DYNAMIC CAPITAL REQUIREMENT SYSTEMS USING ARTIFICIAL INTELLIGENCE IN BANKING – SPAIN: LEGAL THEORY, REGULATORY FRAMEWORK AND CASE LAWS

1. INTRODUCTION

Dynamic Capital Requirement Systems using Artificial Intelligence (AI) represent an emerging approach to banking regulation, financial risk management, and prudential supervision. These systems use machine learning, predictive analytics, automated risk assessment, and advanced financial modelling to evaluate changes in banking risks and support decisions concerning capital adequacy.

In Spain, the legal framework governing AI-assisted capital management is shaped primarily by European Union banking legislation, European Central Bank supervision, Banco de España regulations, and international Basel standards.

Traditional capital adequacy systems rely on regulatory formulas, risk-weighted assets, supervisory assessments, and prescribed capital buffers. AI-based dynamic systems seek to improve the frequency, accuracy, and responsiveness of risk measurement.

Such systems may analyse:

Credit risk and probability of borrower default.

Market volatility and interest-rate movements.

Liquidity and funding pressures.

Operational and cybersecurity risks.

Macroeconomic conditions.

Loan portfolio deterioration.

Concentration and interconnectedness risks.

Climate-related and other emerging financial risks.

However, AI does not possess independent legal authority to establish or change a bank's regulatory capital requirements.

The central legal distinction is between AI systems that calculate or recommend capital adjustments and public authorities that possess statutory powers to impose binding prudential requirements.

This distinction is essential to understanding the Spanish and European regulatory framework.

2. MEANING OF DYNAMIC CAPITAL REQUIREMENT SYSTEMS

A Dynamic Capital Requirement System is a framework in which capital needs are assessed in response to changing financial risks, rather than being treated solely as a static calculation performed at fixed reporting intervals.

An AI-assisted system may continuously process relevant information and produce updated estimates of potential capital needs.

For example, a Spanish bank may use machine learning to identify a deterioration in the credit quality of its commercial loan portfolio.

The system may estimate that increasing expected defaults could raise risk-weighted assets, reduce profitability, and weaken future capital ratios.

Management may then respond by retaining earnings, reducing particular exposures, strengthening risk controls, or preparing a capital restoration plan.

These measures remain subject to applicable legal requirements and supervisory oversight.

2.1 Traditional Capital Requirements

Under conventional prudential regulation, banks maintain minimum regulatory capital against defined categories of risk.

Capital adequacy is assessed using prescribed regulatory measures.

A simplified Common Equity Tier 1 capital ratio is:

CET1 Capital Ratio = CET1 Capital / Total Risk-Weighted Assets × 100

The EU prudential framework generally establishes the following Pillar 1 minimum ratios:

Common Equity Tier 1 capital: 4.5%.

Tier 1 capital: 6%.

Total capital: 8%.

These minimums are supplemented, where applicable, by capital buffers, institution-specific Pillar 2 requirements, and other regulatory measures.

The percentages are not a complete statement of the capital requirement applicable to every Spanish bank.

2.2 Dynamic Capital Assessment

A dynamic framework may update internal capital forecasts when:

Credit defaults increase.

Financial markets become unstable.

Interest rates change.

Asset values deteriorate.

Macroeconomic forecasts weaken.

Operational risks increase.

AI can assist by detecting relationships in large datasets that conventional models may not identify efficiently.

Nevertheless, any regulatory capital calculation must remain consistent with the methods and restrictions established by applicable prudential law.

3. THEORETICAL FOUNDATIONS

3.1 Risk-Sensitive Capital Regulation Theory

Risk-sensitive capital regulation is based on the principle that financial institutions should maintain capital proportionate to the risks they assume.

Higher-risk exposures may require greater capital support, subject to the applicable regulatory methodology.

AI can improve internal risk estimation by analysing complex financial relationships.

