EU AI Act for Financial Services AI: Compliance Requirements

Financial services firms have long been early adopters of artificial intelligence. From credit scoring algorithms and insurance risk models to fraud detection systems and algorithmic trading engines, AI permeates nearly every function in modern banking and finance. With the EU AI Act now in force, financial institutions face a layered regulatory landscape that demands careful attention to both sector-specific rules and the new horizontal AI framework.

This guide breaks down exactly what the EU AI Act requires of financial services organizations, where it intersects with existing regulations like MiFID II and DORA, and how compliance teams can build a practical roadmap for meeting these obligations before the enforcement deadlines arrive.

Why Financial Services AI Attracts High-Risk Classification

The EU AI Act classifies AI systems according to the risk they pose to fundamental rights and safety. Under Annex III, point 5(b), AI systems used to evaluate the creditworthiness of natural persons or to establish their credit score are explicitly designated as high-risk. This is not a grey area or a matter of interpretation. If your organization uses AI to assess whether a consumer qualifies for a loan, a mortgage, or a credit card, that system falls squarely within the high-risk category.

Beyond credit scoring, Annex III captures several additional financial use cases:

• Insurance risk assessment: AI systems that set insurance premiums or determine eligibility based on risk profiling of individuals.
• Customer creditworthiness assessment: Any AI-driven evaluation of a natural person's ability to repay debt or meet financial obligations.
• Access to essential services: AI that determines whether an individual can access a bank account or other essential financial services.

Fraud detection AI and algorithmic trading systems may not appear explicitly in Annex III, but they can still trigger high-risk classification depending on how they are deployed and whether they impact individuals' access to financial services. Compliance teams should conduct a thorough risk assessment for every AI system in their portfolio rather than assuming any system is automatically exempt.

High-Risk Obligations for Financial AI Systems

Once an AI system is classified as high-risk, the EU AI Act imposes a comprehensive set of requirements under Articles 8 through 15. For financial institutions, these translate into concrete operational demands.

Risk Management System (Article 9)

Financial institutions must establish and maintain a risk management system for each high-risk AI system. This is not a one-time exercise. The risk management system must operate as a continuous, iterative process throughout the entire lifecycle of the AI system. For a credit scoring model, this means:

• Identifying and analyzing known and reasonably foreseeable risks to health, safety, and fundamental rights.
• Estimating and evaluating risks that may emerge when the system is used in accordance with its intended purpose and under conditions of reasonably foreseeable misuse.
• Adopting appropriate risk management measures, including design choices and technical safeguards.
• Testing the system to identify the most appropriate risk management measures.

For financial AI, particular attention must be paid to the risk of discriminatory outcomes. A credit scoring model that systematically disadvantages applicants based on protected characteristics such as ethnicity, gender, or age represents both an AI Act violation and a breach of existing anti-discrimination law.

Data Governance (Article 10)

Article 10 sets out strict requirements for training, validation, and testing data. Financial institutions must ensure that datasets used to develop credit scoring, insurance pricing, or creditworthiness models meet specific quality criteria:

• Training data must be relevant, sufficiently representative, and as free of errors as possible.
• Data must reflect the specific geographical, contextual, behavioral, or functional setting in which the AI system is intended to operate.
• Where personal data is processed, appropriate data governance measures must be in place, including data collection protocols, data preparation operations, and assessments of data availability, quantity, and suitability.

For financial services, this requirement intersects directly with GDPR obligations around data minimization and purpose limitation. Compliance teams must build processes that satisfy both frameworks simultaneously. Our EU AI Act vs GDPR comparison explores this intersection in detail.

Technical Documentation (Article 11)

Every high-risk AI system must have comprehensive technical documentation prepared before it is placed on the market or put into service. For financial AI systems, this documentation must include:

• A general description of the AI system, its intended purpose, and the provider's identity.
• A detailed description of the elements of the AI system and the development process, including training methodologies, design specifications, and system architecture.
• Information about the monitoring, functioning, and control of the system.
• A detailed description of the risk management system.
• Information about the performance of the system, including accuracy metrics, robustness measures, and cybersecurity provisions.

