Two loan applications, identical data, one name is Ahmed, the other Stefan. The AI rejects Ahmed. It is exactly for cases like this that the EU AI Act, BaFin, DORA and MaRisk exist. Why banks still work through Excel spreadsheets for this today and how we solve it digitally.
A turbulent week in Frankfurt, lots of appointments, and I am taking you along. We are an IT company that builds software at corporate level, huge platforms and enterprise applications, with our own tools in use at clients. For some years now we have turned our focus strongly to artificial intelligence, like many others. But we chose a clear niche: controlling AI in regulated environments. Banks, insurers, the public sector, everywhere a higher authority demands control.
On the road in Frankfurt, June 2026: What the EU AI Act means for banks and what we are building from it.
Why data protection carries a different weight in Europe
AI is being used more and more, first by end users with all the tools, then in a corporate context. And in Germany and the EU, data protection has a completely different significance than in the US or in Asian countries. That is why the EU introduced the EU AI Act: rules for how an AI, put simply, has to behave. To be able to work in this field, you first have to understand what this regulation actually means.
Ahmed and Stefan: The example that explains the EU AI Act
Imagine a bank has introduced an AI that makes loan decisions automatically. Two people each apply for 100,000 euros. One is called Ahmed, the other Stefan. All the data is identical, maybe one of them is six months younger. Ahmed is rejected, Stefan is approved. The problem: This decision has to remain traceable. Why did the AI reject him? If the bank trained its model on historical data and the model learned that Ahmeds were rejected more often, that is clear discrimination. Technically this is called bias.
Detecting bias. If there is a bias, a human has to step in. That is called human in the loop.
Traceability. The EU AI Act requires that an AI’s decision can be explained in the end, including the question of whether and how a human was involved.
Supervision. Above every bank stands BaFin. It checks whether the bank works properly, and with that whether the AI decided correctly and whether a human was able to trace the rejections.
That is the EU AI Act in one example. There are many more rules, which I will go into in a video of its own. What the framework means in concrete terms for agents in banks, I described in my post on agentic AI governance under BaFin and the EU AI Act (German).
No more Excel: How we digitise regulation
Alongside the EU AI Act there is DORA for the security of IT systems and MaRisk as the minimum standards every bank has to meet. We take these regulatory requirements and have built a layer, a tier that sits above the AI. Every AI model has to register with our system. After that we can trace every single step the AI takes and know exactly what is happening there. Everything stays secured and audit-ready.
Why that is necessary is visible in many banks today: Bank representatives sit there going through requirements by hand, with Excel spreadsheets. Met, not met. When the audit comes, you show the spreadsheet and say: Here, we have met this, do your audit. That costs an enormous amount of time and above all money, which can be saved if you transfer it sensibly into a technical layer. In my view that is the future of AI in regulated environments. How this layer works in detail, I explain in my post on AI control and our governance layer (German).
Healthy growth and a system for the US
Alongside the regulated environment, there are projects running at large corporations. We are currently expanding a huge system for a company from the US, where I will probably be in August. Until then there are plenty of appointments. We are growing well, but we are deliberately growing cleanly and safely, not too fast, so that we keep ourselves under control. Better quality and a sound foundation than fast, fast, fast. We are now around 30 people, we are very selective about who we hire, and we have the strongest consultants and developers you can imagine. That is what sets us apart.
Entrepreneur or self-employed: Why next week it is off to Dubai
A few days later, different day, different place. As an entrepreneur you travel a lot, and there is a difference between an entrepreneur and someone who is self-employed. In German, self-employed is “selbstständig”, which literally reads as “self” and “constantly”: constantly working yourself, in the company instead of on the company. In my case there is the SFM Holding, with SIFAMO as the IT company underneath it and SIFAMO Events, which hosted the summit in Dubai. That is how I build further companies.
That is also the reason I have to go to Dubai next week. Government representatives there have asked whether we can run the 2027 summit together. All depending on the situation and the global political climate, as we all know. How that trip went, you can read in my post Invest in Dubai now? (German). How does the AI audit work in your organisation, Excel or a system? Tell me on LinkedIn or below the video on my YouTube channel.
Frequently asked questions
What does the EU AI Act demand of banks?
That AI decisions affecting people, such as lending, are traceable, checked for bias and, where necessary, reviewed by a human. Documentation and explainability are mandatory, and BaFin monitors compliance.
What is bias in AI?
A systematic distortion that a model picks up from its training data, for example when historical rejections of certain groups lead to new rejections even though the factual data is identical. Bias is the most common reason a human in the loop becomes necessary.
How do DORA and MaRisk fit in?
