Why is governance on paper not enough?
Policies, training evidence and an initial inventory, with which many organisations start AI compliance, are necessary but not sufficient. The decisive question is whether the described processes actually work: is the inventory updated, are responsible persons trained, and can logs, decisions and controls be reconstructed?
Which authorities are responsible for AI in Austria's financial sector?
For high-risk AI generally the FMA (Art. 74(6) AI Act), alongside the RTR AI Service Desk, the DSB and the OeNB; formal designation was still pending on 20 October 2026.
| Body | Relevance for financial institutions |
|---|---|
| FMA | Sector-specific supervisor for banks, insurers and investment firms; AI governance may become relevant through existing supervisory and risk-management obligations. For high-risk AI directly linked to financial services, Art. 74(6) AI Act in principle makes the financial supervisor the market surveillance authority; Member States may deviate. The FMA has already been notified as a fundamental-rights authority under Art. 77 AI Act. The ECB is not a market surveillance authority under the AI Act, not even for significant institutions. |
| RTR AI Service Desk | Contact point and information hub for the AI Act under § 20c KOG and § 194a TKG. It is not a market surveillance authority: as of 20 October 2026 Austria had not yet designated the competent authorities under the AI Act, and the FMA describes the national implementing legislation as still outstanding. Responsibility must therefore be assessed case by case. |
| DSB | Data protection authority for personal data, DPIA, data-subject rights and data breaches. |
| OeNB | Relevant in reporting and stability contexts, although not a general AI market surveillance authority. |
What must be demonstrable for a review?
A robust chain of evidence, not one document: for deployers of high-risk AI systems, Art. 26 EU AI Act, sectoral supervisory obligations, GDPR, DORA and labour-law requirements sit next to each other.
- complete AI inventory including vendor AI, GPAI tools and shadow AI
- risk classification and role allocation for each system
- Art. 26 gap analysis for high-risk systems
- FRIA for the specific cases covered, especially Annex III 5(b) and 5(c)
- logging, log retention and human oversight
- authority contacts, escalation paths and reporting routes for the AI Act, GDPR, DORA, NISG 2026 and – for own products with digital elements – the CRA via the ENISA Single Reporting Platform (in force since 1 October 2026; entities already in scope must register with the cybersecurity authority by 31 December 2026, entities that fall within scope later within three months of meeting the conditions)
What does audit readiness require internally and externally?
Internally, current and findable documentation; externally, knowing which body handles which incident.
Internal dimension
Documentation must be current, findable and operationally reliable. Roles should be visible in processes, tickets, approvals and controls, not only in slide decks.
External dimension
The institution should know which body is relevant for which incident or request. This includes the FMA, DSB, the national AI Act responsibility after implementation, CERT.at or the cybersecurity authority, and internal first contacts.
What does the audit-readiness checklist cover?
Seven checks, from the inventory with owners through risk classification, human oversight and logs to reporting processes and the ArbVG check.
- AI inventory complete and assigned to owners
- risk classification documented and approved
- human oversight named, trained and demonstrably active
- logs and decision bases reconstructable
- FRIA and DPIA duties assessed separately but coordinated
- reporting processes for AI Act, GDPR, DORA and NISG 2026 include timelines
- ArbVG review documented for employee data and control systems
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).