EU AI Act Compliance for Fintech

The Act has no fintech category. This site uses the word for AI that reaches the Act through the uses below.

• Credit scoring: Annex III point 5(b)

  AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score are high-risk. AI systems used for the purpose of detecting financial fraud are excepted. Point 5(b) names natural persons only, not companies.

• Life and health insurance: Annex III point 5(c)

  AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance are high-risk. Point 5(c) names life and health insurance only.

• Fraud detection is excluded from point 5(b)

  The exclusion covers AI systems used for the purpose of detecting financial fraud. A fraud-detection system is high-risk only if another point of Annex III or Annex I covers it.

• Other fintech uses are not named in point 5

  Point 5 does not name anti-money-laundering or know-your-customer checks, algorithmic trading, robo-advice, non-life insurance, claims handling or credit decisions about legal persons. Check each against the other points of Annex III and against Annex I before you treat it as outside the high-risk rules.

• Article 6(3) can take a system out of Annex III

  A system under point 5(b) or 5(c) is high-risk under Article 6(2). Under Article 6(3) it is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights. That includes not materially influencing the outcome of decision making. The Act applies this exception where any of the following conditions is fulfilled (Article 6(3), points (a) to (d)). The system is intended to perform a narrow procedural task. Or it is intended to improve the result of a previously completed human activity. Or it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review. Or it is intended to perform a preparatory task to an assessment relevant for the use cases listed in Annex III. How these conditions combine with the significant-risk test is a question for counsel. The system is always high-risk where it performs profiling of natural persons. Profiling is defined by Article 4(4) GDPR (Article 3(52)). Whether a given scoring or pricing system performs it is also a question for counsel. A provider that relies on the exception documents its assessment before the system is placed on the market or put into service. It must also register the system (Article 6(4), Article 49(2)).

• Other rules of the Act that can reach fintech AI

  Article 5(1), point (b) prohibits AI systems that exploit vulnerabilities of a natural person due to age, disability or a specific social or economic situation. The objective or effect must be to materially distort behaviour in a way that causes or is reasonably likely to cause significant harm. Point (c) prohibits AI systems that evaluate or classify natural persons over time based on social behaviour or personal characteristics, where the social score leads to the detrimental treatment described in that point. These prohibitions apply from 2 February 2025 (Article 113, third paragraph, point (a)). Providers of AI systems intended to interact directly with natural persons, such as a chatbot, must design them so that the persons are informed they are interacting with an AI system, unless this is obvious (Article 50(1)). This applies from 2 August 2026.

The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). Putting into service includes supply for the provider’s own use (Article 3(11)). A bank or insurer that develops a system and puts it into service under its own name is therefore a provider. A bank or insurer that uses a system under its authority is a deployer (Article 3(4)). A deployer becomes the provider in three cases. It puts its name or trademark on a high-risk system already on the market, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated. It makes a substantial modification to such a system that leaves it high-risk. Or it changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)). The provider that initially placed the system on the market or put it into service is then no longer considered the provider of that specific system, and must closely cooperate with the new provider (Article 25(2)). This does not apply where the initial provider clearly specified that its system is not to be changed into a high-risk AI system.

Providers must ensure that their high-risk systems meet the requirements of Section 2 of Chapter III, Articles 8 to 15 (Article 16, point (a)). They must also meet the other provider obligations of Article 16.

• Art. 9
  Risk management system

  A continuous iterative process over the lifecycle, with testing against prior defined metrics and probabilistic thresholds appropriate to the intended purpose.

• Art. 10
  Data and data governance

  Training, validation and testing data sets that meet the quality criteria of Article 10, including an examination for possible biases.

• Art. 12
  Logging by design

  The system must technically allow for the automatic recording of events (logs) over its lifetime.

• Art. 13
  Instructions for use

  Information that lets deployers interpret the output and use it appropriately, including the declared level of accuracy and its metrics.

• Art. 14
  Human oversight by design

  Measures that let natural persons effectively oversee the system while it is in use.

• Art. 15
  Accuracy, robustness and cybersecurity

  An appropriate level, achieved consistently throughout the lifecycle. The levels of accuracy and the relevant accuracy metrics are declared in the instructions for use.

