for each task | Approval rights at depth 3 and 4 tied to a current, role-specific credential | Credential register with expiry dates, matched to approvals in the record |
| Clear responsibility | Each agent capability has a named owner on the management side | Responsibility map signed by the board member concerned |
| Explainable, documented decisions | Reviewers trained to record a reason when they decline or edit a held draft | Decline reasons stored with each verdict |
| ICT awareness and training under DORA | Staff and board training covering agent incidents and escalation | Training records, incident drills, board minutes |
| Human oversight for high-risk uses under the AI Act | Oversight assigned to people with competence and authority to stop the agent | Assignment records, stop events and their timing |
Proving training is a common problem across financial firms; the patterns in how fintechs can prove staff are trained to oversee AI agents and how lenders can prove it apply equally in Germany.
What will a BaFin examiner or auditor ask?
Expect questions aimed at the people, not the model. Who in management is responsible for this agent? Which staff may approve its held actions, and what qualifies them? Show three declined drafts and the reasons given. What happened the last time the agent's certificate lapsed, and how long did manual processing take? How is the works council informed? Can internal audit reconstruct a decision from the record without calling the vendor?
Supervisors compare answers across firms, so the comparison with other markets is useful. RBI expectations for staff who oversee agents in Indian banks show the same pattern under a different regime: name the person, prove the competence, keep the record.
What do these expectations not cover?
They do not prescribe a course, a number of hours or a specific credential. They do not decide which depth an agent should hold; that judgement belongs to the firm, supported by evidence from the agent's own certification. National supervisory practice does not replace the GDPR, and data protection questions sit with the data protection authorities. Labour law questions around monitoring belong to employment counsel. Some programmes use external certification, such as Pryme Intelligence Academy's Operator credential, as one form of evidence, but the duty to judge competence stays with the firm.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does BaFin require AI-specific training for bank staff?
There is no standalone AI training rule from BaFin. The expectation comes from general organisational requirements, DORA's training duty and the AI Act's literacy article, which together make untrained oversight hard to defend.
Is the management board personally responsible for an agent's decisions?
Responsibility for the business organisation, including automated processes, stays with management. Board members do not need to operate agents, but they must understand them well enough to oversee the people who do.
How does the works council affect agent training?
Training plans that use review records to assess individuals touch on employee monitoring. Agree with the works council how review data is used, and keep training evidence separate from performance management unless that use is agreed.