90 per cent in operation: what the ECB’s AI figure measures and what it leaves open

On 22 September 2026, Claudia Buch, who chairs the Supervisory Board of the European Central Bank (ECB), spoke in Amsterdam at the annual conference of the Foreign Bankers’ Association of the Netherlands about digital innovation and banks’ business models. One paragraph of that speech contains the figures that have been quoted ever since: “More than 90% of banks supervised directly by the ECB already integrate AI into their operations, and 85% use generative AI, according to supervisory data.” The same paragraph names risk mitigation as the most important use case, with 64 per cent of banks using artificial intelligence (AI) against fraud and cybercrime. Nine days later, on 1 October, ECB President Christine Lagarde referred to the speech at the annual conference of the European Systemic Risk Board (ESRB) and wrote that nearly nine out of ten significant euro area banks use generative AI.

It is tempting to read figures like these as a progress report: banks have arrived at AI, and the topic is settled or at least on track. The supervisor’s own publications tell a soberer story. According to the ECB Banking Supervision newsletter published on 20 November 2025, 87 per cent of significant institutions were already using AI in 2023 and 88 per cent in 2024. The published rate, in other words, has sat in the same range for three years. What has grown is the use of AI where it supports decisions, for example in credit scoring, where the share of institutions more than doubled from 14 to 30 per cent. For that use, the supervisory texts set other yardsticks than the rate: the quality of data, evidence of benefit and the governance of individual applications. Their findings there sound far less comfortable than the headline figure. A speech is not a statistical release, and the supervisor did publish its denominator for 2023 and 2024. What follows reads the published supervisory texts side by side.

The published rate already stood at close to nine in ten banks in 2023

The supervisor collects data on banks’ use of new technologies every year. In its annual report on supervisory activities for 2025, the ECB describes an “annual data collection on digitalisation and the use of innovative technologies” that forms part of the short-term exercise (STE), a data request that supplements regular supervisory reporting. Results from it appeared in the Supervision Newsletter on 20 November 2025. The chart there shows the share of significant institutions using AI in 2023 and 2024, and its note gives the denominator, counted in significant institutions (SIs): “Based on the STE data from supervisory reporting of 107 SIs in 2023 and 110 SIs in 2024.” On that basis 87 and 88 per cent of institutions were using AI. In a speech on AI in the euro area on 23 March 2026, Christine Lagarde put the figure at “nearly 90 per cent of significant euro area banks”, with 2025 as the latest observation according to the note on her chart.

Between those data points sits a run of speeches with shifting wording. Patrick Montagner, a member of the ECB’s Supervisory Board, spoke on 3 February 2026 of “over 85% of the banks we supervise”. Pedro Machado, also a member of the board, put it on 24 February at more than 85 per cent of “large banks under European supervision” using AI “in some form”, and Frank Elderson, the board’s Vice-Chair, again said more than 85 per cent on 3 June. In September Claudia Buch spoke of banks that integrate AI “into their operations”. Whether “use in some form” and “integrate into operations” measure the same thing cannot be read from the published texts. The move from 85 to 90 per cent is therefore not an established increase, and it may simply reflect a change of wording. What is established is that, depending on the wording, the rate has stood at close to 90 per cent or above since 2023.

To be fair, the figure is a legitimate signal for the supervisor. If almost every bank uses AI, then AI is no longer a side issue and becomes part of every assessment of business model and operational risk, which is exactly how Claudia Buch uses it. Yet the rate only answers whether a bank uses AI somewhere. The rate does not say whether an institution with a single customer-service chatbot is counted differently from one whose credit decisions rest on models. Their path through the ECB itself shows how quickly such figures harden. Claudia Buch put generative AI at 85 per cent, and on 1 October Christine Lagarde, referring to her speech, wrote: “Nearly nine out of ten significant euro area banks use it”, meaning generative AI. That is loose rounding, defensible as such, but it shows how a figure without a denominator turns into a certainty.

