EBA Publishes September 2026 Organization Chart Showing AI Act, PSD3/PSR, and DORA Oversight Leaders

Key Takeaways

• The European Banking Authority released its organization chart dated September 16, 2026.
• It is an internal structure document, not a new rule, but it identifies the teams and leaders responsible for AI Act implementation, PSD3/PSR implementation, DORA joint oversight, and Pillar 2 convergence.
• Compliance teams can use it to direct regulatory engagement and anticipate supervisory priorities.

Deep Dive

The European Banking Authority released its organization chart dated September 16, 2026. It is an internal structure document, not a new rule, but it identifies the teams and leaders responsible for AI Act implementation, PSD3/PSR implementation, DORA joint oversight, and Pillar 2 convergence. Compliance teams can use it to direct regulatory engagement and anticipate supervisory priorities.

Several workstreams signal current EBA priorities. These include AI Act implementation, an AI program (listed under two team leaders), PSD3/PSR implementation, CMDI (crisis management and deposit insurance) implementation, Pillar 2 convergence, NBFI (non-bank financial intermediation), an integrated data dictionary, a European data dissemination portal, and IFRS coordination. The two DORA Joint Oversight teams sit in a Joint ESAs Department that reports to the three ESAs' Executive Directors rather than the EBA alone. This matters for firms with critical ICT third-party provider (CTPP) relationships, since oversight is coordinated across the ESAs.

Recommended actions: (1) Update regulatory engagement maps and consultation-response contact lists to reflect current team structures. (2) Confirm that horizon-scanning covers the workstreams above, especially AI Act, PSD3/PSR, CMDI, and DORA oversight. (3) Align internal ownership for these topics so that technical outreach, Q&A submissions, and supervisory dialogue are routed to the right EBA counterparts. (4) Monitor leadership changes, particularly the acting positions, for shifts in policy emphasis or timing. Names and structures should be verified against the EBA's official publication before being relied upon.

Risk implications are low and indirect. There is no compliance deadline or enforcement exposure. The main exposure is the strategic one of missing signals about supervisory focus. The concentration of resources on digital finance, AI, payments, data, and ICT oversight suggests continued regulatory attention to operational resilience, technology governance, and consumer protection in payments.

Source: European Banking Authority