However, AI-generated risk estimates cannot automatically replace legally prescribed risk weights or approved internal models.

3.2 Macroprudential Regulation Theory

Macroprudential regulation focuses on risks affecting the stability of the financial system as a whole.

It addresses problems such as:

Excessive credit expansion.

Asset-price bubbles.

Systemic interconnectedness.

Procyclical lending.

Financial contagion.

AI-based models may help supervisors identify systemic vulnerabilities earlier.

For example, machine learning may detect unusually rapid growth in real estate lending across multiple financial institutions.

Such findings could inform supervisory analysis concerning the countercyclical capital buffer.

However, the authority to set or adjust a legally binding buffer remains with the competent public authority.

3.3 Adaptive Financial Regulation Theory

Adaptive regulation supports the adjustment of regulatory responses as economic conditions evolve.

In an AI-assisted banking environment, adaptive supervision may involve:

Continuous collection of prudential data.

Identification of emerging risks.

Predictive stress testing.

Assessment of capital adequacy.

Supervisory intervention where legally justified.

The theory seeks to make regulation more responsive without abandoning legal certainty or institutional accountability.

3.4 Algorithmic Governance Theory

Algorithmic governance concerns the use of computational systems to support institutional decision-making.

In banking supervision, AI may influence risk classifications, capital forecasts, and supervisory priorities.

The principal legal concern is that decisions affecting financial institutions must remain reviewable and attributable to legally responsible persons or authorities.

Algorithmic complexity must not eliminate accountability.

3.5 Financial Stability and Proportionality Theory

Capital regulation aims to preserve financial stability while avoiding unnecessary restrictions on legitimate banking activity.

AI-assisted capital systems must therefore balance:

Financial stability.

Credit availability.

Regulatory compliance.

Operational efficiency.

Model reliability.

Institutional accountability.

An excessively conservative model may encourage unnecessary credit restrictions.

An excessively optimistic model may underestimate risk and weaken financial resilience.

4. SPANISH LEGAL FRAMEWORK

4.1 Law 10/2014 on the Organisation, Supervision and Solvency of Credit Institutions

Spain's Law 10/2014 establishes important national rules concerning credit institutions, prudential supervision, governance, and solvency.

It operates within the broader European banking regulatory framework.

For AI-assisted capital systems, the legislation is relevant because banks remain responsible for maintaining sound governance, appropriate internal controls, and compliance with applicable prudential obligations.

A bank cannot avoid regulatory responsibility by attributing an incorrect capital assessment to an automated model.

4.2 Royal Decree 84/2015

Royal Decree 84/2015 develops aspects of Law 10/2014.

It addresses matters concerning the authorisation, supervision, and functioning of credit institutions.

Its relevance to AI-assisted capital management lies in the continuing requirement for institutions to maintain legally compliant governance and risk management arrangements.

4.3 Banco de España Circular 2/2016

Banco de España Circular 2/2016 develops certain supervisory and prudential requirements for credit institutions.

It forms part of the national regulatory framework applicable alongside EU law.

Banks must determine which provisions remain applicable to their particular activities, taking account of subsequent amendments and directly applicable European legislation.

4.4 Banco de España Supervisory Functions

Banco de España performs supervisory and macroprudential functions within Spain's banking system.

Its responsibilities operate alongside those of the European Central Bank under the Single Supervisory Mechanism.

AI tools may support supervisory analysis, but their use does not independently create new statutory powers.

4.5 Spanish Data Protection Framework

Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights supplements the EU General Data Protection Regulation in Spain.

Where AI-based capital models process personal data, banks must consider applicable data protection obligations.

These may include:

Lawfulness of processing.

Data minimisation.

Accuracy.

Security.

Accountability.

Restrictions on certain automated individual decisions.

Not every capital management model processes personal data, and not every automated capital calculation constitutes an individual decision under Article 22 GDPR.

