The EU AI Act and Financial Services: How are Financial Institutions impacted?

On August 1, 2024, the European Union’s AI Act came into force—the world’s first legal framework regulating artificial intelligence. Designed to balance innovation and risk, this regulation introduces a series of staggered compliance deadlines, with most provisions becoming fully applicable by mid-2026. However, some prohibited AI uses, such as real-time biometric surveillance in public spaces, will be banned within six months.

Fines for non-compliance will also be severe, reaching up to 7% of global annual turnover for violations involving banned AI applications.

The AI Act’s compliance obligations are still evolving, but organizations must start preparing now. The act introduces risk-based classification for AI systems and imposes specific requirements on developers and providers, particularly in regulated industries like financial services.

In the meantime, a lot has been written about this regulation. Supporters praise the EU’s proactive stance, emphasizing the need for transparency, security, and ethical standards in one of the most disruptive technologies to date. Critics argue that the regulation comes too soon, as AI is still evolving, and its full potential remains uncertain. Some believe it could place the EU at a competitive disadvantage, creating barriers for startups and smaller firms that lack the resources to comply.

Yet, well-designed regulation can drive long-term competitiveness. Companies that integrate security, privacy, and ethics early may avoid costly retrofitting later as global standards evolve. Additionally, trust-driven industries such as financial services may benefit from greater consumer confidence in AI systems that meet stringent EU standards.

The AI Act categorizes AI systems into five risk levels, each with specific obligations:

Unacceptable Risk: AI systems which pose an unacceptable risk are outright banned under the AI Act. This includes AI applications that manipulate human behavior, use real-time remote biometric identification (e.g. facial recognition in public spaces) or implement social scoring (ranking individuals based on personal characteristics, socio-economic status or behavior). However, AI systems used for military, national security or pure scientific research and development are exempted from this category.
High Risk: AI systems used for biometric and facial recognition, medical applications, education, employment, and certain public sector functions are classified as high-risk and must comply with strict regulations. While these AI applications are permitted, they must adhere to strict regulations governing both the AI system itself and its provider. This includes thorough documentation, pre-market conformity assessments and potential regulatory audits.

General-Purpose AI (GPAI): This category primarily includes foundation models such as ChatGPT. Unless the weights and model architecture are released under a free and open-source license, in which case only a training data summary and a copyright compliance policy are required, GPAI systems must comply with transparency requirements. Additionally, high-impact general-purpose AI systems must undergo a rigorous evaluation process to assess potential systemic risks.

Limited Risk: AI systems with limited risks, such as chatbots and image and video generative AI must meet transparency requirements to ensure users are aware they are interacting with AI. The EU’s primary focus for this category is on reducing manipulation risks and ensuring transparency. This includes obligations to provide a summary of training data and to implement policies ensuring copyright compliance, among other requirements.
Minimal Risk: Most AI systems fall into this category and are encouraged to self-regulate. Examples include AI used in video games and spam filters. Since these applications are considered low risk, they face minimal regulatory requirements under the AI Act.

This tiered approach ensures that regulatory efforts focus on high-impact AI, while allowing low-risk innovation to continue with minimal constraints.

Financial services have been identified as one of the sectors where AI could have the most significant impact. The regulation defines two high-risk AI use cases in finance:

Creditworthiness assessments (AI models used to approve/reject loans)
AI-driven risk assessment & pricing for life and health insurance

AI-powered fraud detection, money laundering prevention, customer due diligence, credit scoring, algorithmic trading, investment optimization, insurance underwriting, and robo-advisors all fall under the AI Act. These applications will now require greater transparency, bias mitigation and regulatory oversight.

The AI Act also references existing EU financial services laws, particularly those covering internal governance and risk management. These laws will continue to apply to financial institutions using AI. EU financial regulators will oversee AI Act implementation within financial services, including market surveillance and enforcement.

One of the biggest challenges for financial institutions is proving compliance with the AI Act’s rigorous standards, particularly in areas like transparency, fairness, accountability, and oversight. For large financial institutions, the number of AI systems could be in the hundreds. Those that developed or deployed AI before the AI Act came into effect will need to reassess whether these systems comply with the new regulations. Consumer protection provisions in the Act may also require modifications to existing systems.

Additionally, financial firms must determine their role under the AI Act:

Providers: Those developing AI systems must ensure compliance from the outset.
Deployers: Those using third-party AI solutions must verify compliance and manage risks related to misuse or malfunction.

