What does the EU AI Act require of banks and payment firms using AI in operations?

Most AI that banks and payment firms use in operations, such as fraud detection, reconciliation, routing and internal assistants, is not high-risk under the EU AI Act. The prohibitions and the AI literacy duty have applied since 2 February 2025, and transparency duties for systems such as customer chatbots now apply too. The main high-risk use in the sector is evaluating the creditworthiness of natural persons or setting their credit score, which Annex III lists while excluding AI used to detect financial fraud. After the 2026 amendment, Regulation (EU) 2026/1744, the high-risk obligations for Annex III systems apply from 2 December 2027, not 2 August 2026.

The base text is Regulation (EU) 2024/1689 on EUR-Lex; read the consolidated text dated 27 July 2026, because many older summaries still give August 2026 as the high-risk date.

Which AI Act dates apply to banks and payment firms?

Sources: European Commission: AI Act and Council of the EU: provisional agreement, 7 May 2026.

Why did the high-risk date move from August 2026?

The Commission's November 2025 "Digital Omnibus on AI" proposal would have tied the start of high-risk obligations to the availability of standards and other compliance support (EUR-Lex: COM(2025) 836). The Council and Parliament replaced that with fixed dates in their 7 May 2026 provisional agreement: 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for systems embedded in products.

The result is Regulation (EU) 2026/1744, adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. The consolidated text now applies Chapter III, Sections 1 to 3, from 2 December 2027 to systems that are high-risk under Article 6(2) and Annex III. The amendment also reworded the AI literacy duty in Article 4.

Which banking and payment uses are high-risk?

Annex III, point 5(b), lists AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used to detect financial fraud. Article 6(3) lets a provider conclude in narrow cases that an Annex III system is not high-risk, but never where the system performs profiling of natural persons.

How credit scoring systems work shows which parts of a scoring stack would fall in scope. AI fraud detection vs rule engines covers the fraud controls you still need outside 5(b). For operations, AI payment reconciliation shows where human approval stays in the loop.

Are you a provider or a deployer of the AI system?

The AI Act splits duties by role. The provider develops the system and places it on the market or puts it into service under its own name; the deployer uses it under its own authority. A bank that buys a vendor's scoring model is usually a deployer; one that builds and runs its own model is both.

Provider duties for a high-risk system include a conformity assessment before it is placed on the market or put into service. For credit institutions regulated under the Capital Requirements Directive, the AI Act folds that assessment into the supervisory review procedure in Articles 97 to 101 of Directive 2013/36/EU, so it runs through existing banking supervision.

Deployer duties sit mainly in Article 26, and two are adapted for financial institutions:

• Monitoring. A financial institution's duty to monitor the high-risk system is deemed fulfilled if it complies with the internal governance rules that already apply to it under Union financial services law (Article 26(5)).
• Logs. Deployers must keep automatically generated logs for at least six months; financial institutions keep them as part of the documentation they already maintain under financial services law (Article 26(6)).

Deployers of point 5(b) systems must also carry out a fundamental rights impact assessment before first use (Article 27). It depends on information only the provider has, so write that duty into the vendor contract.

Who supervises AI Act compliance for banks and payment firms?

Article 74(6) makes the national financial supervisor the market surveillance authority for high-risk AI systems placed on the market, put into service or used by regulated financial institutions, where the use is directly connected to providing those financial services (consolidated text).

Germany. The national implementing act (KI-MIG) took effect in summer 2026. BaFin says it now carries out AI market surveillance for credit institutions, insurers and the other financial firms it supervises, limited to AI systems directly connected to a regulated financial activity; AI used in HR, for example, falls to the Bundesnetzagentur. BaFin says it already monitors the Article 5 prohibitions and the Article 50 transparency obligations, will supervise the high-risk requirements for creditworthiness assessment from 2 December 2027, and can impose fines of up to EUR 35 million or 7% of annual turnover in the most serious cases (BaFin: press release, 29 July 2026; BaFin: KI-Marktüberwachung). The Bundesnetzagentur takes the central role as market surveillance authority and point of contact for the AI Act in Germany (Bundesnetzagentur: press release, 29 July 2026).

How does the AI Act fit with existing banking and resilience rules?

The AI Act sits alongside financial services law rather than replacing it. The deemed-compliance routes in Article 26 mean existing governance does much of the work, provided it actually covers AI systems. Check that your model inventory includes vendor AI features and language models, not only in-house scorecards; that your operational resilience framework, including DORA where it applies, covers the systems and vendors behind each AI use; and that each system has a named business, technical and control owner. Enterprise AI: ownership, access and operating handover sets out that model, and why AI and ML fail in production payments shows what happens without it.

What should a bank or payment firm do now?

1. Inventory every AI system, including features inside vendor software, and record whether you are provider, deployer or both.
2. Classify each one: prohibited practice, Annex III high-risk, Article 50 transparency, or general duties only.
3. Put AI literacy measures in place against the current Article 4 wording, and check chatbot disclosures against Article 50.
4. Plan the 2 December 2027 work for any creditworthiness system: impact assessment, monitoring, logs and vendor documentation.
5. In Germany, map each system to its supervisor: BaFin for regulated financial activities, the Bundesnetzagentur for most other uses, such as HR.

FAQ

Does the EU AI Act apply to banks and payment firms?

Yes. The prohibitions and AI literacy duty apply to any firm that provides or uses AI, and transparency duties apply to systems such as chatbots. The heavier high-risk regime applies mainly to creditworthiness assessment of natural persons.

Is credit scoring high-risk under the EU AI Act?

Yes. Annex III, point 5(b), lists AI used to evaluate the creditworthiness of natural persons or establish their credit score. Those high-risk obligations apply from 2 December 2027.

Is AI fraud detection high-risk under the AI Act?

AI used to detect financial fraud is expressly excluded from point 5(b). The prohibitions, the AI literacy duty and data protection law still apply.

When do the AI Act high-risk rules apply?

Under the amended text, from 2 December 2027 for Annex III systems such as credit scoring, and from 2 August 2028 for AI in products covered by Annex I.

Who supervises the AI Act for banks in Germany?

BaFin, for AI systems directly connected to regulated financial activities at the firms it supervises. AI uses outside that, such as HR systems, generally fall to the Bundesnetzagentur.