5. EUROPEAN UNION REGULATORY FRAMEWORK

5.1 Capital Requirements Regulation – Regulation (EU) No 575/2013

The Capital Requirements Regulation, commonly called the CRR, establishes directly applicable prudential requirements for credit institutions.

It addresses matters including:

Own funds.

Risk-weighted assets.

Credit risk.

Market risk.

Operational risk.

Leverage.

Prudential reporting.

Regulation (EU) 2024/1623, commonly associated with CRR III, introduced substantial amendments implementing important elements of the final Basel III reforms.

AI systems used in regulatory capital calculations must operate within the applicable CRR methodology.

5.2 Capital Requirements Directive – Directive 2013/36/EU

The Capital Requirements Directive, or CRD, governs matters including authorisation, governance, supervisory powers, and prudential supervision.

Directive (EU) 2024/1619, commonly referred to as CRD VI, amended this framework.

The CRD framework is particularly relevant to:

Internal governance.

Risk management.

Supervisory review.

Capital adequacy assessment.

Institution-specific supervisory measures.

An AI model may assist with these activities, but legal responsibility remains with the institution and competent authorities.

5.3 Single Supervisory Mechanism Regulation

Council Regulation (EU) No 1024/2013 establishes the Single Supervisory Mechanism.

The ECB directly supervises significant credit institutions within participating Member States, including significant Spanish banking groups.

Less significant institutions are generally supervised by national competent authorities under the ECB's oversight, subject to the applicable allocation of responsibilities.

AI-assisted supervisory systems must respect this institutional structure.

5.4 European Banking Authority

The European Banking Authority develops technical standards, guidelines, and supervisory convergence measures.

Relevant areas include:

Internal governance.

Credit risk management.

Internal capital adequacy assessment.

Model risk.

Supervisory review.

Prudential reporting.

The EBA does not provide a general authorisation for banks to substitute unrestricted AI calculations for regulatory capital requirements.

5.5 EU Artificial Intelligence Act

Regulation (EU) 2024/1689 establishes the European Union's AI regulatory framework.

Its obligations apply according to the Act's phased implementation timetable and subsequent applicable legislative changes.

AI systems used to evaluate the creditworthiness of natural persons or establish their credit scores are specifically addressed within the high-risk classification framework, subject to defined exceptions.

However, an AI system used exclusively for internal bank capital forecasting is not automatically high-risk merely because it operates within the banking sector.

Classification depends on the system's intended purpose and the applicable legal provisions.

Where the AI Act applies, relevant obligations may concern risk management, data governance, documentation, transparency, human oversight, accuracy, and cybersecurity.

5.6 Digital Operational Resilience Act

Regulation (EU) 2022/2554, known as DORA, establishes requirements concerning digital operational resilience in the financial sector.

DORA has applied since 17 January 2025.

Its framework is relevant to AI-based capital systems where they form part of a financial institution's information and communication technology environment.

Banks must consider:

ICT risk management.

Operational resilience.

Incident management.

Digital resilience testing.

ICT third-party risk.

Business continuity.

6. ARTIFICIAL INTELLIGENCE APPLICATIONS IN CAPITAL MANAGEMENT

6.1 Credit Risk Prediction

AI models can analyse borrower behaviour, financial statements, repayment histories, and economic indicators.

These models may assist in estimating:

Probability of default.

Loss given default.

Exposure at default.

Portfolio concentration.

Expected credit deterioration.

However, regulatory use of internal credit risk models is subject to specific legal conditions and supervisory requirements.

6.2 Market Risk Analysis

Machine learning may support analysis of market movements, volatility, and exposure sensitivity.

It may help banks identify circumstances in which market movements could weaken capital adequacy.

6.3 Stress Testing

AI can assist banks in generating and analysing stress scenarios.

For example, a model may estimate the impact of:

Rising unemployment.

Falling property prices.

Higher interest rates.

Corporate defaults.

Financial market disruption.

These forecasts can inform internal capital planning.

