Article 13 for Fintech AI: Transparency and Instructions for Use

Article 13 sets duties for the provider towards the deployer. It sets no duty to explain a decision to an applicant or customer.

• Art. 13(1)
  Transparency that lets deployers interpret outputs

  High-risk AI systems must be designed and developed so that their operation is sufficiently transparent to enable deployers to interpret the output and use it appropriately. An appropriate type and degree of transparency must be ensured, so that the provider and the deployer can meet their obligations in Section 3.

• Art. 13(2)
  Instructions for use

  High-risk systems must be accompanied by instructions for use in an appropriate digital format or otherwise. They must contain concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers.

• Art. 13(3)(a), (b)
  Minimum content: provider, performance and limits

  The instructions must contain at least the provider’s identity and contact details, and the characteristics, capabilities and limitations of performance of the system. These include its intended purpose. They include the level of accuracy, including its metrics, robustness and cybersecurity against which the system was tested and validated and which can be expected, and known circumstances that may affect it. They include known or foreseeable circumstances that may lead to risks to health, safety or fundamental rights. Where applicable or appropriate, they also include the technical capabilities to explain the output, the performance for specific persons or groups, specifications for input data, and information that lets deployers interpret the output.

• Art. 13(3)(c)–(f)
  Changes, oversight, resources and logs

  The instructions must also state the changes pre-determined by the provider at the initial conformity assessment, if any, and the human oversight measures under Article 14. They must state the computational and hardware resources needed, the expected lifetime and the maintenance measures, including software updates. Where relevant, they describe the mechanisms that let deployers collect, store and interpret the logs in line with Article 12.

Article 13 applies to high-risk AI systems only. The rows below show where fintech AI becomes high-risk.

• Fintech is not a category in the Act

  The Act has no fintech category. This site uses the word for AI that reaches the Act through two uses in Annex III, point 5. Point 5(b) covers AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score. It makes an exception for AI systems used for the purpose of detecting financial fraud. Point 5(c) covers AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Point 5 does not name fraud detection, anti-money-laundering or know-your-customer checks, algorithmic trading, robo-advice, non-life insurance, claims handling or credit decisions about legal persons. A system for one of these uses is high-risk only if another point of Annex III or Annex I covers it.

• Article 6(3) can take a system out of Annex III

  A system under point 5(b) or 5(c) is high-risk under Article 6(2). Under Article 6(3) it is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights. That includes not materially influencing the outcome of decision making. The Act applies this exception where any of the following conditions is fulfilled (Article 6(3), points (a) to (d)). The system is intended to perform a narrow procedural task. Or it is intended to improve the result of a previously completed human activity. Or it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review. Or it is intended to perform a preparatory task to an assessment relevant for the use cases listed in Annex III. How these conditions combine with the significant-risk test is a question for counsel. The system is always high-risk where it performs profiling of natural persons. Profiling is defined by Article 4(4) GDPR (Article 3(52)). Whether a given scoring or pricing system performs it is also a question for counsel. A provider that relies on the exception documents its assessment before the system is placed on the market or put into service. It must also register the system (Article 6(4), Article 49(2)).

• Provider and deployer

  The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). Putting into service includes supply for the provider’s own use (Article 3(11)). A bank or insurer that develops a system and puts it into service under its own name is therefore a provider. A bank or insurer that uses a system under its authority is a deployer (Article 3(4)). A deployer becomes the provider in three cases. It puts its name or trademark on a high-risk system already on the market, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated. It makes a substantial modification to such a system that leaves it high-risk. Or it changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)). The provider that initially placed the system on the market or put it into service is then no longer considered the provider of that specific system, and must closely cooperate with the new provider (Article 25(2)). This does not apply where the initial provider clearly specified that its system is not to be changed into a high-risk AI system.

• Explaining a decision to an applicant is not Article 13

  Article 86(1) gives a right to explanation. It applies where a deployer takes a decision on the basis of the output of an Annex III high-risk system, except point 2. The decision must produce legal effects or similarly significantly affect the person in a way they consider adverse to their health, safety or fundamental rights. The person then has the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken. The right does not apply where exceptions or restrictions follow from Union or national law in compliance with Union law (Article 86(2)). It applies only to the extent the right is not otherwise provided under Union law (Article 86(3)). Deployers of Annex III systems that make or assist decisions related to natural persons must also inform them that they are subject to the use of the system (Article 26(11)).

• Dates

  The requirements for these Annex III uses apply from 2 December 2027 (Article 113, third paragraph, point (c)(i)). A system placed on the market or put into service before that date is covered only if its design changes significantly afterwards. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

• Fines

  Providers must ensure that their high-risk systems meet the requirements of Section 2 of Chapter III, which includes Articles 9 to 15 (Article 16, point (a)). A breach of the provider obligations in Article 16 or of the deployer obligations in Article 26 can be fined. The fine is up to EUR 15 million or, for an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4), points (a) and (e)). For SMEs, including start-ups, each fine is up to whichever of the two is lower (Article 99(6)). The same applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)).

• Reach and limits of the Act

  The Act applies to providers and deployers established or located in a third country where the output produced by the AI system is used in the Union (Article 2(1), point (c)). It does not apply to areas outside the scope of Union law, and it does not affect the competences of the Member States concerning national security (Article 2(3)). The Act does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). It does not apply to research, testing or development activity before a system is placed on the market or put into service. Testing in real-world conditions is not covered by that exclusion (Article 2(8)). AI systems released under free and open-source licences are outside the Act. That exclusion does not apply if they are placed on the market or put into service as high-risk AI systems, or if they fall under Article 5 or 50 (Article 2(12)).

• No fintech disclosure format

  The Act names no format, template or wording for instructions for use in lending or insurance. The provider decides how to present the items required by Article 13(3). The Act itself names no harmonised standard. High-risk systems that conform to harmonised standards published in the Official Journal are presumed to conform to the requirements of Section 2, to the extent those standards cover them (Article 40(1)). The Commission is to develop guidelines on the practical application of the requirements and obligations in Articles 8 to 15, 25 and 26 (Article 96(1), point (a)).

• Example: content for a credit-scoring system

  Example, not an Act requirement: instructions for use of a credit-scoring system could state the data the model needs and the population on which its accuracy was measured. They could also name the cases in which its output should not be used alone.

• Example: input data the deployer controls

  Example, not an Act requirement: instructions for use could list the bank-side inputs the model depends on, so that a deployer that controls input data can meet Article 26(4).

• EU AI Act Article 13: Transparency and Instructions for Use

  Article 13 for all sectors: the requirements, dates and fines.

• EU AI Act Compliance for Fintech

  The fintech overview: how the Act reaches credit-scoring and insurance AI.

• Article 14 for Fintech AI: Human Oversight

  Fintech AI and Article 14: oversight by natural persons and what the Act does not require.

• Annex III Deep Dive: All 8 High-Risk Categories

  The Annex III categories, including point 5 on credit scoring and life and health insurance.