Shipping AI to production behind BaFin, MaRisk and DORA

The stack, in one view

Four frameworks shape AI in DACH financial operations. BaFin's MaRisk sets minimum risk-management requirements for banks, including outsourcing and IT risk — an AI system that prepares decisions falls squarely inside its idea of a controlled process. DORA, the EU's Digital Operational Resilience Act, treats every critical ICT system — AI included — as something that must be resilient, tested and governed, with third-party providers documented. The GDPR governs the personal data most financial workflows inevitably touch. And the EU AI Act adds risk-tiered obligations, with credit scoring named a high-risk use — transparency, human oversight and documentation stop being nice-to-haves.

Read together, the message is consistent: you may automate the work, but you must be able to show how the system behaves, who oversees it, and what happens when it fails.

Retrofit is the expensive order

The common failure mode is sequencing: build fast, then "add compliance" before go-live. Retrofitting traceability into a system that never logged its reasoning means rebuilding it; bolting human oversight onto a flow designed to skip humans means redesigning it. The audit becomes an excavation.

Teams that ship in regulated finance invert the order. From the first sprint, every agent action writes an audit trail; every material decision has a named human owner; every model has documented governance; every workflow has a tested fallback. Compliance stops being a phase and becomes a property of the architecture.

What that means concretely

In the systems we build, it comes down to a standard kit: documentation, traceable decision paths, audit trails, model governance, risk controls, consent logging, explainability, data lineage and access control — present from the first commit, not appended for the auditor. Built this way, the regulator conversation changes character: instead of defending a black box, you walk through a system that was designed to be walked through.

Sequencing the move

Start where the regulatory surface is manageable and the leverage is real: back-office reconciliation, regulatory reporting preparation, claims and dispute handling. Prove the pattern — agent prepares, human decides, everything traced — then extend it toward the higher-stakes decisions. That sequence is one you can defend to the board and the regulator at every step.