Guide · August 2026 edition

The EU AI Act Guide for Financial Services.

The Digital Omnibus moved the high-risk deadline to December 2027. It did not move the prohibitions, the AI-literacy duty, or the transparency rules that took effect this month. This guide maps what the Act demands of banks, insurers, and investment firms, what binds now, and the records that answer. Free with a work email.

Each claim linked to the Act's text and the Omnibus deferral, verified August 2026.
Finance-first: credit scoring, insurance pricing, and recruitment as the named high-risk uses.
Opens right on this page; print or save as PDF once it's unlocked.

What's inside

Nine chapters, one supervisor's-eye view.

What applies, when it bites, and the evidence to start accumulating now.

Scope and roles

Who the Act reaches (including firms outside the EU whose output lands inside it), and why most financial institutions are deployers.

The clock, post-Omnibus

What the Digital Omnibus moved to December 2027, and the prohibitions, literacy, GPAI, and transparency duties that bind today.

Four tiers, finance-first

The risk ladder read from a trading floor: where a bank meets each rung, from prohibited practices to minimal risk.

Annex III, up close

Credit scoring and insurance pricing as named high-risk uses: the deployer duties, the logs, and the fundamental-rights impact assessment.

The three surfaces

Chat use, agents, and shadow AI under the Act, including why the AI-literacy duty makes invisible use a live problem.

The readiness sequence

What to run during the sixteen months of runway, starting with the logs that cannot be backfilled.

1 · What the Act is, and who it reaches

The EU AI Act (Regulation (EU) 2024/1689, in force since 1 August 2024) is the first comprehensive AI law anywhere. It regulates by risk tier: the riskier the use, the heavier the obligations. Financial services never gets its own chapter, and doesn't need one, because two of the Act's named high-risk uses sit at the center of the industry: credit scoring and insurance pricing.

Reach is the first thing to get right. The Act binds providers who place AI systems on the EU market wherever they are established, deployers located in the EU, and providers or deployers outside the EU when the system's output is used inside it. A London firm scoring EU applicants is in scope. So is a US fintech whose model output reaches EU customers.

The second thing to get right is your role. Most financial institutions are deployers: they buy or license AI and put it to work. Deployer obligations are lighter than provider obligations, but not light, and a firm that substantially modifies a system or puts its own name on one can slide into the provider role without noticing.

The question the Act asks is "what is this system used for, and where does its output land?" Scope follows the use, not the charter.

The EU AI Act Guide for Financial Services.

Nine chapters, one supervisor's-eye view.

What the Act is, and who it reaches

1 · What the Act is, and who it reaches

When a regulator changes what an AI examination asks for, hear about it first.

What the Act is, and who it reaches

1 · What the Act is, and who it reaches