Fintechs should start AI Act readiness with an inventory of systems and a documented decision about each system’s intended purpose—not with the assumption that every financial-sector AI tool is high-risk. Creditworthiness and credit scoring for natural persons are specifically listed high-risk uses, while the financial-fraud-detection exception and other classification rules depend on what a system actually does. As of 11 October 2026, the Act is generally applicable, but its Annex III high-risk requirements do not apply until 2 December 2027.
Which AI Act dates matter to fintechs?
The AI Act entered into force on 1 August 2024. Its provisions are phased: some duties already apply, the regulation became generally applicable on 2 August 2026, and the main high-risk requirements have later application dates. The European Commission’s current timeline reflects the AI Omnibus, which entered into force on 27 July 2026.
As an Amazon Associate I earn from qualifying purchases.
| Date | Milestone | Practical significance |
|---|---|---|
| 1 August 2024 | The AI Act entered into force. | The regulation began its phased implementation period. |
| 2 February 2025 | Prohibited-practice rules and AI literacy requirements began to apply. | Fintechs should address prohibited uses and ensure relevant staff have appropriate AI literacy. |
| 2 August 2025 | General-purpose AI model obligations began to apply. | Relevant obligations may matter where a fintech provides or otherwise falls within scope for a general-purpose AI model. |
| 2 August 2026 | The Act became generally applicable, subject to staggered provisions; AI Office and national competent-authority enforcement powers apply. | Do not treat this date as the start of every high-risk requirement. |
| 2 December 2027 | Annex III high-risk rules apply. | This is the principal later deadline for listed financial-services uses such as covered creditworthiness assessments. |
| 2 August 2028 | Annex I product-related high-risk rules apply. | This date concerns high-risk AI embedded in regulated products covered by Annex I. |
These dates are stated in the consolidated Regulation (EU) 2024/1689 and the Commission’s current implementation and enforcement material. Check those official sources for updates before relying on a timeline operationally.
Which fintech AI uses may be high-risk?
Creditworthiness and credit scoring
Annex III point 5(b) identifies AI systems intended to assess the creditworthiness of natural persons or establish their credit score. It excludes systems used to detect financial fraud. Classification turns on the system’s intended purpose and actual workflow, not the vendor’s label or the fact that a human has the final sign-off.
Life and health insurance risk and pricing
Annex III point 5(c) identifies AI systems intended for risk assessment and pricing in relation to natural persons for life and health insurance. The listed use is specific: do not generalise it to every insurance workflow or every use of AI by an insurer.
Fraud detection and other workflows
The creditworthiness entry expressly excludes AI systems used to detect financial fraud. That exception does not mean a system performing credit assessment becomes exempt merely because it also has a fraud-related function. Record the intended purpose and the role of each function in the decision process.
Rank #2
Other systems need their own classification. A vendor tool, internal model, or generative AI application is not automatically high-risk simply because a fintech uses it. Conversely, describing a tool as administrative or assistive does not settle its status if it materially influences decisions about people.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow should you classify a system?
Assess the use in context and retain a concise record that another team can review. For each system or materially distinct use, capture:
- The business process, intended purpose, affected people, and whether the system is used for one of the Annex III financial-services purposes.
- Inputs, outputs, and how those outputs affect an individual decision, including the degree of influence and the nature of human review.
- Whether the system profiles natural persons, and whether its deployed use differs from the provider’s stated purpose.
- For a credit-related use, whether the system is used to detect financial fraud and how that function relates to creditworthiness assessment or scoring.
- The classification conclusion, supporting reasoning, accountable owner, and conditions that would trigger reassessment.
Article 6(3) allows certain Annex III systems not to be classified as high-risk where they do not pose a significant risk of harm and do not materially influence decision-making. The provision gives examples such as narrow procedural or preparatory tasks. It also states that a system performing profiling of natural persons remains high-risk. A human decision-maker alone does not establish that a system is merely preparatory or non-influential.
Where a provider relies on this derogation for a listed system, the provider must document the assessment before placing the system on the market or putting it into service and make the required registration. That is a specific obligation; it is not a general route for deployers to relabel a system.
What should a fintech readiness playbook contain?
- Inventory systems and uses. Include internally developed models, vendor systems, embedded tools, and generative AI uses. Record the business process and intended purpose rather than maintaining only a list of model names or suppliers.
- Map roles and owners. Determine whether the fintech acts as provider, deployer, or both for each system and use. Assign legal or compliance, model, business, and operational-monitoring owners. A contract label by itself does not determine the role; assess how the system is placed on the market or put into service and how it is used.
- Keep classification decisions reviewable. Document why a use is or is not within a listed high-risk category, what evidence supports the conclusion, and whether a derogation or exception is being relied on. For provider reliance on the Article 6(3) derogation, track the associated assessment and registration requirements.
- Design controls around the lifecycle. For high-risk systems, plan for risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity, and post-market monitoring. The Act assigns different responsibilities to providers and deployers, so allocate controls by role rather than assuming one team owns everything.
- Connect AI controls to financial-sector governance. Map existing governance processes against the particular AI Act duties. The text deems certain quality-management and monitoring duties fulfilled through relevant existing Union financial-services governance rules for covered institutions; this is not a blanket exemption from the AI Act.
- Train staff and revisit uses. AI literacy obligations already apply. Maintain a route for business, product, and operations teams to report a change in purpose, users, inputs, outputs, or decision influence so the inventory and classification can be reviewed.
How does existing financial regulation interact with the AI Act?
Financial-sector governance can provide relevant controls and, for covered institutions, the law recognises limited overlaps for specified quality-management and monitoring duties. It does not erase other AI Act obligations or make every existing model-risk process sufficient by default. Confirm the institution’s regulatory status and the precise duties addressed by the applicable sectoral rules.
Free tools Windows power users keep installed
One-click scans. No signup required.
The European Banking Authority’s November 2025 paper maps high-risk AI requirements—especially those concerning creditworthiness and credit scoring—against banking-sector requirements. It is useful context for that mapping, but it predates the 27 July 2026 amendment and should not override the current consolidated law.
Best Value
What does a workable control program look like before the deadline?
Build toward evidence that the system is understood, assigned to accountable owners, and monitored in actual use. For a high-risk system, translate the relevant legal requirements into controls and records that fit its lifecycle: risk-management decisions, data governance, technical documentation, logs, user-facing transparency, human-oversight arrangements, performance and security controls, and post-market monitoring. Provider and deployer obligations are distinct, so make the handoffs explicit when a vendor system is involved.
Article 9(1) of the Artificial Intelligence Act states: “A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.” The quote is from the European Parliament and Council’s Regulation (EU) 2024/1689. For fintech teams, the operational implication is to maintain a living process—not a one-time checklist—and to reopen classification when the system’s purpose or use changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
