AI in Banking: Governance, Models and Customer Outcomes
What this domain tests
The AI domain examines how banks adopt models without breaching conduct, data-protection or resilience rules. Questions focus on the EU AI Act risk tiers, GDPR automated decision-making, model risk management and the bank's accountability for vendor tools.
Core rules
- The EU AI Act bans unacceptable uses and treats creditworthiness and credit scoring as high-risk. High-risk systems need risk management, data governance, logging, technical documentation, human oversight and conformity assessment before deployment.
- GDPR Article 22 applies to solely automated decisions with legal or similarly significant effects. The customer needs meaningful information about the logic and a route to human intervention, not access to source code.
- Model risk management covers independent validation, data lineage, bias testing, performance monitoring and change control.
- Outsourced or cloud-hosted models remain the bank's responsibility; contracts must allow audit, regulatory access and exit.
Worked example
A bank's machine-learning model rejects a mortgage applicant. Because it assesses creditworthiness, it is high-risk under the AI Act. The bank must provide the main reasons for rejection in plain language, offer human review, retain decision logs, test for discriminatory outcomes and ensure the vendor contract supports audit. A letter saying only 'score too low' fails Article 22 and conduct expectations.
Traps that cost marks
- Treating every chatbot or fraud filter as high-risk.
- Confusing explainability with disclosure of the algorithm.
- Assuming a third-party model transfers accountability.
- Equating accuracy with fairness.
Exam focus
Link each control to a customer outcome and a named legal hook.