Strategic Enterprise Risk Management

AI governance does not replace what banks already do well. It builds on it. This article shows how data governance, model governance, and internal governance combine into a framework that satisfies supervisors and enables AI at scale: from dataset suitability and continuous monitoring to accountability across the three lines of defense.

The 9th MaRisk Amendment is final: more proportionality, SNCI reliefs, new size categories. All changes, deadlines and an implementation roadmap to 2027.

The EU Benchmarks Regulation has acquired another layer. On 5 May 2026, ESMA published new Guidelines on Internal Controls that apply from 1 October 2026 — the latest step in a regulatory story running straight back to the LIBOR scandal. Here's what benchmark administrators and credit rating agencies now have to demonstrate.

The draft 2027 EBA stress test introduces a dedicated climate risk module, layering transition and flood shocks onto the adverse macro-financial scenario. It leaves capital ratios untouched for now, but it produces exactly the kind of supervisory dataset that shapes future cycles, so the draft is best treated as a dry run.

For two decades, the performance of banks' PD models stayed inside confidential supervisory channels. The EBA's April 2026 Staff Paper changes that — applying systematic PD model backtesting across EU IRB banks, sharpening the binomial test for both asset and serial correlation, and putting a Tier 1 capital number on the result.

The credit risk function of 2026 looks materially different from the one most banks still operate. Here are the five shifts, from generative AI to ESG integration, that risk managers should plan for now.