6.4 Capital Buffer Forecasting

AI systems may forecast how changing economic conditions could affect the bank's capital headroom.

Such forecasts can support management decisions concerning capital conservation.

They do not themselves modify statutory capital buffers.

6.5 Supervisory Technology

Supervisory authorities may use advanced analytics to detect anomalies in prudential information and identify institutions requiring further examination.

The use of supervisory technology remains subject to applicable administrative law, data protection rules, and institutional responsibilities.

7. SEVEN IMPORTANT CASE LAWS

There is currently no established line of seven landmark judgments directly governing AI-driven dynamic capital requirement systems in Spanish banking.

The following seven judicial decisions are relevant because they establish legal principles concerning European banking supervision, capital regulation, administrative accountability, automated decision-making, and data protection.

Their application to AI-assisted capital systems is primarily analytical rather than the result of direct judicial rulings on that specific technology.

CASE LAW 1: Landeskreditbank Baden-Württemberg v. European Central Bank

Case: C-450/17 P
Court: Court of Justice of the European Union
Judgment: 8 May 2019

Facts:

Landeskreditbank Baden-Württemberg challenged its classification as a significant supervised entity under the Single Supervisory Mechanism.

The dispute concerned the allocation of supervisory responsibility between the ECB and national competent authorities.

Legal issue:

Whether the institution should be subject to direct ECB supervision under the applicable significance criteria.

Judgment:

The Court of Justice upheld the relevant interpretation of the SSM framework and dismissed the appeal.

Legal principle:

The allocation of prudential supervisory responsibilities must follow the legally established European framework.

Relevance to AI Capital Systems:

An AI system cannot independently decide which public authority possesses supervisory jurisdiction over a Spanish credit institution.

Supervisory competence must be determined by law.

CASE LAW 2: Crédit Mutuel Arkéa v. European Central Bank

Cases: C-152/18 P and C-153/18 P
Court: Court of Justice of the European Union
Judgment: 2 October 2019

Facts:

The litigation concerned ECB prudential supervision of Crédit Mutuel Arkéa within the Crédit Mutuel banking structure.

The disputes involved supervisory treatment and the relevant institutional framework.

Legal issue:

Whether the ECB's supervisory approach was lawful under the applicable EU banking legislation.

Judgment:

The Court dismissed the appeals and upheld the relevant supervisory approach.

Legal principle:

Prudential supervisory decisions must be grounded in the statutory powers and legal criteria governing banking groups.

Relevance:

AI-generated assessments of group risk, capital adequacy, or institutional relationships must be evaluated within the applicable legal structure.

Algorithmic assessments cannot replace statutory determinations concerning supervisory powers.

CASE LAW 3: Crédit Agricole SA and Others v. European Central Bank

Cases: T-133/16 to T-136/16
Court: General Court of the European Union
Judgment: 24 April 2018

Facts:

The cases concerned ECB decisions imposing administrative penalties in connection with prudential regulatory obligations.

Legal issue:

Whether the contested supervisory sanctions satisfied applicable legal requirements.

Judgment:

The General Court examined the legal basis and reasoning supporting the ECB's sanctions and annulled the contested decisions in relevant respects.

Legal principle:

Prudential enforcement measures must comply with applicable procedural and substantive legal requirements.

Relevance:

Where an AI system identifies a potential capital compliance breach, a supervisory authority must still ensure that any enforcement action is legally justified and adequately reasoned.

An automated risk alert is not equivalent to a lawful sanction.

CASE LAW 4: Banco Popular Español SA v. Single Resolution Board

Cases: Including T-481/17
Court: General Court of the European Union
Judgment: 1 June 2022

Facts:

The litigation arose from the resolution of Banco Popular Español in 2017.

The resolution involved decisions by the Single Resolution Board and European institutions under the EU bank resolution framework.

Legal issue:

Whether the resolution measures complied with applicable EU law, including procedural and substantive requirements.