• Art. 17
  Quality management system

  Written policies, procedures and instructions covering the aspects listed in Article 17(1), implemented in proportion to the size of the provider’s organisation (Article 17(2)).

• Art. 43(2)
  Conformity assessment

  For the systems in points 2 to 8 of Annex III, which include point 5, the provider follows the conformity assessment procedure based on internal control (Annex VI). That procedure does not provide for a notified body.

• Art. 16
  EU declaration, CE marking and registration

  The provider draws up an EU declaration of conformity and affixes the CE marking. It also registers itself and the system in the EU database before placing the system on the market or putting it into service (Article 16, points (g) to (i); Article 49(1)).

• Art. 72, 73
  Post-market monitoring and serious incidents

  The provider establishes and documents a post-market monitoring system (Article 72(1)) and reports serious incidents to the market surveillance authorities (Article 73).

• Art. 26(1), (2)
  Use as instructed, assign oversight

  Deployers take appropriate technical and organisational measures to use the system in accordance with the instructions for use. They assign human oversight to natural persons who have the necessary competence, training and authority.

• Art. 26(4)–(6)
  Input data, monitoring and logs

  To the extent they control the input data, deployers ensure it is relevant and sufficiently representative. They monitor the operation of the system on the basis of the instructions for use. They keep the logs under their control for at least six months, unless provided otherwise in applicable Union or national law.

• Art. 26(11)
  Inform the persons concerned

  Deployers of high-risk Annex III systems that make or assist decisions related to natural persons inform them that they are subject to the use of the system, without prejudice to Article 50 (Article 26(11)).

• Art. 27
  Fundamental rights impact assessment

  Before deploying a system under point 5(b) or 5(c), deployers perform an assessment of the impact on fundamental rights, whether they are public or private (Article 27(1)). The assessment consists of: a description of the deployer’s processes in which the system will be used in line with its intended purpose; the period and frequency of intended use; the categories of natural persons and groups likely to be affected; the specific risks of harm to them, taking into account the provider’s information under Article 13; a description of the human oversight measures; and the measures to be taken if those risks materialise, including internal governance and complaint mechanisms. Deployers notify the market surveillance authority of the results (Article 27(3)). Obligations already met through a data protection impact assessment can be cross-referenced (Article 27(4)).

• Art. 86
  Explanation to the affected person

  A person has a right to explanation where a deployer takes a decision on the basis of the output of a high-risk system listed in Annex III, except point 2. The decision must produce legal effects or similarly significantly affect the person in a way they consider adverse to their health, safety or fundamental rights. The person may then obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken (Article 86(1)). The right does not apply where exceptions or restrictions follow from Union or national law in compliance with Union law (Article 86(2)). It applies only to the extent the right is not otherwise provided under Union law (Article 86(3)).

The Act lets financial institutions fold some duties into the rules they already follow. The rules apply to financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law. The Act names no specific financial services law; which rules count is a question for counsel.

• Art. 17(4)
  Quality management system

  For providers that are such financial institutions, the quality management system obligation is deemed fulfilled by complying with the internal governance rules. The exceptions are the risk management system, post-market monitoring and serious incident reporting (Article 17(4)).

• Art. 18(3)
  Technical documentation

  Providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law maintain the technical documentation as part of the documentation kept under that law (Article 18(3)).

• Art. 19(2), 26(6)
  Logs

  Providers and deployers that are such financial institutions maintain the automatically generated logs as part of the documentation kept under the relevant Union financial services law (Article 19(2) and Article 26(6), second subparagraph).

• Art. 26(5)
  Deployer monitoring

  For deployers that are such financial institutions, the monitoring obligation in the first subparagraph of Article 26(5) is deemed fulfilled. The condition is compliance with the rules on internal governance arrangements, processes and mechanisms under the relevant financial services law (Article 26(5), second subparagraph).

• Art. 72(4)
  Post-market monitoring

  Providers may integrate the elements of the post-market monitoring system and plan into systems and plans that already exist, provided this achieves an equivalent level of protection. Article 72(4), second subparagraph, extends this choice to Annex III point 5 systems of such financial institutions.