Financial institutions accustomed to model documentation under the ECB's Guide to Internal Models or the PRA's model risk management expectations will find some overlap, but the AI Act's documentation requirements are broader in scope and explicitly oriented toward fundamental rights protection.

Record-Keeping and Logging (Article 12)

High-risk AI systems must be designed to enable automatic recording of events (logs) during operation. For credit scoring and insurance AI, this means maintaining logs that allow for:

• Traceability of the system's operation.
• Monitoring of the system's performance over time.
• Post-market surveillance and investigation of incidents.

Logs must be retained for a period appropriate to the intended purpose of the system, and in any case for no less than six months unless otherwise provided by applicable Union or national law. Given that financial regulations often require longer retention periods, institutions should align their AI logging with existing record-keeping obligations.

Human Oversight (Article 14)

AI systems classified as high-risk must be designed to allow effective human oversight. In the financial services context, this means that credit decisions, insurance pricing determinations, and fraud detection alerts generated by AI must be subject to meaningful human review. The Act requires that human overseers:

• Fully understand the capabilities and limitations of the AI system.
• Be able to correctly interpret the system's output.
• Be able to decide not to use the system, override the output, or reverse an automated decision.
• Be able to intervene in the system's operation or interrupt it through a stop button or similar procedure.

This requirement has significant implications for straight-through processing (STP) in lending. Fully automated credit decisions with no human involvement may not satisfy Article 14 unless the institution can demonstrate that the system's design incorporates effective override mechanisms and that staff are trained and empowered to use them.

Overlap with Existing Financial Regulation

The EU AI Act does not exist in isolation. Financial institutions must navigate its requirements alongside a dense web of sector-specific regulation.

MiFID II and Algorithmic Trading

The Markets in Financial Instruments Directive II (MiFID II) already imposes requirements on algorithmic trading systems, including risk controls, testing obligations, and record-keeping. The AI Act adds a new dimension: where an algorithmic trading system incorporates AI capabilities that meet the Act's definition, it may need to comply with both MiFID II's algorithmic trading rules and the AI Act's requirements for high-risk systems.

Firms using AI for order execution, market-making, or portfolio optimization should assess whether their systems fall within the AI Act's scope and, if so, how to integrate AI Act compliance into their existing MiFID II frameworks.

DORA (Digital Operational Resilience Act)

The Digital Operational Resilience Act (DORA), which became applicable in January 2025, establishes requirements for ICT risk management, incident reporting, and digital operational resilience testing across the financial sector. AI systems are a form of ICT, and institutions must ensure their AI risk management practices align with DORA's broader ICT risk framework.

Key areas of overlap include:

• Third-party risk management: Where AI systems are procured from external providers, DORA's requirements for managing ICT third-party risk apply alongside the AI Act's obligations for deployers of high-risk AI.
• Incident reporting: AI system failures that result in operational incidents may trigger reporting obligations under both DORA and the AI Act.
• Testing: DORA's digital operational resilience testing requirements may need to incorporate AI-specific testing mandated by the AI Act.

Anti-Money Laundering (AML) AI

AI systems used for anti-money laundering and counter-terrorism financing (AML/CTF) occupy a unique position. While these systems serve critical regulatory compliance functions, they also process sensitive personal data and can generate significant consequences for individuals whose transactions are flagged. Financial institutions must ensure that their AML AI systems:

• Comply with the AI Act's transparency and documentation requirements.
• Maintain appropriate human oversight so that suspicious activity reports (SARs) are reviewed by qualified personnel.
• Are regularly tested for bias and accuracy to avoid disproportionate impacts on specific demographic groups.
• Satisfy GDPR requirements for lawful processing, including the legal basis for profiling.

Bias Testing and Fairness Requirements

Bias in financial AI is not merely a compliance risk; it is a reputational and legal liability. The EU AI Act reinforces existing non-discrimination obligations by requiring that high-risk AI systems be designed and developed to minimize the risk of biased outputs.