Judgment:

In the relevant 2022 proceedings, the General Court dismissed challenges to the resolution scheme.

Legal principle:

Bank resolution decisions must be taken by legally authorised institutions under the applicable statutory framework.

Relevance:

AI systems may assist with financial distress indicators and capital deterioration forecasts.

However, they cannot independently exercise public powers to resolve a failing bank.

The case also illustrates the importance of institutional accountability in decisions with major consequences for shareholders and creditors.

CASE LAW 5: SCHUFA Holding (Scoring)

Case: C-634/21
Court: Court of Justice of the European Union
Judgment: 7 December 2023

Facts:

The dispute concerned automated credit scoring and the use of probability values generated by a credit information agency.

Legal issue:

Whether automated generation of a creditworthiness score could constitute automated individual decision-making under Article 22 GDPR.

Judgment:

The Court held that automated scoring may fall within Article 22 where the score plays a determining role in a third party's decision concerning the individual.

Legal principle:

Automated decision-making may be subject to specific GDPR restrictions where its legal conditions are satisfied.

Relevance:

Spanish banks using AI-based credit scoring must consider GDPR requirements.

Where credit scores feed into broader capital risk models, the bank must distinguish between internal prudential analytics and automated decisions affecting identifiable individuals.

The judgment does not directly regulate capital ratios.

CASE LAW 6: Dun & Bradstreet Austria

Case: C-203/22
Court: Court of Justice of the European Union
Judgment: 27 February 2025

Facts:

The dispute concerned access to meaningful information about the logic involved in automated creditworthiness assessment.

Legal issue:

The extent of an individual's right to receive meaningful information concerning automated decision-making under GDPR.

Judgment:

The Court clarified requirements concerning the explanation of automated decision-making and the information that must be provided in relevant circumstances.

Legal principle:

Where GDPR rights apply, meaningful information about automated processing cannot necessarily be replaced by vague or purely technical descriptions.

Relevance:

Banks deploying complex AI systems for individual creditworthiness decisions must consider explainability and transparency obligations.

For capital management, the broader lesson is that model complexity does not automatically eliminate legal accountability.

However, the GDPR explanation requirements addressed in this case do not automatically apply to every internal capital forecasting model.

CASE LAW 7: Melloni v. Ministerio Fiscal

Case: C-399/11
Court: Court of Justice of the European Union
Judgment: 26 February 2013

Facts:

The case arose from Spanish judicial proceedings concerning a European arrest warrant and the relationship between national constitutional standards and EU law.

Legal issue:

How national fundamental rights standards interact with harmonised EU legal requirements.

Judgment:

The Court emphasised the requirements of EU law and the limits on applying national standards where doing so would compromise the primacy, unity, and effectiveness of EU law.

Legal principle:

National authorities must respect the applicable hierarchy and requirements of European Union law.

Relevance:

Spain's regulation of AI-assisted banking systems must operate consistently with binding EU prudential legislation.

The case is relevant to EU legal hierarchy, not directly to banking capital requirements or AI.

8. INDIAN LEGAL FRAMEWORK: COMPARATIVE PERSPECTIVE

Although the principal subject concerns Spain, Indian law provides a useful comparative framework for understanding AI-assisted banking risk management.

8.1 Banking Regulation Act, 1949

The Banking Regulation Act establishes important legal foundations for banking supervision and regulation in India.

AI-assisted capital management by Indian banks remains subject to the applicable statutory and RBI prudential framework.

8.2 Reserve Bank of India Act, 1934

The RBI Act provides part of the statutory framework supporting India's central banking and financial regulatory functions.

AI systems cannot independently exercise the Reserve Bank's regulatory powers.

8.3 RBI Basel III Capital Regulations

Indian banks are subject to applicable RBI capital adequacy requirements, including relevant Basel III provisions.

