EU Artificial Intelligence Act (EU AI Act)

Seven other changes matter to a financial institution:

• Art. 4 (AI literacy) softened from a hard obligation to a duty to take measures to support the development of staff AI literacy, with an express disclaimer that no specific level need be guaranteed for any individual.
• New Art. 4a permits processing GDPR Article 9 special-category data for bias detection and correction under six cumulative conditions, extended from high-risk providers to all providers and deployers, with the strict-necessity test retained. It creates no obligation to do bias testing.
• Art. 27(4) now lets a deployer cross-reference the relevant sections of an existing GDPR Article 35 DPIA into its fundamental rights impact assessment, and Art. 27(5) mandates an AI Office template with an automated tool.
• Art. 17 and 63 give SMEs and small mid-caps simplified technical documentation and a proportionate quality management system.
• New Art. 2(13) lets Arts. 9–15 and 17–25 be limited where Annex I Section A legislation gives equivalent protection, through delegated acts due 2 August 2027.
• Art. 49(2) registration was simplified, not abolished. Nine data items became seven. Claiming the Art. 6(3) derogation still puts you in the public EU database.
• Art. 73 serious-incident reporting was not amended. The 15-day, 2-day and 10-day limits stand exactly as drafted, and Art. 6(3) is unchanged.

Is AML transaction monitoring high-risk?

No. AML and CFT transaction monitoring is not listed in any of the eight Annex III categories. Annex III 5(b) expressly excepts systems used to detect financial fraud, and Recital 58 excludes systems provided for by Union law for detecting fraud in the offering of financial services. The Commission's draft high-risk classification guidelines of 19 May 2026 close the remaining route, confirming that a private entity running AML detection to meet its own obligations does not act on behalf of law enforcement, so Annex III point 6 does not catch it either.

Does a bank have to do a fundamental rights impact assessment?

Yes, if it deploys credit scoring on natural persons. This is the provision most often stated wrongly.

Article 27(1) names three separate categories of deployer, and the list is disjunctive: bodies governed by public law, or private entities providing public services, and deployers of high-risk AI systems referred to in points 5(b) and (c) of Annex III. A private commercial bank is not a public body and does not provide public services, but it is caught by the third limb. So is a life or health insurer under 5(c).

The FRIA must describe the deployer's processes and intended purpose, the period and frequency of use, the categories of natural persons and groups affected, the specific risks of harm, how human oversight is implemented, and what will be done if the risks materialise. Results must be notified to the market surveillance authority under Article 27(3).

Can we use our existing CRD, Solvency II and DORA governance?

Largely, and this is explicit in the text rather than an interpretation.

Article 17(4) provides that for providers that are financial institutions subject to internal governance requirements under Union financial services law, the quality management system obligation "shall be deemed to be fulfilled by complying with the rules on internal governance arrangements or processes pursuant to the relevant Union financial services law", except Art. 17(1)(g) the risk management system, (h) post-market monitoring and (i) serious incident reporting, which must be built separately.

Article 26(5) deems the deployer's monitoring duty fulfilled by compliance with financial-services internal governance rules. Article 26(6) lets a financial institution keep AI logs inside its existing financial-services documentation rather than a separate store with the general six-month minimum. Article 72(4) does the same for post-market monitoring, expressly extended to Annex III point 5.

Article 43(2) matters commercially: for Annex III points 2 to 8, which includes credit scoring and life and health insurance pricing, conformity assessment is internal control under Annex VI, with no notified body. Only Annex III point 1, biometrics, has the notified-body route.

The EBA reached the same conclusion in November 2025: no material contradictions between the AI Act and EU banking and payment legislation, and the AI Act's credit-scoring obligations largely overlap with existing requirements in CRR, CRD, DORA, CCD2, MCD and the EBA guidelines. Integrate, rather than building a parallel compliance stack. If your DORA ICT risk framework is already running, it is the structure this bolts onto.

Grandfathering: what a model already in production owes

This is the provision with the most money attached to it, and almost nobody covers it.

Article 111(2) applies the high-risk regime to Annex III systems placed on the market before the Chapter III application date "only if, as from that date, those systems are subject to significant changes in their designs."

Read plainly: a credit-scoring model already in production on 2 December 2027 is grandfathered indefinitely, unless it is significantly redesigned. There is no sunset for private deployers. Only public-authority deployments carry a hard backstop, at 2 August 2030, and Annex X large-scale IT systems at 31 December 2030.

