The Artificial Intelligence (AI) transparency obligations under Regulation (EU) 2024/1689 (the AI Act) have applied since 2 August 2026. However, the relevant rules regarding the use of high-risk AI systems apply on 2 December 2027. For financial institutions (FIs), three steps decide how much work is left:

1. Identify the systems

FIs should compile a list of every AI system in use, preferably by leveraging existing sources such as the DORA Register of Information. For each system – FIs should indicate what it does, who owns it, whether it faces customers, and whether it decides or only supports a decision.

2. Establish system status and the FI’s role

Is the system high-risk?

Some systems are more critical than others, the AI Act provides for a closed list of “high-risk” systems subject to more stringent requirements. For FIs, it captures creditworthiness assessment and credit scoring of natural persons, risk assessment and pricing in life and health insurance, and internal HR tools for recruitment, evaluation and promotion. In contrast, AML/CTF monitoring, sanctions and PEP screening, fraud detection, algorithmic trading, robo-advice and customer service fall outside it.

Was the system built in-house?

Systems built in-house will qualify the FI as a provider with a more extensive set of responsibilities. Systems purchased from outside (with the exception of substantially modified ones) will qualify the FI as a deployer.

3. Plan, implement, check

What needs to be done depends on previous outcomes:

  • Providers of high-risk AI systems (typically FIs building such tools in-house) bear the heaviest burden. In practice, this means registering, CE-marking and certifying the system, documenting the decision-making process, ensuring and monitoring governance across its entire lifecycle, etc.
  • Providers of non-high-risk AI systems face transparency duties rather than certification. In practice, this means informing end-users when they are dealing with AI, marking AI-generated content.
  • Deployers of high-risk AI systems stand in the middle. In practice, this means running the system in line with the provider’s instructions, assessing the impact on individuals before first use, ensuring second line oversight, retaining logs, informing affected employees, and being able to explain any individual decision.
  • Deployers of non-high-risk systems bear the lightest burden – and this is where most systems will sit. The obligations are limited to disclosure where customers are involved, alongside the third-party controls FIs already implement.

Finally, whatever the classification, FIs should ensure an adequate level of AI literacy among staff using these tools.

Most FIs will land in the deployer column, where the controls largely exist already under DORA, PSD2, GDPR and other applicable frameworks, making the AI Act an extension rather than a new regime.

Have more questions? Contact Marius Matiukas.