AI may support internal risk assessment, but regulatory capital calculations must follow the applicable RBI methodology.

8.4 Information Technology Act, 2000

The Information Technology Act provides relevant legal provisions concerning electronic records, cybersecurity-related obligations, and certain technology-related liabilities.

Its application depends on the nature of the system and the conduct involved.

8.5 Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection Act establishes a statutory framework for digital personal data processing, subject to its commencement provisions and applicable rules.

Where banks process personal data through AI systems, they must assess the provisions legally in force at the relevant time.

8.6 Comparative Regulatory Principle

Both Spain and India recognise the importance of capital adequacy, risk management, and supervisory responsibility.

The fundamental principle is similar:

AI may assist prudential analysis, but binding regulatory capital obligations must be determined under applicable law.

9. INTERNATIONAL BANKING REGULATIONS

9.1 Basel III Framework

Basel III establishes international standards addressing bank capital, leverage, liquidity, and risk management.

AI-assisted systems may support the implementation of these requirements through improved forecasting and internal monitoring.

However, Basel standards do not independently authorise AI systems to determine legally binding capital requirements.

9.2 Basel Committee Principles for Effective Risk Data Aggregation and Risk Reporting

BCBS 239 establishes principles concerning risk data aggregation and reporting.

Relevant principles include:

Data accuracy.

Data integrity.

Completeness.

Timeliness.

Adaptability.

Governance.

These principles are particularly important for AI systems that depend on large volumes of financial information.

9.3 Financial Stability Board

The Financial Stability Board examines financial stability risks, including those arising from technological innovation.

AI-related concerns may include:

Model concentration.

Third-party dependencies.

Cybersecurity.

Market interconnectedness.

Operational disruption.

9.4 International Monetary Fund

The IMF conducts financial stability analysis and provides research concerning banking vulnerabilities, macroprudential policy, and financial technology.

Its publications may inform policy analysis but do not ordinarily create binding capital requirements for Spanish banks.

10. LEGAL RISKS OF AI-BASED DYNAMIC CAPITAL SYSTEMS

10.1 Algorithmic Bias

AI models may produce distorted estimates where training data are incomplete, unrepresentative, or affected by historical bias.

This can undermine credit risk assessment and internal capital planning.

Where personal data or individual credit decisions are involved, additional legal obligations may apply.

10.2 Model Risk

AI models may fail because of:

Incorrect assumptions.

Data quality problems.

Model drift.

Overfitting.

Unexpected market conditions.

Inadequate validation.

Banks must maintain appropriate model governance.

10.3 Explainability Risk

Complex AI models may be difficult to interpret.

Supervisors may require institutions to explain how risk estimates were produced and how those estimates affect prudential management.

The specific legal requirements depend on the applicable regulatory regime and model use.

10.4 Supervisory Accountability

A public authority cannot avoid its legal responsibilities by relying exclusively on an automated recommendation.

Supervisory measures must remain attributable to a competent authority.

10.5 Data Protection Risk

Where AI systems process personal data, GDPR and applicable Spanish legislation may impose obligations concerning lawful processing, security, accuracy, and individual rights.

10.6 Cybersecurity Risk

An AI model integrated into capital planning infrastructure may become vulnerable to manipulation, data corruption, or operational failure.

DORA and other applicable ICT risk requirements are relevant.

10.7 Procyclicality Risk

AI systems trained on recent market behaviour may amplify financial cycles.

For example, during an economic downturn, models may predict rising defaults and encourage banks to restrict lending.

If many banks respond similarly, credit contraction may intensify.

This creates a potential conflict between institution-level risk management and system-wide financial stability.

11. ILLUSTRATIVE EXAMPLE: SPANISH BANK

Assume a Spanish bank has the following financial position:

Common Equity Tier 1 capital: €12 billion.

Risk-weighted assets: €100 billion.

Its CET1 capital ratio is:

€12 billion / €100 billion × 100 = 12%

The bank introduces an AI-assisted risk forecasting system.

