AI in risk management

KPMG follows AI through each stage of the risk cycle. In identification it drafts process flows, spots emerging risks and maps them to the risk taxonomy and its controls. In assessment it proposes ratings and computes key risk indicators and residual risk. In monitoring it replaces point-in-time reports with continuous ones. In KPMG's Future of Risk survey, 400 executives ranked AI and generative AI as the leading technology for their added risk duties over the next three to five years.

KPMG Germany lists the risk types where companies use it: credit, market, fraud, operational and liquidity risk. Almost half of the companies in its AI in Finance study use AI to identify risks faster. In a bank the uses run from early-warning signals in the loan book to stress scenarios and the review of contracts with ICT providers.

The Bundesbank's page on machine learning methods lists three documents. A discussion paper on the use of AI and machine learning in the financial sector from November 2020 asked about explainability and data, BaFin published principles for the use of algorithms in decision-making in June 2021, and BaFin and the Bundesbank followed with a joint consultation paper on machine learning in risk models in July 2021. It covers both the models for regulatory capital and the internal models a bank uses to steer its risks.

In December 2025 BaFin added guidance on ICT risks in the use of AI systems, which treats an AI system as part of the ICT that DORA governs. A risk model built with machine learning therefore falls under two sets of rules: model risk management for what it predicts, and ICT risk management for how it runs.

KPMG counts the new risks that AI brings into the function among the challenges risk managers now face. A model can drift when markets change, and a model nobody owns can fail without anyone noticing. Banks keep an AI and model inventory and validate models before and after launch.

Model risk management in Germany covers the MaRisk validation duty and the ECB guide to internal models, and AI governance in banking covers who decides on a use case and who may switch a system off.

Credit, market, fraud, operational and liquidity risk are the types KPMG Germany lists. AI works best where there is a lot of data and a clear signal, such as payments, market prices or a large loan book. It has little to learn from for rare events that the history does not contain.

Only some uses are. Annex III of the AI Act lists credit scoring of natural persons and pricing in life and health insurance among its finance entries. A model for market or liquidity risk is not on that list, but it stays under MaRisk, DORA and the bank's model risk rules.