DORA ensures that the IT systems of financial companies remain resilient and secure, MaRisk sets the minimum requirements for risk management. Together with the EU AI Act they form the framework that a governance layer maps technically.
Two loan applications, identical data, one name is Ahmed, the other Stefan. The AI rejects Ahmed. It is exactly for cases like this that the EU AI Act, BaFin, DORA and MaRisk exist. Why banks still work through Excel spreadsheets for this today and how we solve it digitally.
A turbulent week in Frankfurt, lots of appointments, and I am taking you along. We are an IT company that builds software at corporate level, huge platforms and enterprise applications, with our own tools in use at clients. For some years now we have turned our focus strongly to artificial intelligence, like many others. But we chose a clear niche: controlling AI in regulated environments. Banks, insurers, the public sector, everywhere a higher authority demands control.
Why data protection carries a different weight in Europe
AI is being used more and more, first by end users with all the tools, then in a corporate context. And in Germany and the EU, data protection has a completely different significance than in the US or in Asian countries. That is why the EU introduced the EU AI Act: rules for how an AI, put simply, has to behave. To be able to work in this field, you first have to understand what this regulation actually means.
Ahmed and Stefan: The example that explains the EU AI Act
Imagine a bank has introduced an AI that makes loan decisions automatically. Two people each apply for 100,000 euros. One is called Ahmed, the other Stefan. All the data is identical, maybe one of them is six months younger. Ahmed is rejected, Stefan is approved. The problem: This decision has to remain traceable. Why did the AI reject him? If the bank trained its model on historical data and the model learned that Ahmeds were rejected more often, that is clear discrimination. Technically this is called bias.
That is the EU AI Act in one example. There are many more rules, which I will go into in a video of its own. What the framework means in concrete terms for agents in banks, I described in my post on agentic AI governance under BaFin and the EU AI Act (German).
No more Excel: How we digitise regulation
Alongside the EU AI Act there is DORA for the security of IT systems and MaRisk as the minimum standards every bank has to meet. We take these regulatory requirements and have built a layer, a tier that sits above the AI. Every AI model has to register with our system. After that we can trace every single step the AI takes and know exactly what is happening there. Everything stays secured and audit-ready.
Why that is necessary is visible in many banks today: Bank representatives sit there going through requirements by hand, with Excel spreadsheets. Met, not met. When the audit comes, you show the spreadsheet and say: Here, we have met this, do your audit. That costs an enormous amount of time and above all money, which can be saved if you transfer it sensibly into a technical layer. In my view that is the future of AI in regulated environments. How this layer works in detail, I explain in my post on AI control and our governance layer (German).
Healthy growth and a system for the US
Alongside the regulated environment, there are projects running at large corporations. We are currently expanding a huge system for a company from the US, where I will probably be in August. Until then there are plenty of appointments. We are growing well, but we are deliberately growing cleanly and safely, not too fast, so that we keep ourselves under control. Better quality and a sound foundation than fast, fast, fast. We are now around 30 people, we are very selective about who we hire, and we have the strongest consultants and developers you can imagine. That is what sets us apart.
Entrepreneur or self-employed: Why next week it is off to Dubai
A few days later, different day, different place. As an entrepreneur you travel a lot, and there is a difference between an entrepreneur and someone who is self-employed. In German, self-employed is “selbstständig”, which literally reads as “self” and “constantly”: constantly working yourself, in the company instead of on the company. In my case there is the SFM Holding, with SIFAMO as the IT company underneath it and SIFAMO Events, which hosted the summit in Dubai. That is how I build further companies.
That is also the reason I have to go to Dubai next week. Government representatives there have asked whether we can run the 2027 summit together. All depending on the situation and the global political climate, as we all know. How that trip went, you can read in my post Invest in Dubai now? (German). How does the AI audit work in your organisation, Excel or a system? Tell me on LinkedIn or below the video on my YouTube channel.
Frequently asked questions
What does the EU AI Act demand of banks?
That AI decisions affecting people, such as lending, are traceable, checked for bias and, where necessary, reviewed by a human. Documentation and explainability are mandatory, and BaFin monitors compliance.
What is bias in AI?
A systematic distortion that a model picks up from its training data, for example when historical rejections of certain groups lead to new rejections even though the factual data is identical. Bias is the most common reason a human in the loop becomes necessary.
How do DORA and MaRisk fit in?
DORA ensures that the IT systems of financial companies remain resilient and secure, MaRisk sets the minimum requirements for risk management. Together with the EU AI Act they form the framework that a governance layer maps technically.
Related: AI Governance · EU AI Act
Recent Posts
Recent Comments