The European Central Bank has signalled a major change in AI oversight for banks: supervisors expect testing to focus on how AI behaves in production, not only on static model validation. This is a direct response to the risks posed by generative and agentic systems.
The New Frontier: Behavioural AI Testing in Banking
Traditional model validation measures statistical performance and bias on historical data. Behavioural testing observes an AI system’s actions across realistic scenarios to detect failures that conventional checks miss.
Why Behavioural Testing Matters
Generative AI and agentic systems can produce plausible but incorrect outputs, take multi-step actions, or interact unpredictably with users and systems. Those failure modes are not captured by offline metrics. Behavioural testing uses scenario-based probes, red teaming, adversarial prompts, and end-to-end transaction simulations to reveal hallucinations, logic drift, abuse vectors, and unsafe automation paths that only show up in interaction.
ECB’s Clear Mandate
The ECB has framed supervisory expectations around operational resilience and real-world behaviour. This aligns with DORA’s focus on ICT risk management and with TIBER-EU principles for threat-led testing. Regulators want evidence that institutions have assessed how AI performs under attack, during abnormal conditions, and over time. Supervisors will care more about continuous operational evidence than one-off model reports.
Action for Banks: A Lifecycle Approach
Banks must treat AI like software in production: build continuous monitoring, run automated behavioural test suites, and involve QA, risk and cyber teams from design through retirement. Practical steps include scenario libraries, synthetic user traffic, canary deployments, logging for chain-of-thought and prompts, incident playbooks, and vendor oversight for third-party models. QA teams must expand from metric validation to operational testing and ongoing assurance.
Conclusion: Testing Behaviour, Not Just Models
The message is urgent and non-negotiable. To meet ECB expectations and DORA obligations, banks must adopt continuous behavioural testing and operational governance so AI systems are monitored, tested, and controlled across their full lifecycle.