The catch is what counts as a significant change in design. Model refreshes, retraining on new data and feature changes are exactly where that bites, and a model governance calendar that schedules an annual rebuild is a calendar that schedules its own entry into the high-risk regime. Date and document the production baseline now, while the evidence is easy to assemble.

The Netherlands is late, it has admitted it in writing, and it has a consequence. Member States had to designate authorities and lay down penalty rules under Article 70(2) by 2 August 2025. The cabinet accepted in a letter to Parliament that the Dutch implementing act would enter into force later than the Regulation requires (Kamerstuk II 2025/26, 22 112, nr. 4318, 20 April 2026). The internet consultation drew 30 responses and submission is planned for Q4 2026, contingent on securing the supervision budget (Kamerstuk 36 800-XIII, nr. 42). The Article 5 and Article 50 obligations bind Dutch firms directly, because a regulation does not need national law to apply, but Dutch administrative fining powers are not yet in national statute. The AP put it plainly in March 2026: there are risks "waartegen nu niet handhavend kan worden opgetreden".

The proposed model names ten market surveillance authorities (AP, RDI, ILT, NVWA, NLA, IGJ, AFM, DNB, PGHR and the chair of the ABRvS), with the RDI as the Article 70 single point of contact and the AP as residual authority. For financial services it follows Article 74(6): Art. 5(1)(a) and (b) prohibitions to the AFM alone; Annex III 5(b) creditworthiness and 5(c) life and health insurance pricing to the AFM and DNB jointly; Art. 50 transparency to DNB and the AFM.

The split itself is contested. The AFM's uitvoeringstoets of 12 June 2026 calls the bill workable in principle but argues that both the AFM and DNB should be competent for both the prohibitions and the high-risk applications, saying the proposed division "sluit onvoldoende aan bij de doelstellingen van de AI-verordening en kan effectief toezicht belemmeren", and flags gaps in capacity, funding, expertise and data sharing.

Germany is ahead and more explicit. BaFin confirmed on 29 July 2026 that it is the market surveillance authority for AI in direct connection with regulated financial activity, named bank creditworthiness assessment and life and health insurance risk evaluation as the high-risk cases, and confirmed the 2 December 2027 date. Its stated current focus is Article 5 prohibitions, Article 50 transparency and Article 4 staff competence, with a recommendation to integrate AI governance into existing structures, *particularly DORA*.

What recently changed

2 August 2026: enforcement began. The AI Office and national authorities began enforcing the prohibitions, the GPAI obligations and the transparency rules, as the Commission announced on 31 July 2026. A complaints tool, a whistleblower tool and a downstream-provider complaints channel opened. Article 101 fines for GPAI providers also became available on this date: Article 113(b) had expressly excluded Article 101 from the 2 August 2025 start, leaving it to fall in under the general date.

31 July 2026: the ESAs framed frontier AI through DORA. The joint statement on frontier AI models (JC 2026-25) sets the supervisory expectation for financial entities using frontier models, and it routes the risk through operational resilience rather than through a new AI-specific framework. If you are reading this page and the DORA page as two separate programmes, the supervisors are not.

27 July 2026: Regulation (EU) 2026/1744 entered into force, three days after publication under an urgency provision, moving the high-risk dates set out above.

10 June 2026: a Code of Practice on Transparency of AI-generated Content was published, with roughly 190 signatories by end July 2026, confirmed by the Commission as an adequate voluntary route to Article 50 compliance.

19 May 2026: the Commission published only a draft of the high-risk classification guidelines. These were statutorily due under Article 6(5) by 2 February 2026. They remain in draft as at 17 August 2026.

5 March 2026: the AP's AI-Impactbarometer turned red, with four of nine indicators red. Its stated concern is systems registered as ordinary algorithms rather than as AI systems, which keeps them out of scope on paper while leaving them in scope in law.

21 January 2026: DNB published findings on AI at insurers. Around 80% of large and mid-sized insurers use AI in regular processes against 21% of small insurers; more than 70% recognise the six EIOPA governance principles, but documentation and post-deployment monitoring are weak. DNB names life and health risk assessment and premium setting as the high-risk category and said it would run sector-wide surveys in 2026.

Harmonised standards have not arrived. Ten standardisation areas were requested under mandate M/593 as amended. As at mid-2026, zero have been cited in the Official Journal, meaning no AI Act standard currently grants presumption of conformity. Only prEN 18286 has reached public enquiry, on 30 October 2025, and nine JTC 21 deliverables are in progress. Against an original mandate deadline of 30 April 2025 and a mandate expiring 28 February 2027, that is a slippage of roughly eighteen months.