To navigate this, financial institutions should:

Identify AI Systems – Catalog all AI applications and classify them under the AI Act’s risk framework.
Assess Impact – Map AI Act requirements to existing policies (e.g. Model Risk Management, Data Protection, Third-Party Risk Management).
Strengthen Documentation – Ensure AI models have transparent training data records, bias assessments, and regulatory compliance reports.
Review Third-Party AI Systems – Both providers and deployers share responsibility for compliance. Institutions customizing third-party AI must evidence additional controls.
Enhance Governance – Align AI oversight with EU financial regulations, ensuring compliance with risk management, transparency, and fairness.
Customer Communication – Inform clients when high-risk AI systems impact their data or financial decisions.

While the AI Act introduces new compliance burdens, it also presents opportunities. Financial institutions that embrace transparency and risk management early may gain a competitive edge as global AI regulations evolve. By taking proactive steps now, financial services firms can turn compliance into an advantage—ensuring trust, efficiency, and resilience in an AI-driven future.

Comments

Transforming the insurance sector to an Open API Ecosystem

1. Introduction "Open" has recently become a new buzzword in the financial services industry, i.e. open data, open APIs, Open Banking, Open Insurance …, but what does this new buzzword really mean? "Open" refers to the capability of companies to expose their services to the outside world, so that external partners or even competitors can use these services to bring added value to their customers. This trend is made possible by the technological evolution of open APIs (Application Programming Interfaces), which are the digital ports making this communication possible. Together companies, interconnected through open APIs, form a true API ecosystem , offering best-of-breed customer experience, by combining the digital services offered by multiple companies. In the technology sector this evolution has been ongoing for multiple years (think about the travelling sector, allowing you to book any hotel online). An excelle...

RPA - The miracle solution for incumbent banks to bridge the automation gap with neo-banks?

Hypes and marketing buzz words are strongly present in the IT landscape. Often these are existing concepts, which have evolved technologically and are then renamed to a new term, as if it were a brand new technology or concept. If you want to understand and assess these new trends, it is important to reduce the concepts to their essence and compare them with existing technologies , e.g. Integration (middleware) software ensures that 2 separate applications or components can be integrated in an easy way. Of course, there is a huge evolution in the protocols, volumes of exchanged data, scalability, performance…, but in essence the problem remains the same. Nonetheless, there have been multiple terms for integration software such as ETL, ESB, EAI, SOA, Service Mesh… Data storage software ensures that data is stored in such a way that data is not lost and that there is some kind guaranteed consistency, maximum availability and scalability, easy retrieval...

IoT - Revolution or Evolution in the Financial Services Industry

1. The IoT hype We have all heard about the "Internet of Things" (IoT) as this revolutionary new technology, which will radically change our lives. But is it really such a revolution and will it really have an impact on the Financial Services Industry? To refresh our memory, the Internet of Things (IoT) refers to any object , which is able to collect data and communicate and share this information (like condition, geolocation…) over the internet . This communication will often occur between 2 objects (i.e. not involving any human), which is often referred to as Machine-to-Machine (M2M) communication. Well known examples are home thermostats, home security systems, fitness and health monitors, wearables… This all seems futuristic, but smartphones, tablets and smartwatches can also be considered as IoT devices. More importantly, beside these futuristic visions of IoT, the smartphone will most likely continue to be the cent...

PSD3: The Next Phase in Europe’s Payment Services Regulation

With the successful rollout of PSD2, the European Union (EU) continues to advance innovation in the payments domain through the anticipated introduction of the Payment Services Directive 3 (PSD3) . On June 28, 2023, the European Commission published a draft proposal for PSD3 and the Payment Services Regulation (PSR) . The finalized versions of this directive and associated regulation are expected to be available by late 2024, although some predictions suggest a more likely timeline of Q2 or Q3 2025. Given that member states are typically granted an 18-month transition period, PSD3 is expected to come into effect sometime in 2026. Notably, the Commission has introduced a regulation (PSR) alongside the PSD3 directive, ensuring more harmonization across member states as regulations are immediately effective and do not require national implementation, unlike directives. PSD3 shares the same objectives as PSD2, i.e. increasing competition in the payments landscape and en...

