What Financial Institutions Must Prepare
The EU AI Act is no longer tomorrow’s compliance problem. Since 2 August 2026, most provisions apply and EU authorities have begun exercising enforcement powers, while AI literacy and prohibited-practice rules have applied since February 2025. For financial institutions, the challenge is double-edged: exploit AI’s speed and insight while proving that increasingly complex systems remain controlled, transparent and accountable. That makes AI governance far more than an IT project. It must become part of the operating model, connecting business strategy, risk, compliance and technology. The journey starts with five questions: scope, classification, accountability, evidence and, ultimately, implementation.
For financial institutions, the AI Act is not another technology rule to hand to IT. AI already reaches across customer service, fraud detection, credit decisions, insurance and investment processes, meaning one faulty model can trigger consumer, conduct, operational, reputational and governance risks at once. That makes AI risk embedded business risk, not merely model risk.
The European Banking Authority (EBA) has explicitly mapped the Act against existing frameworks including Capital Requirements Regulation and Directive (CRR/CRD), Digital Operations Resilience Act (DORA) and consumer-credit rules, reinforcing that AI governance must connect with established financial supervision. A bank’s legal role can also change with the technology. Developing an AI system in-house may make it both provider and deployer, whereas using a third-party system typically makes it a deployer.
Creditworthiness assessment illustrates the stakes. AI used to evaluate an individual’s creditworthiness is generally classified as high-risk under the Act. Meanwhile, the EBA reports AI spreading through customer support, profiling, fraud prevention and internal processes. The practical response is therefore not another policy document gathering dust. Institutions need an AI operating model that connects system ownership, regulatory classification, data, controls, third-party dependencies and accountability across the business.
You cannot govern AI you do not know you are using. For financial institutions, that makes a living AI inventory the starting point, covering in-house models, AI embedded in vendor products and applications built on general-purpose AI. The Act’s risk-based structure distinguishes prohibited practices, high-risk systems, uses carrying transparency duties and minimal-risk applications.
Classification matters particularly in finance. AI used to evaluate a natural person’s creditworthiness or establish a credit score is listed as high-risk, while systems used specifically to detect financial fraud are excluded from that example. A simple spreadsheet, however, is unlikely to be enough. Institutions should build an AI dependency map linking each system to its models, datasets, vendors, business processes, decisions and affected customers. This also helps expose “classification drift”: a low-impact assistant today could acquire new functions tomorrow or feed into a consequential customer decision.
The Commission’s 2026 draft classification guidance reinforces the importance of intended purpose and actual decision impact. A practical response is a regulatory classification passport for every significant AI system, recording its purpose, role, risk category, dependencies and controls, and updating it whenever the system changes.
AI governance becomes dangerous when everyone is involved but nobody owns the consequences. Financial institutions therefore need clear responsibilities spanning business management, technology, data, risk, compliance and internal audit. The AI Act makes human oversight particularly important for high-risk systems, requiring overseers to have appropriate competence, training and authority. Crucially, they must be able to disregard, override or reverse an AI output. A credit officer mechanically clicking “approve” after an algorithmic recommendation is hardly meaningful oversight.
Boards need not become data scientists, but they should understand who holds decision authority, where exposure lies, which exceptions are occurring and what happens when systems fail. Third-party AI complicates this further. The EBA warns that growing reliance on external providers creates operational and concentration risks, while DORA already requires oversight of relevant ICT dependencies.
One practical innovation is an algorithmic accountability statement for significant systems. It should name who may deploy, modify, override, suspend and ultimately retire the AI. Combined with escalation mechanisms capable of actually stopping a failing process, this turns accountability from an organisational chart into operational control.
The smarter question is no longer “Is our AI compliant?” but “Can we demonstrate why we believe it is compliant?” For high-risk systems, the AI Act demands evidence through technical documentation, logging, data governance, human oversight, accuracy, robustness and cybersecurity. Crucially, records must follow the system beyond launch. A bank using AI in credit decisions, for example, should be able to reconstruct what data entered the system, what output emerged, whether a human intervened and what happened next.
