Article 26 in Fintech: Deployer Obligations

Article 26 sets these duties for deployers of high-risk AI systems.

• Art. 26(1)
  Use according to the instructions

  Take appropriate technical and organisational measures to use the system in accordance with the instructions for use.

• Art. 26(2)
  Assign human oversight

  Assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.

• Art. 26(4)
  Check input data

  To the extent the deployer controls the input data, ensure that it is relevant and sufficiently representative for the intended purpose.

• Art. 26(5)
  Monitor, inform, suspend

  Monitor operation on the basis of the instructions for use and, where relevant, inform providers. If use in accordance with the instructions may present a risk within the meaning of Article 79(1), inform the provider or distributor and the market surveillance authority without undue delay and suspend use. After a serious incident, immediately inform the provider first, then the importer or distributor and the market surveillance authorities. If the provider cannot be reached, Article 73 applies mutatis mutandis.

• Art. 26(6)
  Keep logs

  Keep the logs the system generates automatically, to the extent they are under the deployer’s control, for a period appropriate to the intended purpose and of at least six months, unless Union or national law, in particular on the protection of personal data, provides otherwise.

• Art. 26(7)
  Inform workers

  Employers must inform workers’ representatives and the affected workers, before putting a high-risk system into service or using it at the workplace, that they will be subject to its use. This information is provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives.

• Art. 26(8)
  Public authorities register

  Deployers that are public authorities, or Union institutions, bodies, offices or agencies, must comply with the registration obligations of Article 49, which concern Annex III systems. They must not use a system that is not registered in the EU database.

• Art. 26(9)
  Data protection impact assessment

  Where applicable, use the information the provider gives under Article 13 for the data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.

• Art. 26(11)
  Inform people affected by decisions

  For Annex III systems that make or assist decisions about natural persons, inform those persons that they are subject to the use of the system, without prejudice to Article 50.

• Art. 26(12)
  Cooperate with authorities

  Cooperate with the competent authorities in any action they take in relation to the high-risk system.

Article 26 binds deployers of high-risk AI systems only. The rows below show where fintech AI becomes high-risk and which rules are specific to financial institutions.

• Fintech is not a category in the Act

  The Act has no fintech category. This site uses the word for AI that reaches the Act through two Annex III hooks: point 5(b), creditworthiness and credit scoring of natural persons, and point 5(c), risk assessment and pricing in life and health insurance. Point 5(b) excludes fraud detection. Annex III point 5 does not list anti-money-laundering checks, algorithmic trading, robo-advice, insurance other than life and health insurance, or credit assessment of legal persons. A system can still be high-risk under another point of Annex III.

• Annex III points 5(b) and 5(c)

  Annex III point 5(b) covers AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud. Point 5(c) covers AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Under Article 6(2), AI systems referred to in Annex III are considered high-risk. A provider that considers such a system not high-risk under Article 6(3) must document its assessment before the system is placed on the market or put into service, and must register it under Article 49(2). The derogation never applies where the system performs profiling of natural persons. Profiling means profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 (Article 3(52)); whether a given scoring system performs profiling is not answered by the Act.

• Provider and deployer

  The provider develops the AI system, or has it developed, and places it on the market or puts it into service under its own name (Article 3(3)); this can be a software vendor or a bank that develops a system for its own use. A natural or legal person, public authority, agency or other body that uses a system under its authority, such as a bank, insurer or lender, is a deployer (Article 3(4)). A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification that leaves the system high-risk, or changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)). Natural persons who use a system in the course of a purely personal non-professional activity are not bound as deployers (Article 2(10)). Putting its name or trademark on the system is without prejudice to contractual arrangements that allocate the obligations otherwise (Article 25(1), point (a)); the initial provider then ceases to be the provider of that system and must closely cooperate with the new provider (Article 25(2)).

• Dates

  Annex III points 5(b) and 5(c) apply from 2 December 2027 (Article 113, third paragraph, point (c)). A system placed on the market or put into service before that date is covered only if its design changes significantly afterwards; in any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

• Fines

  Breaches of provider obligations under Article 16 and of deployer obligations under Article 26 can be fined up to EUR 15 million or, for an undertaking, up to 3% of total worldwide annual turnover in the preceding financial year, whichever is higher (Article 99(4)). For SMEs, including start-ups, each fine is capped at whichever is lower (Article 99(6)). The same cap applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)). Articles 27, 49 and 86 are not listed in Article 99(3) to (5); Member States lay down the rules on penalties applicable to any infringement of the Regulation by operators (Article 99(1)).

