AI & Machine Learning Company in Frankfurt

No band survives contact with an EU AI Act risk classification, so Frankfurt ML work is quoted fixed-fee against a written EU AI Act and MaRisk scope instead. A scoped AI proof of concept is a six to ten week engagement covering data audit, a baseline model, an EU AI Act risk classification, and a hosted demo. A custom production ML model (fraud scoring, credit decisioning, AML transaction monitoring, claims triage) adds MLOps, model risk documentation under MaRisk AT 4.3.4, and a BaFin AI Risk Management Guidance 2024 gap closure. Full production AI systems layer on RAG, multiple models, fine-tuning, and core-banking integrations. Frankfurt sits above Berlin and Munich because of the BaFin documentation burden and the regulated-finance talent premium. We quote fixed-fee against a written EU AI Act and MaRisk scope.

The EU AI Act entered into force on 1 August 2024 with staged obligations: prohibitions from February 2025, GPAI (general-purpose AI) obligations from August 2025, high-risk system obligations from August 2026 (most), and the rest by August 2027. For Frankfurt financial services, Annex III point 5b explicitly classifies AI used to evaluate creditworthiness of natural persons and AI used for risk assessment and pricing in life and health insurance as high-risk. Our discovery runs the classification, drafts the Annex IV technical documentation (data governance, accuracy/robustness, human oversight, logging, transparency), and aligns with the conformity assessment route. We coordinate with your BaFin contact and your appointed AI compliance lead under the BaFin 2024 guidance. Annex IV documentation is delivered in German and English.

BaFin issued Principles for the use of algorithms in decision-making processes of financial institutions in 2021 (the so-called BDAI principles — Big Data and AI), and in 2024 published updated AI-specific risk management guidance addressing GenAI, LLM use in regulated financial institutions, explainability for high-impact models, human-in-the-loop requirements, and model risk management under MaRisk AT 4.3.4. Our high-risk financial AI deliverables include a German-language Modellkarte mapping each model property to BDAI Principles and the 2024 guidance, an Erklärbarkeitsbericht (explainability report) using SHAP or LIME, a challenger model comparison, and a §25a KWG-compliant governance documentation pack. We stay current with BaFin Konsultationen and AuA updates.

Yes. We ship RAG copilots, internal knowledge assistants, KYC document extraction, and onboarding agents for Frankfurt banks and BaFin-regulated fintechs. For Deutsche Bank, Commerzbank, DZ Bank, and Helaba-pattern clients we stay inside EU regions (Aleph Alpha Luminous for sensitive German content, Mistral on EU infrastructure, AWS Bedrock with Anthropic in eu-central-1, Azure OpenAI in Germany West Central), apply MaRisk AT 4.3.4 model risk controls, and produce the BaFin AI Risk Management Guidance documentation. PII redaction, §203 StGB professional-secrecy guards, prompt injection defences, and human-in-the-loop review gates are baked in. Output logs feed your existing SIEM and model risk register. For genuinely sovereign workloads we recommend Aleph Alpha’s on-premise deployment.

German financial AI sits at the intersection of GDPR, BDSG-neu (2018), §25a KWG banking secrecy, and §203 StGB criminal-law professional confidentiality. Training data is pseudonymised at the source under GDPR Art. 4(5), with re-identification keys kept inside a separate KMS controlled by your bank, not Codazz. For §203 StGB regulated data (which extends to bank customer relationships in some German court interpretations) we deploy on-premise or in your VPC inside eu-central-1, never in shared SaaS. The Verzeichnis von Verarbeitungstätigkeiten is updated, a DPIA is filed where Art. 35 GDPR triggers apply, and the Hessischer Beauftragter für Datenschutz und Informationsfreiheit is the lead supervisory authority for most Frankfurt clients.

We have built models on anonymised SSM (Single Supervisory Mechanism) supervisory data patterns, Bundesbank statistical datasets (AnaCredit credit register, MMSR money-market statistics, BISTA banking statistics), and ECB Statistical Data Warehouse extracts. Direct access to non-anonymised ECB or Bundesbank data sits with your bank’s designated researchers under signed confidentiality agreements; we typically operate on anonymised or aggregated extracts under a documented data sharing protocol. For regulatory reporting AI (AnaCredit reasonableness checks, MMSR completeness, Bundesbank ad hoc statistical requests) we have built ETL and ML pipelines that match the granularity Bundesbank examiners expect on Vor-Ort-Prüfungen and remote supervisory data calls.

Yes. Our fraud and AML AI builds align with §25h KWG (banking organisational requirements for fraud prevention), the German Money Laundering Act (GwG), BaFin AuA (Auslegungs- und Anwendungshinweise) on suspicious-transaction monitoring, and the EBA Guidelines on customer due diligence. Architecture is hybrid: rules engine for known typologies plus ML (gradient boosting, graph neural networks for network typologies, autoencoders for novelty) with SHAP explanations per alert. Alerts route into your existing case management (Actimize, SAS, NICE, or internal) with documented disposition codes. Suspicious-transaction reports (Verdachtsmeldung) to the Financial Intelligence Unit (FIU) at the Generalzolldirektion are generated as drafts for your AML officer (Geldwäschebeauftragter) to review and submit. Model risk documentation is MaRisk AT 4.3.4 grade.

AIC4 (Artificial Intelligence Cloud Services Compliance Criteria Catalogue) is the German Federal Office for Information Security (BSI) framework for AI cloud services, published 2021 and updated since, that complements the BSI C5 catalogue for general cloud services. It covers security of training data, model integrity, robustness, explainability, bias, and reliability. For Frankfurt financial AI clients running on AWS, Azure, or GCP, AIC4 alignment is not strictly mandatory but is increasingly expected by BaFin examiners and by enterprise procurement at Deutsche Bank, Commerzbank, and DZ Bank. We map each Codazz-delivered model and AI service against AIC4 control objectives, document the gaps, and ship a remediation roadmap your CISO can present to internal audit and to BaFin during onsite supervisory reviews.