For financial institutions, this means implementing rigorous bias testing protocols for credit scoring, insurance pricing, and customer segmentation models. Best practices include:

• Pre-deployment bias audits: Testing the model against protected characteristics before it goes live.
• Ongoing monitoring: Continuously tracking model outputs for disparate impact across demographic groups.
• Corrective mechanisms: Establishing processes to retrain or adjust models when bias is detected.
• Documentation: Recording all bias testing activities, results, and remediation steps as part of the technical documentation required under Article 11.

The European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA) are expected to issue further guidance on AI fairness in financial services, and institutions should monitor these developments closely.

Deployer Obligations for Financial Institutions

Most financial institutions will operate as deployers rather than providers of AI systems under the EU AI Act. Deployer obligations under Article 26 require financial institutions to:

• Use high-risk AI systems in accordance with the provider's instructions for use.
• Ensure that input data is relevant and sufficiently representative for the system's intended purpose.
• Monitor the operation of the AI system and inform the provider or distributor of any serious incidents or malfunctions.
• Conduct a fundamental rights impact assessment before deploying high-risk AI systems (for entities governed by Union law in the banking and insurance sectors, this assessment may be integrated into existing impact assessment procedures).
• Maintain logs generated by the high-risk AI system for a period appropriate to the system's intended purpose.
• Inform individuals that they are subject to a decision made by or with the assistance of a high-risk AI system.

The fundamental rights impact assessment (FRIA) is a new obligation that does not have a direct equivalent in current financial regulation. Financial institutions should begin developing FRIA templates and processes now, drawing on their experience with Data Protection Impact Assessments (DPIAs) under the GDPR. For a full walkthrough of all compliance requirements, see our EU AI Act Compliance Checklist.

Practical Compliance Roadmap for Financial Services

Building compliance is a multi-phase effort. Here is a pragmatic approach for financial institutions:

Phase 1: AI Inventory and Classification (Q2 2026)

Conduct a comprehensive inventory of all AI systems in use across the organization. For each system, determine whether it falls within the AI Act's scope, classify its risk level, and identify whether the institution is acting as a provider or deployer.

Phase 2: Gap Analysis and Documentation (Q3 2026)

For each high-risk AI system, perform a gap analysis against the Act's requirements. Prioritize technical documentation, risk management systems, and data governance measures. Begin preparing fundamental rights impact assessments.

Phase 3: Remediation and Implementation (Q4 2026 - Q1 2027)

Address identified gaps through technical remediation, process development, and organizational changes. Implement bias testing protocols, logging mechanisms, and human oversight procedures. Train staff on their obligations under the AI Act.

Phase 4: Ongoing Compliance and Monitoring (Continuous)

Establish ongoing monitoring processes to ensure continued compliance. Integrate AI Act obligations into existing compliance management systems, internal audit programs, and risk reporting frameworks.

Penalties for Non-Compliance

The consequences of failing to comply with the EU AI Act are severe. Financial institutions that violate the Act's requirements for high-risk AI systems face administrative fines of up to 15 million EUR or 3% of total worldwide annual turnover, whichever is higher. For prohibited practices, fines rise to 35 million EUR or 7% of turnover. These penalties apply on top of any sanctions imposed under existing financial regulation. For a complete breakdown, see our guide on EU AI Act fines and enforcement.

Getting Started

Financial institutions that have not yet begun their EU AI Act compliance journey should act now. The deadlines are approaching, and the complexity of aligning AI Act obligations with existing financial regulation demands careful planning and cross-functional coordination.

An effective starting point is a structured compliance assessment that maps your AI systems against the Act's requirements and identifies the most critical gaps.

Start Your Free Compliance Assessment

The intersection of AI regulation and financial services law will continue to evolve as supervisory authorities issue guidance and enforcement begins. Financial institutions that invest in robust AI governance now will be better positioned to adapt to future regulatory developments and to maintain the trust of their customers and regulators alike. For a comparative review of tools that can help streamline compliance, consult our analysis of the best EU AI Act compliance tools.