Trade-offs Are Inevitable in Software Delivery - Remember the CAP Theorem

In the world of financial services, the integrity of data systems is fundamentally reliant on non-functional requirements (NFRs) such as reliability and security. Despite their importance, NFRs often receive secondary consideration during project scoping, typically being reduced to a generic checklist aimed more at compliance than at genuine functionality. Regrettably, these initial NFRs are seldom met after delivery, which does not usually prevent deployment to production due to the vague and unrealistic nature of the original specifications. This common scenario results in significant end-user frustration as the system does not perform as expected, often being less stable or slower than anticipated. This situation underscores the need for better education on how to articulate and define NFRs , i.e. demanding only what is truly necessary and feasible within the given budget. Early and transparent discussions can lead to system architecture being tailored more close...

An overview of 1-year blogging

Last week I published my 60th post on my blog called Bankloch (a reference to "Banking" and my family name). The past year, I have published a blog on a weekly basis, providing my humble personal vision on the topics of Fintech, IT software delivery and mobility. This blogging has mainly been a personal enrichment , as it forced me to dive deep into a number of different topics, not only in researching for content, but also in trying to identify trends, innovations and patterns into these topics. Furthermore it allowed me to have several very interesting conversations and discussions with passionate colleagues in the financial industry and to get more insights into the wonderful world of blogging and more general of digital marketing, exploring subjects and tools like: Search Engine Optimization (SEO) LinkedIn post optimization Google Search Console Google AdWorks Google Blogger Thinker360 Finextra … Clearly it is not easy to get the necessary ...

Low- and No-code platforms - Will IT developers soon be out of a job?

“ The future of coding is no coding at all ” - Chris Wanstrath (CEO at GitHub). Mid May I posted a blog on RPA (Robotic Process Automation - https://bankloch.blogspot.com/2020/05/rpa-miracle-solution-for-incumbent.html ) on how this technology, promises the world to companies. A very similar story is found with low- and no-code platforms, which also promise that business people, with limited to no knowledge of IT, can create complex business applications. These platforms originate , just as RPA tools, from the growing demand for IT developments , while IT cannot keep up with the available capacity. As a result, an enormous gap between IT teams and business demands is created, which is often filled by shadow-IT departments, which extend the IT workforce and create business tools in Excel, Access, WordPress… Unfortunately these tools built in shadow-IT departments arrive very soon at their limits, as they don’t support the required non-functional requirements (like h...

AI in Financial Services - A buzzword that is here to stay!

In a few of my most recent blogs I tried to demystify some of the buzzwords (like blockchain, Low- and No-Code platforms, RPA…), which are commonly used in the financial services industry. These buzzwords often entail interesting innovations, but contrary to their promise, they are not silver bullets solving any problem. Another such buzzword is AI (or also referred to as Machine Learning, Deep Learning, Enforced Learning… - the difference between those terms put aside). Again this term is also seriously hyped, creating unrealistic expectations, but contrary to many other buzzwords, this is something I truly believe will have a much larger impact on the financial services industry than many other buzzwords. This opinion is backed by a study of McKinsey and PWC indicating that 72% of company leaders consider that AI will be the most competitive advantage of the future and that this technology will be the most disruptive force in the decades to come. Deep Lea...

The UPI Phenomenon: From Zero to 10 Billion

If there is one Indian innovation that has grabbed global headlines , it is undoubtedly the instant payment system UPI (Unified Payments Interface) . In August 2023, monthly UPI transactions exceeded an astounding 10 billion, marking a remarkable milestone for India’s payments ecosystem. No wonder that UPI has not only revolutionized transactions in India but has also gained international recognition for its remarkable growth. Launched in 2016 by the National Payments Corporation of India (NPCI) in collaboration with 21 member banks, UPI quickly became popular among consumers and businesses. In just a few years, it achieved remarkable milestones : By August 2023, UPI recorded an unprecedented 10.58 billion transactions , with an impressive 50% year-on-year growth. This volume represented approximately 190 billion euros . In July 2023, the UPI network connected 473 different banks . UPI is projected to achieve a staggering 1 ...

Are product silos in a bank inevitable?

Silo thinking is often frowned upon in the industry. It is often a synonym for bureaucratic processes and politics and in almost every article describing the threats of new innovative Fintech players on the banking industry, the strong bank product silos are put forward as one of the main blockages why incumbent banks are not able to (quickly) react to the changing customer expectations. Customers want solutions to their problems and do not want to be bothered about the internal organisation of their bank. Most banks are however organized by product domain (daily banking, investments and lending) and by customer segmentation (retail banking, private banking, SMEs and corporates). This division is reflected both at business and IT side and almost automatically leads to the creation of silos. It is however difficult to reorganize a bank without creating new silos or introducing other types of issues and inefficiencies. An organization is never ideal and needs to take a numbe...

Bankloch

Search This Blog