• Art. 74(6)
  Supervising authority

  For high-risk systems placed on the market, put into service or used by financial institutions regulated by Union financial services law, the market surveillance authority is the national authority responsible for their financial supervision under that law. This applies in so far as the placing on the market, putting into service or use is in direct connection with the provision of those financial services (Article 74(6)).

• Dates

  The requirements for these Annex III uses apply from 2 December 2027 (Article 113, third paragraph, point (c)(i)). A system placed on the market or put into service before that date is covered only if its design changes significantly afterwards. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

• Fines

  Providers must ensure that their high-risk systems meet the requirements of Section 2 of Chapter III, which includes Articles 9 to 15 (Article 16, point (a)). A breach of the provider obligations in Article 16 or of the deployer obligations in Article 26 can be fined. The fine is up to EUR 15 million or, for an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4), points (a) and (e)). For SMEs, including start-ups, each fine is up to whichever of the two is lower (Article 99(6)). The same applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)).

• Reach and limits of the Act

  The Act applies to providers and deployers established or located in a third country where the output produced by the AI system is used in the Union (Article 2(1), point (c)). It does not apply to areas outside the scope of Union law, and it does not affect the competences of the Member States concerning national security (Article 2(3)). The Act does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). It does not apply to research, testing or development activity before a system is placed on the market or put into service. Testing in real-world conditions is not covered by that exclusion (Article 2(8)). AI systems released under free and open-source licences are outside the Act. That exclusion does not apply if they are placed on the market or put into service as high-risk AI systems, or if they fall under Article 5 or 50 (Article 2(12)).

• No fintech metrics, thresholds or standards

  The Act names no accuracy value, error-rate limit, fairness metric or technical standard for credit scoring or insurance pricing. Providers set the metrics for testing (Article 9(8)) and declare the accuracy levels and metrics in the instructions for use (Article 15(3)). The Act itself names no harmonised standard. High-risk systems that conform to harmonised standards published in the Official Journal are presumed to conform to the requirements of Section 2, to the extent those standards cover them (Article 40(1)). Systems trained and tested on data reflecting the specific geographical, behavioural, contextual or functional setting of intended use are presumed to comply with Article 10(4) (Article 42(1)). The Commission is to develop guidelines on the practical application of the requirements and obligations in Articles 8 to 15, 25 and 26 (Article 96(1), point (a)).

• Other law applies alongside the Act

  Other Union and national law, such as the GDPR and financial services law, continues to apply. This page does not describe it, and the Act names no specific financial services law.

• Example: one inventory of AI systems

  Example, not an Act requirement: a lender or insurer could keep one inventory of its AI systems. It could list for each system the Annex III classification, the Article 6(3) assessment where it relies on one, and whether the firm is provider or deployer.

Each page applies one article to credit-scoring and insurance AI.

• Article 9 for Fintech AI: Risk Management System

  Risk management system for credit-scoring and insurance AI.

• Article 10 for Fintech AI: Data and Data Governance

  Data sets, bias examination and special categories of personal data.

• Article 12 for Fintech AI: Record-Keeping and Logs

  Automatic logging and who keeps the logs.

• Article 13 for Fintech AI: Transparency and Instructions for Use

  Instructions for use and the explanation owed to affected persons.

• Article 14 for Fintech AI: Human Oversight

  Human oversight and what the Act does not require.

• Article 15 for Fintech AI: Accuracy, Robustness and Cybersecurity

  Accuracy, robustness and cybersecurity.

• Article 17 for Fintech AI: Quality Management System

  Quality management system and the financial-institution rule.

• Article 26 in Fintech: Deployer Obligations

  Deployer obligations of banks and insurers.

• Article 50 for Fintech AI: Transparency and Disclosure

  Transparency duties for chatbots and generated content.

• Article 53 in Fintech: Obligations of General-Purpose AI Model Providers

  Providers of general-purpose AI models.

• Annex III Deep Dive: All 8 High-Risk Categories

  Point 5 of Annex III in the context of all eight categories.

• Article 6: High-Risk AI System Classification

  How Article 6 classifies high-risk AI systems, including the Article 6(3) exception.

• Article 27: Fundamental Rights Impact Assessment

  The impact assessment that Article 27(1) requires from deployers under point 5(b) and 5(c).