The model predicts that deteriorating credit conditions may increase risk-weighted assets to €110 billion.

Assuming CET1 capital remains unchanged:

€12 billion / €110 billion × 100 = 10.91%

The model therefore forecasts a reduction in the CET1 ratio from 12% to approximately 10.91%.

Management may consider:

Retaining earnings.

Reducing selected risk exposures.

Reviewing lending policies.

Strengthening capital planning.

Updating stress-testing assumptions.

However, the AI forecast does not itself establish that regulatory risk-weighted assets have legally increased.

The bank must apply the relevant regulatory methodology when determining its official capital position.

12. AI CAPITAL MANAGEMENT AND SPANISH CONSUMER LAW

AI-assisted capital systems may indirectly affect consumers through lending decisions.

For example, a bank anticipating increased capital pressure may tighten credit standards.

Relevant legal considerations may include:

Consumer credit legislation.

Mortgage lending requirements.

GDPR.

Applicable anti-discrimination law.

Contractual transparency.

Fair treatment of customers.

Spain's Law 5/2019 regulating real estate credit contracts may be relevant where AI-assisted systems affect mortgage lending.

Nevertheless, an internal capital forecast is not automatically a consumer-facing automated decision.

The legal analysis must distinguish between prudential management and decisions directly affecting individual borrowers.

13. REGULATORY GOVERNANCE MODEL

A legally sound AI-assisted capital management framework should include several institutional safeguards.

A. Board Oversight

The board and senior management should establish appropriate accountability for the use of AI in capital planning.

B. Independent Model Validation

Material models should undergo appropriate independent review and testing.

C. Data Governance

Banks should maintain reliable and appropriately controlled data.

D. Human Supervision

Qualified personnel should review material model outputs and determine whether management action is necessary.

E. Auditability

The institution should maintain sufficient documentation to support review of model development, operation, and decisions.

F. Regulatory Compliance

The model must operate consistently with applicable EU and Spanish prudential requirements.

G. Operational Resilience

The bank should establish appropriate controls for system failures, cyber incidents, and external technology dependencies.

14. FUTURE LEGAL AND REGULATORY DEVELOPMENTS

AI-assisted capital management is likely to raise important questions concerning the future of banking supervision.

Potential areas of development include:

Real-time prudential monitoring: More frequent analysis of capital and risk indicators.

Predictive supervisory intervention: Earlier identification of emerging financial weaknesses.

AI model governance: More formalised expectations concerning validation, explainability, and accountability.

Regulatory technology: Greater use of automated data analysis by supervisory authorities.

Cross-border supervision: Coordination of AI-related risk assessment within the European Banking Union.

Systemic model risk: Examination of the consequences of multiple banks relying on similar AI models or technology providers.

These are possible directions of regulatory development rather than established legal requirements for fully automated capital adjustment.

15. CRITICAL LEGAL ANALYSIS

The principal advantage of AI-assisted dynamic capital management is its potential to improve the identification and measurement of changing financial risks.

However, the use of AI also creates significant legal and institutional challenges.

First, capital regulation requires legal certainty. Banks must know which requirements apply and how compliance will be measured.

Second, supervisory decisions must remain attributable to competent public authorities.

Third, AI systems may produce errors or unstable forecasts, particularly during periods of market disruption.

Fourth, automated models can generate systemic risks if financial institutions respond uniformly to similar signals.

Fifth, the use of personal data may trigger additional regulatory protections.

Sixth, banks must distinguish internal economic capital estimates from legally binding regulatory capital calculations.

Finally, financial stability depends not only on technical accuracy but also on governance, accountability, transparency, and effective supervision.

Accordingly, the most legally defensible approach is to treat AI as a decision-support and risk-management technology operating within the established prudential framework.

16. CONCLUSION

Dynamic Capital Requirement Systems using Artificial Intelligence represent an important theoretical development in modern banking risk management and prudential supervision.