That requires continuous AI assurance. Models can drift as customer behaviour, datasets and economic conditions change, while updates can introduce unexpected outputs. Monitoring should therefore test performance and emerging risks throughout the lifecycle, not simply at pre-deployment approval.
Explainability must also fit its audience. A developer needs technical detail, a compliance officer needs evidence of control, a supervisor needs traceability, and a customer needs an intelligible explanation of a consequential decision.
Think of this as AI incident forensics. When something goes wrong, can the institution replay the decision? Regulatory defensibility increasingly rests on that chain of evidence, not a beautifully written policy gathering dust.
The AI Act is a sequence of deadlines, not one regulatory big bang. Prohibited-practice and AI-literacy provisions began applying in February 2025, while enforcement powers for the AI Office and national authorities arrived in August 2026. Following the 2026 AI Omnibus, key requirements for Annex III high-risk systems, including creditworthiness assessment, apply from December 2027.
Financial institutions should therefore prioritise by regulatory exposure and decision impact, rather than attempting to fix everything simultaneously. Start with a living AI inventory, identify whether the institution is provider or deployer, and reassess high-impact applications. Then test governance and documentation gaps, tailor AI literacy to employees’ roles, review vendor contracts and information rights, and embed testing, monitoring and escalation within existing controls.
The hidden enemy is AI regulatory debt. Every poorly documented legacy model, unexplained vendor dependency or forgotten pilot becomes harder and costlier to understand as requirements mature. A bank discovering late that nobody can explain an inherited credit model faces remediation at precisely the wrong moment. The smartest rule for prioritisation is simple: fix the hardest-to-explain AI first.
The AI Act should not become a brake on innovation. Done well, governance creates institutional permission to innovate. The sequence is straightforward: identify AI, classify it, assign ownership, build evidence and monitor continuously. This matters because AI is already moving into EU banking’s mainstream. EBA research shows around 40% of EU banks using general-purpose AI, particularly in customer support and internal processes. The winners will not necessarily be those deploying the most algorithms. They will be institutions that know where AI sits, understand what it does and can demonstrate control when challenged. The competitive question is shifting from “How fast can we adopt AI?” to “How confidently can we scale it?”
– Which of your organisation’s AI applications could fall into the EU AI Act’s high-risk categories, and how robust is your current classification process?
– If an AI-driven decision caused customer harm tomorrow, would it be clear who was accountable and who had the authority to intervene?
Resources
– AI Act
European Commission
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
– AI Act: implications for the EU banking and payments sector
EBA (2025)
chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.eba.europa.eu/sites/default/files/2025-11/d8b999ce-a1d9-4964-9606-971bbc2aaf89/AI%20Act%20implications%20for%20the%20EU%20banking%20sector.pdf
– Commission starts enforcing AI Act rules and new transparency requirements on 2 August
European Commission (2026)
– European approach to artificial intelligence
European Commission
https://digital-strategy.ec.europa.eu/en/policies/european-approach-artificial-intelligence
– First rules of the Artificial Intelligence Act are now applicable
European Commission
– Risk Assessment Report – June 2026
EBA (2026)
https://www.eba.europa.eu/publications-and-media/publications/risk-assessment-report-june-2026
Contact the EIMF Team
Phone: +357 2227 4470
Email: [email protected]
Join us to gain insights from Alana Hill, learn practical strategies for turning conflict into opportunity, and discover how challenges can drive growth and stronger team performance.
On All Self-Paced eLearning CPD Courses in Financial Regulation
Hosted by the EIMF and the Chartered Governance Institute
Engage with 20+ leading experts and earn 6 CPD units in Financial Regulation.
Not sure if it’s right for you? Let’s talk.
Discount Coupon: NYNY10
Valid until 31 Jan 2025 23:59
Register now to receive a valuable educational resource each day and be automatically entered into our Grand Christmas Draw on 24th December – Don’t miss out!
On Self-Paced eLearning Courses
*complete your purchase before 21 April 2024