The speech’s cost figures date from end-2021, and its AI figures carry no reference date

Alongside the AI figures, the 22 September speech contains three indicators of banks’ digitalisation. In Claudia Buch’s words, more than 80 per cent of supervised banks see process automation as an important way to reduce costs, banks invest an average of 2.8 per cent of their operating income in digital transformation projects, and around 5 per cent of their staff work on such projects. Footnotes 4 and 40 of the speech refer to slides published by ECB Banking Supervision on 15 February 2023 on its survey of digital transformation and fintech. The slides state the reference date plainly: “On average, banks invested 2.8% of their operating income in digital transformation projects in 2021”, and they describe this as “a very preliminary estimate of banks’ digital spending at the end of 2021”. The 80 per cent appears there as 83 per cent and the 5 per cent of staff as 5.2 per cent, again with data as at end-2021.

Anyone who has marked positions on a trading floor knows that a price without a valuation date means little. The speech’s cost figures do have a reference date, given in the footnote, and it is almost five years old. The AI figures carry no footnote in the published speech, and so no reference date, no denominator and no question. The documents reviewed for this article, from the 2025 annual report and the supervisory priorities for 2026 to 2028 to the aggregated 2025 SREP results, contain no more recent figure for digitalisation budgets or staff. Whether one exists cannot be told from the published texts. There is no need to read a deliberate choice by the speaker into this, and a gap in what has been published is the likelier explanation.

Nor is the gap peculiar to the ECB. In a short report on 25 September 2025, the European Banking Authority (EBA) wrote that it observes “92% of EU banks are currently deploying AI”, with 8 per cent testing or discussing use cases, and the short report again gives no sample or definition. Two European supervisors thus cite the same order of magnitude, and for the latest figures of both it has not been published what was counted. For banks that want to benchmark themselves, that limits what the figures can do. A rate without a published question gives a snapshot of the sector, but not a yardstick for one’s own institution.

AI in credit and fraud decisions has grown, and that is where scrutiny begins

The two applications that the November 2025 newsletter reports separately are more telling than the overall rate. According to its chart, the share of significant institutions using AI in credit scoring rose from 14 per cent in 2023 to 30 per cent in 2024, and in fraud detection from 36 to 62 per cent. For 2025 Christine Lagarde again gave 30 per cent for credit scoring and “more than half of banks” for fraud and cybercrime. Claudia Buch’s 64 per cent for “fraud and cybercrime prevention” sits in the same range, but it is worded differently and so is not a point in the same series. The pattern is clear all the same: from 2023 to 2024 the share of banks using AI barely moved, while the share using it in credit and fraud decisions rose markedly.

That is also where the law changes. The AI Act classifies systems that assess the creditworthiness of natural persons as high-risk under Annex III, and under Regulation (EU) 2026/1744, the digital omnibus adopted in July 2026, the obligations for such systems apply from 2 December 2027. The same annex expressly excludes AI systems used to detect financial fraud. The fastest-growing application is therefore outside these obligations, while credit scoring is inside them. The supervisor looked at both uses in workshops with 13 banks on credit scoring and fraud detection, and the annex to the newsletter records: “A ‘human in the loop’ remains central to banks’ processes”, but also “Interpretation of human in the loop is still varied, in some cases limited to explaining the credit decision to customer on demand.” Almost 80 per cent of the sample had begun assessing their readiness for the AI Act. The newsletter itself warns that findings from so small a sample “should not be generalised for the entire sector”.

One sentence in the same newsletter is more striking than any rate: “However, the financial quantification of realised benefits remains a challenge, echoing repeated findings from on-site inspections on banks’ ability to monitor the financial impact of strategic digital initiatives.” About half of the banks in the sample had introduced dedicated policies or committees for AI, and supervisors still see room for development in oversight by the second and third lines of defence. Pedro Machado set out the standard in February: “From a supervisory perspective, ambition is not a red flag. But unclear strategy and cost-benefit analysis of investment decisions is, because it results in poor steering of outcomes and risk-adjusted returns.” By that standard, broad use without a quantified benefit is a warning sign, and no evidence of progress. Citi’s agent platform shows what supervisors expect for a single material use case.

The British supervisors publish their sample and their definition

The Bank of England shows how a supervisor can answer the same question with its method on the table. Together with the Financial Conduct Authority (FCA), it published “Artificial intelligence in UK financial services – 2024” on 21 November 2024. The report gives the number of responses, “The survey received 118 responses”, broken down into six sectors, and it prints the definition that respondents were asked about: AI as “the simulation of human intelligence by machines” that can learn, decide and solve problems. The headline result sounds familiar. 75 per cent of responding firms use AI, a further 10 per cent plan to, and among international banks the figure is 94 per cent.

