EU AI Office

Who actually supervises AI in a financial institution?

Not the AI Office. Its direct competence covers general-purpose AI models, including those with systemic risk. High-risk AI systems are supervised by national market surveillance authorities, and Article 74(6) of Regulation (EU) 2024/1689 routes financial institutions to their existing supervisor: the authority already responsible for prudential or conduct supervision under EU financial services law acts as the AI Act market surveillance authority for that institution's high-risk AI systems.

In practice:

• Germany. BaFin was designated market surveillance authority for AI systems used by financial entities under the German AI Act implementing law, in force since 29 July 2026 (BaFin press release).
• Netherlands. The draft implementing act published for consultation on 20 April 2026 designates ten authorities, including AFM and DNB for the financial sector, with the AP and RDI coordinating. The Dutch bill has not yet passed. It must still clear both chambers.

If you are a Dutch institution asking who your AI supervisor is, the honest answer as at August 2026 is: probably the AFM or DNB, but the law saying so is not yet in force.

Which AI uses in finance are high-risk?

Annex III of the AI Act names two use cases that sit squarely in financial services: creditworthiness evaluation of natural persons, and risk assessment and pricing in relation to life and health insurance (Commission AI Act FAQ).

Separately, three prohibited practices reach into finance and have applied since 2 February 2025: social scoring, whether by public or private actors; exploitation of vulnerabilities or manipulation through subliminal techniques; and biometric categorisation inferring protected characteristics. The AI literacy obligation in Article 4 has applied since the same date, and it applies to every deployer, not only to high-risk users.

What does the AI Office publish?

The General-Purpose AI Code of Practice, published in final form on 10 July 2025 and due for review at least every two years; guidelines, most recently on the Article 50 transparency obligations, published 20 July 2026; templates, including the model training-content summary; standardisation requests to CEN-CENELEC; and the AI Act Service Desk, a single information platform with an AI Act Explorer and a compliance checker at ai-act-service-desk.ec.europa.eu.

The GPAI Code of Practice has 21 confirmed signatories, with one further partial signatory to the safety and security chapter only. The separate Code of Practice on Transparency of AI-generated Content had roughly 180 to 190 signatory organisations as at 31 July 2026.

Nothing else moved. Prohibitions, AI literacy, general-purpose AI obligations and the Article 50 transparency requirements all apply on their original dates. If you deploy a customer-facing chatbot, the transparency duty to disclose that it is AI has applied since 2 August 2026: the delay does not touch it.

What are the penalties?

Article 99 sets three tiers, each expressed as the higher of a fixed amount and a percentage of global annual turnover, with SMEs subject to the lower of the two:

• prohibited practices and data-governance violations: up to €35 million or 7%
• other obligations, including most high-risk system duties: up to €15 million or 3%
• supplying incorrect or misleading information to authorities: up to €7.5 million or 1%

Who imposes them depends on what is being enforced. The Commission, through the AI Office, enforces against providers of general-purpose AI models. For high-risk systems, the fine comes from the national market surveillance authority. For a financial institution, that is its own financial supervisor. We found no published AI Office enforcement action as at 17 August 2026.

What changes for a mid-sized institution?

The Act gives SMEs simplified compliance pathways for some of the more burdensome obligations, technical documentation among them. Article 57 requires every member state to establish at least one AI regulatory sandbox, and the Digital Omnibus expands sandbox access beyond SMEs to small mid-cap companies. In the Netherlands, the AP and RDI are due to launch a joint sandbox during 2026.

The more consequential change for a mid-sized bank or insurer is the fifteen-month extension on Annex III. Credit-scoring and insurance-pricing models that were due to meet high-risk requirements this month now have until 2 December 2027, which is either relief or a planning trap, depending on whether the extra time gets used.