Skip to content
Regulation (EU) 2024/1689European Union

EU AI Act (EU) 2024/1689

The AI Act regulates AI systems by risk. For banks, AI systems that evaluate the creditworthiness of natural persons or establish their credit score are high-risk (Annex III, point 5(b)). Since the 2026 Digital Omnibus, those high-risk obligations apply from 2 December 2027.

Key points

  1. 01
    Risk-based structure: prohibited practices (Article 5), high-risk AI systems (Article 6 with Annexes I and III), transparency obligations (Article 50) and rules for general-purpose AI models (Chapter V).
  2. 02
    AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are high-risk, except systems used to detect financial fraud (Annex III, point 5(b)).
  3. 03
    The Digital Omnibus on AI, Regulation (EU) 2026/1744 in force since 27 July 2026, moved the high-risk obligations for Annex III systems from 2 August 2026 to 2 December 2027.
  4. 04
    Prohibitions and AI literacy have applied since 2 February 2025; since the Omnibus, providers and deployers take measures to support the AI literacy of their staff, without having to guarantee a specific level for any individual (Article 4).
  5. 05
    Deployers of credit-scoring systems carry out a fundamental rights impact assessment before deployment (Article 27).
  6. 06
    Fines reach up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for other operator obligations, whichever is higher (Article 99).
Status
Published in the Official Journal on 12 July 2024; in force since 1 August 2024. Staged application under Article 113, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 (published 24 July 2026, in force 27 July 2026): prohibitions and AI literacy from 2 February 2025; general-purpose AI models, governance and penalties from 2 August 2025; general application, including the transparency obligations, from 2 August 2026; two new prohibitions added by the Omnibus from 2 December 2026; high-risk obligations (Chapter III, Sections 1 to 3) from 2 December 2027 for Annex III systems such as credit scoring and from 2 August 2028 for Annex I systems, instead of 2 August 2026 and 2 August 2027.

What it requires

  1. 01
    Risk classification
    Each AI system is assessed as prohibited, high-risk or subject to transparency obligations. An Annex III system is not high-risk where it poses no significant risk of harm to health, safety or fundamental rights, but it is always high-risk where it performs profiling of natural persons (Article 6(3)).
  2. 02
    Deployer obligations for high-risk systems
    Use in line with the instructions for use, human oversight by persons with the necessary competence, training and authority, relevant and representative input data where the deployer controls it, monitoring, logs kept for at least six months, and information to affected natural persons (Article 26). For financial institutions, the monitoring obligation is deemed fulfilled by complying with internal governance rules under Union financial services law (Article 26(5)).
  3. 03
    Fundamental rights impact assessment
    Before deploying a system under Annex III, point 5(b), the deployer assesses the impact on fundamental rights (Article 27(1)). Since the Omnibus, the assessment may cross-refer to the data protection impact assessment under the GDPR (Article 27(4)).
  4. 04
    Provider obligations for in-house systems
    A bank that develops a high-risk system and puts it into service under its own name is a provider (Article 3(3)): quality management system, technical documentation and the conformity assessment based on internal control for Annex III points 2 to 8 (Article 43(2)). For financial institutions, the quality management system is deemed fulfilled, with stated exceptions, by complying with internal governance rules under Union financial services law (Article 17(4)).
  5. 05
    AI literacy
    Providers and deployers take measures to support the AI literacy of their staff and of other persons operating AI systems on their behalf, taking into account their knowledge and the context of use (Article 4, as replaced by Regulation (EU) 2026/1744).

What it means for the board and executive management

  1. 01
    Credit decisions on natural persons that rely on AI fall into the high-risk regime; the board should know which systems qualify and whether the bank acts as provider or deployer for each.
  2. 02
    The new date of 2 December 2027 defers the Annex III high-risk obligations but is not an exemption; prohibitions and AI literacy have applied since 2 February 2025.
  3. 03
    Human oversight must be assigned to persons with the necessary competence, training and authority (Article 26(2)), which ties AI deployment to governance and staffing decisions.
  4. 04
    Exposure extends beyond EU entities: the Act covers providers and deployers in third countries where the output of the AI system is used in the EU (Article 2(1)(c)).
In MRM-Solution

How MRM-Solution supports it

  1. 01Keep every model in one inventory with owner, tier, EU AI Act risk class and re-validation dates, linked to the committees that approve its use.
  2. 02Derive the requirements into each policy’s register, every row with its origin, and count a row only after a person has approved it.
  3. 03Treat AI findings as proposals: a verdict counts only after a person has confirmed it against the exact texts.
  4. 04Keep an append-only audit trail of who changed what, when and in which role, plus a change log per policy.
Book a demo

Questions executives ask

Is our credit scoring a high-risk AI system?

Yes, if it is an AI system intended to evaluate the creditworthiness of natural persons or establish their credit score (Annex III, point 5(b)); systems used to detect financial fraud are excepted, and the point covers natural persons only. An Annex III system can fall outside the high-risk category if it poses no significant risk of harm, but never where it performs profiling of natural persons (Article 6(3)).

When do the high-risk obligations apply after the Digital Omnibus?

Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July 2026, amended Article 113: Chapter III, Sections 1 to 3, applies from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, including credit scoring, and from 2 August 2028 for systems under Article 6(1) and Annex I. The original dates were 2 August 2026 and 2 August 2027.

Does the AI Act apply to a Swiss bank?

It applies to deployers established in the EU, so to EU subsidiaries, and to providers placing AI systems on the EU market wherever they are established. It also covers providers and deployers established in a third country where the output produced by the AI system is used in the EU (Article 2(1)(c)), which a bank serving EU clients from Switzerland must assess per use case.

Sources

Executive summary for orientation, not legal advice. The official text prevails.
Regulatory hub

Related regulations

All regulations →
Glossary

Related terms

All glossary terms →

Too good to be true? Then we should talk.

30 minutes. Your use case, maximum impact.

info@mrm-solution.com
Area of interest