AI Act (Artificial Intelligence Act)

What it is

The Artificial Intelligence Act is an EU regulation that entered into force on 1 August 2024. It applies to providers that place AI systems on the EU market and to deployers that use them in their activities, wherever the provider is based. It follows a risk-based approach with four layers:

• Prohibited practices, such as social scoring or manipulative techniques that cause harm, banned since 2 February 2025.
• High-risk AI systems, listed in Annex I (safety components of regulated products) and Annex III (uses such as recruitment, creditworthiness assessment of natural persons, and risk assessment and pricing in life and health insurance).
• Transparency obligations for some systems, for example telling people they are talking to a chatbot.
• Rules for general-purpose AI models, applying since 2 August 2025.

An amending regulation adopted in 2026, Regulation (EU) 2026/1744, moved the application date for Annex III high-risk systems to 2 December 2027 and for Annex I systems to 2 August 2028.

Why it matters

Banks and insurers are deployers, and sometimes providers, of AI systems in the high-risk list. Providers of high-risk systems need a risk management system, data governance, technical documentation, logging, human oversight, accuracy and robustness, and a conformity assessment. Deployers must use systems according to instructions, assign trained people to oversee them, monitor operation, keep logs and, for credit scoring and life and health insurance pricing, carry out a fundamental rights impact assessment. Fines for the most serious breaches reach 35 million euro or 7 percent of worldwide annual turnover. For financial institutions, national financial supervisors act as market surveillance authorities.

Worked example

Illustrative numbers. A lender reviews its inventory of 40 AI and ML tools. Six are used to score consumer loan applicants or set limits, so they are high-risk under Annex III. Twenty support internal tasks such as document search and fall outside the high-risk list, though chatbot uses carry transparency duties. Fraud detection models are excluded from the credit scoring entry. The lender plans work on the six high-risk systems for the December 2027 date, starting with the fundamental rights impact assessment and human oversight procedures.

Who uses it

AI transformation analysts build the AI inventory and classify use cases. Regulatory change analysts track delegated acts, guidelines and the amended timeline. Privacy specialists align AI Act duties with GDPR rules on automated decisions. Data scientists produce the documentation and testing evidence. Legal counsel interprets the role of the firm (provider or deployer) in each case. Model validation analysts extend existing model risk processes to cover the Act’s requirements.

Common confusions

The AI Act does not replace the GDPR: when an AI system processes personal data, both apply. Being a high-risk system is about the use case, so the same algorithm can be high-risk in credit scoring and outside the list in marketing. Finally, using a third-party AI tool does not move all duties to the vendor: deployers have their own obligations.