• Limits of the Act’s scope

  The Act applies to providers that place AI systems on the market or put them into service in the Union, or place general-purpose AI models on the market in the Union, wherever they are established (Article 2(1), point (a)), and to providers and deployers in a third country where the output of the AI system is used in the Union (point (c)). It does not apply to areas outside the scope of Union law and does not affect Member States’ competences on national security, nor to AI systems used exclusively for military, defence or national security purposes (Article 2(3)).

• Financial institutions: monitoring and logs (Article 26(5) and (6))

  For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the monitoring obligation is deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms under the relevant financial services law (Article 26(5), second subparagraph). These deployers maintain the logs as part of the documentation kept under the relevant Union financial services law (Article 26(6), second subparagraph). The Act does not name the financial services law concerned.

• Fundamental rights impact assessment (Article 27)

  Article 27(1): before deploying a high-risk AI system referred to in Article 6(2), with the exception of systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law or private entities providing public services, and deployers of systems referred to in Annex III points 5(b) and 5(c), must assess the impact on fundamental rights that the use of the system may produce. For points 5(b) and 5(c) the text names the deployers of those systems without limiting them to public bodies. The duty applies to the first use; in similar cases the deployer may rely on earlier assessments (Article 27(2)). The deployer notifies the market surveillance authority of the results (Article 27(3)) and may cross-refer to a data protection impact assessment (Article 27(4)).

• Explanation of decisions (Article 86) and information (Article 26(11))

  Under Article 26(11), deployers of Annex III high-risk systems that make or assist decisions related to natural persons must inform those persons that they are subject to the use of the system. Separately, an affected person subject to a decision taken by the deployer on the basis of the output of an Annex III high-risk system (other than point 2) that produces legal effects or similarly significantly affects that person in a way they consider adverse to their health, safety or fundamental rights has the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision (Article 86(1)). This applies only to the extent the right is not otherwise provided under Union law (Article 86(3)). Paragraph 1 does not apply where exceptions or restrictions follow from Union or national law in compliance with Union law (Article 86(2)).

• Which authority enforces

  For high-risk systems placed on the market, put into service or used by financial institutions regulated by Union financial services law, the market surveillance authority is the relevant national authority responsible for the financial supervision of those institutions under that legislation, in so far as the placing on the market, putting into service or use of the system is in direct connection with the provision of those financial services (Article 74(6)). In appropriate circumstances, and provided that coordination is ensured, a Member State may identify another relevant authority (Article 74(7)).

• No staffing or training numbers

  Article 26 sets no staffing level, training hours or qualification for the people who oversee a credit or insurance system. It requires the necessary competence, training, authority and support. The Commission is to develop guidelines on the application of the requirements and obligations in Articles 8 to 15 and Articles 25 and 26 (Article 96(1), point (a)).

• Logs and financial-law retention

  Article 26(6) sets at least six months for logs under the deployer’s control and gives way to other Union or national law, in particular on personal data. The Act names no retention period from financial services law.

• Design choice: oversight roles

  A common design choice, not an Act requirement: name the oversight persons by role in the credit or underwriting procedures, and record their training.

• Human review of each decision

  Article 14(4) and Article 26(2) concern human oversight of the system. Neither says that a person must review each individual decision. Whether other law, for example on automated individual decisions, requires it is not answered by the Act.

• Article 26: Deployer Obligations for High-Risk AI

  Article 26 for all sectors: who is a deployer, the duties, Article 27 and fines.

• EU AI Act Compliance for Fintech

  The fintech overview: how the Act reaches credit-scoring and insurance AI.

• Article 17 for Fintech AI: Quality Management System

  Fintech AI and Article 17: the 13 aspects and the rule for financial institutions.

• Article 27: Fundamental Rights Impact Assessment

  Article 27 for all sectors: who must assess fundamental-rights impact and what the assessment covers.