The difference lies in what comes next. The British report asks how much the applications matter and finds: “62% of all AI use cases are rated low materiality by the firms that use them with 16% rated high materiality.” It asks about understanding, and 46 per cent of firms said they understood the technologies they use only partly, against 34 per cent with complete understanding, which the report attributes largely to third-party models. Only 2 per cent of use cases take decisions fully autonomously. The earlier reports from 2019 and 2022, which still covered machine learning, wrote their limits into the text, in 2022 with the sentence that the sample and findings “should not be seen as representative”, based on 71 responses from 168 firms approached. The Bank of England has announced a fourth survey for this year. In a letter to the House of Commons Treasury Committee dated 1 April 2026, it also wrote that market participants had not yet adopted advanced forms such as generative or agentic AI in a way that would create systemic risk.

Admittedly, the British report is not directly comparable. Alongside banks it covers insurers, non-bank lenders, capital markets firms and market infrastructures, and it predates the Frankfurt figures. That is precisely why it is a useful benchmark for what a rate can tell us. The British figures on breadth are of the same order as the European ones, and only the questions on materiality, understanding and autonomy show how much of that breadth actually carries weight. In the ECB’s published texts, detail on the human in the loop and on governance structures exists so far only for the 13 banks in the workshops, and on materiality there is none. As part of a more targeted review of generative AI, the supervisory priorities for 2026 to 2028 announce the intention to develop “a supervisory stance on the materiality of these AI applications” as the basis for future reviews. The texts reviewed contain no such judgement so far.

For supervisors, what AI achieves depends on a bank’s data

In the second half of the same speech, Claudia Buch names a precondition that at first sight has little to do with AI. As the first element of a resilient digital strategy she names the quality of data. Strong capabilities for risk data aggregation and risk reporting (RDARR) determine, in her words, “how effectively banks can exploit AI and advanced analytics”. The supervisory priorities for 2026 to 2028 make the same point: “a strong RDARR framework positions banks to exploit digitalisation tools and technologies such as AI and advanced analytics.”

On precisely this foundation, supervisors report only slow and insufficient progress. The aggregated results of the 2025 SREP state: “In the area of risk data aggregation and risk reporting (RDARR), progress continues to be slow and insufficient.” As causes the report lists “a lack of prioritisation at the board level, inadequate data architecture and IT infrastructures, as well as deficiencies in data quality controls”, and it observes that many institutions focus more on the cost of remediation than on its benefits. The supervisory priorities note that the relevant average sub-score did not improve in the 2025 SREP compared with the previous year. In her speech Claudia Buch describes progress as “often too slow” and refers to a supervisory escalation strategy where material deficiencies are not addressed in time.

What this means in practice is set out in the ECB’s guide on risk data aggregation, published in May 2024. Supervisors observed “Large-scale miscalculations of key risk ratios and limits”, caused by reconciliation errors, manual adjustments and incomplete data, and “In many cases, production times of 40 or more working days were observed for monthly risk reports.” For a credit model meant to learn from new data, a monthly report that takes at least eight weeks would be a weak foundation. The guide places responsibility squarely on the management body, which bears “full responsibility for risk data quality and governance”, provides adequate resources and appoints one or two of its members to answer for it. A footnote describes the chief risk officer, alone or with the chief financial officer, as a pragmatic choice.

This leads to an uncomfortable reading of the 90 per cent. A bank can use AI in many places and still be one of the institutions whose risk data supervisors consider inadequate. Its use of AI then becomes broader without becoming more mature. Claudia Buch made the connection herself: “a bank with reliable data, modern infrastructure and effective governance will be better placed to identify valuable applications of new technology and to deploy them safely at scale.” For a board, the rate therefore does not show where the institution stands. What matters more is whether its own risk reporting is ready well within the 40 working days supervisors have observed, whether the benefit of its own applications can be quantified, and who on the board answers for it. Those are the questions that follow from the published supervisory texts, even though supervisors have not yet published a rate for them.

Recommendations

Glossary