In Spain, these systems must operate within the European Union's capital requirements framework, the Single Supervisory Mechanism, Spanish banking legislation, applicable data protection rules, and digital operational resilience requirements.

AI can support credit risk forecasting, stress testing, capital planning, macroprudential analysis, and supervisory monitoring.

However, it cannot independently create, amend, or enforce legally binding regulatory capital requirements.

The relevant judicial decisions demonstrate the importance of supervisory competence, legal accountability, administrative procedure, data protection, and compliance with EU law.

The principal legal conclusion is that AI-assisted dynamic capital management is permissible as a risk-management and decision-support approach, subject to applicable law, but autonomous algorithmic determination of binding regulatory capital requirements has no general legal authorisation under the existing Spanish and EU prudential framework.

Future regulatory development may expand the use of AI in prudential supervision, but financial stability and the rule of law require human and institutional accountability to remain central.

17. REFERENCES

A. SPANISH LEGISLATION

Law 10/2014 of 26 June on the Organisation, Supervision and Solvency of Credit Institutions.

Royal Decree 84/2015 of 13 February.

Banco de España Circular 2/2016.

Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights.

Law 5/2019 of 15 March regulating Real Estate Credit Contracts.

B. EUROPEAN UNION LEGISLATION

Regulation (EU) No 575/2013 – Capital Requirements Regulation.

Directive 2013/36/EU – Capital Requirements Directive.

Regulation (EU) 2024/1623 – Amendments to the Capital Requirements Regulation.

Directive (EU) 2024/1619 – Amendments to the Capital Requirements Directive.

Council Regulation (EU) No 1024/2013 – Single Supervisory Mechanism.

Regulation (EU) 2016/679 – General Data Protection Regulation.

Regulation (EU) 2024/1689 – Artificial Intelligence Act.

Regulation (EU) 2022/2554 – Digital Operational Resilience Act.

C. SEVEN JUDICIAL DECISIONS

Landeskreditbank Baden-Württemberg v. European Central Bank, C-450/17 P, CJEU, 8 May 2019.

Crédit Mutuel Arkéa v. European Central Bank, C-152/18 P and C-153/18 P, CJEU, 2 October 2019.

Crédit Agricole SA and Others v. European Central Bank, T-133/16 to T-136/16, General Court, 24 April 2018.

Banco Popular Español SA v. Single Resolution Board, T-481/17, General Court, 1 June 2022.

SCHUFA Holding (Scoring), C-634/21, CJEU, 7 December 2023.

Dun & Bradstreet Austria, C-203/22, CJEU, 27 February 2025.

Melloni v. Ministerio Fiscal, C-399/11, CJEU, 26 February 2013.

D. INDIAN LEGISLATION

Banking Regulation Act, 1949.

Reserve Bank of India Act, 1934.

Information Technology Act, 2000.

Digital Personal Data Protection Act, 2023.

Reserve Bank of India – Applicable Basel III Capital Regulations.

E. INTERNATIONAL REGULATORY MATERIALS

Basel Committee on Banking Supervision – Basel Framework.

Basel Committee on Banking Supervision – Principles for Effective Risk Data Aggregation and Risk Reporting (BCBS 239).

European Banking Authority – Guidelines on Internal Governance.

European Central Bank – Guide to the Internal Capital Adequacy Assessment Process.

European Central Bank – Guide to Internal Models.

Financial Stability Board – Publications on Artificial Intelligence and Financial Stability.

International Monetary Fund – Financial Stability and Macroprudential Policy Publications.

Legal Research Note: This analysis distinguishes existing binding law from proposed or theoretical applications of AI in capital regulation. The seven cases are related precedents, not direct rulings establishing a legal regime for autonomous AI capital-setting systems. The regulatory position should be checked against legislation, implementation dates, supervisory guidance, and judicial developments in force when the analysis is used.