Few sectors use AI as broadly as finance: credit decisions, fraud detection, pricing, customer service, document review, investment advice. And few sectors are so densely regulated. The AI Act adds to existing obligations and connects with them. This article describes which applications are affected, what role financial supervisors play and what applies to Swiss institutions.
Which applications are high-risk
Annex III of the AI Act names two case groups for the financial sector explicitly. First, AI systems that evaluate the creditworthiness of natural persons or establish their credit score. Systems used to detect financial fraud are explicitly excluded. Second, AI systems for risk assessment and pricing in life and health insurance for natural persons. From 2 December 2027 the full high-risk obligations apply to both, for providers and deployers alike.
Many other applications in finance are not high-risk: customer service chatbots, internal assistants, document extraction or fraud detection. They are, however, subject to the AI literacy duty under Art. 4 and, where people interact with AI, the transparency obligations under Art. 50.
Fundamental rights impact assessment
Deployers using AI for creditworthiness assessment or for pricing in life and health insurance must carry out a fundamental rights impact assessment before first use and notify the authority of the result. It is one of the few places where the AI Act obliges private companies outside the public sector to carry out a FRIA — and it targets precisely these financial applications.
Financial supervisors as market surveillance
For AI systems placed on the market or used by supervised financial institutions, the competent financial supervisor is in principle also the market surveillance authority under the AI Act in the EU. For banks and insurers this means: the AI Act is not checked by an unfamiliar authority but by the body already supervising their governance and risk management. The AI Act also allows certain obligations to be met through existing governance requirements of financial services law rather than building parallel structures.
DORA and AI vendors
Since 17 January 2025 the Digital Operational Resilience Act (DORA) has applied in the EU. It requires financial entities to manage ICT risk, including risk from third-party providers. Anyone sourcing AI services from external vendors, such as language models via an API, must include them in that third-party risk management: contract design, exit strategy, monitoring, reporting of major incidents. The AI Act and DORA complement each other: one governs the properties of the AI system, the other the resilience of operations.
The Swiss framework
Swiss banks and insurers are subject to the AI Act insofar as they offer AI systems in the EU or use their output there, for example through EU subsidiaries. Independently, FINMA set out its expectations for governance and risk management in the use of AI in December 2024 with Guidance 08/2024. They cover, among other things, clear responsibilities, an inventory with risk classification of applications, data quality, testing and ongoing monitoring, documentation, explainability and independent review. Meeting these expectations covers a large part of AI Act preparation already. For automated individual decisions, such as a fully automated credit rejection, the information and hearing rights of the Swiss Federal Act on Data Protection also apply.
What financial institutions should do now
1. Keep an AI inventory combining AI Act risk class, FINMA risk classification and data protection classification.
2. Identify creditworthiness and pricing applications and check them against Annex III and its exceptions.
3. For these applications, prepare the high-risk requirements and the FRIA by December 2027.
4. Include external AI vendors in third-party risk management under DORA or in outsourcing management.
5. Plan and document AI literacy measures for business units, risk management and internal audit.
Support
For classifying individual systems, AI Risk Check fits. We support implementation in regulated settings through high-risk conformity and our FRIA and DPIA package. The bigger picture is in our AI Act 2026 guide.