For banks and financial services firms, the EU AI Act is not a new topic alongside supervision but another layer on top of it. Credit decisions, fraud detection, investment advice and customer service increasingly use AI, and several of these applications touch exactly the areas the AI Act classifies as high-risk. Following the Digital Omnibus, duties for high-risk systems under Annex III apply from 2 December 2027; in a regulated institution, preparation starts much earlier.
Where AI in finance meets Annex III
Expressly listed as high-risk are AI systems used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of systems used to detect financial fraud. In insurance, risk assessment and pricing in life and health insurance are covered. Credit scoring for companies, market analysis or internal assistants do not fall under these points but may trigger other duties, such as transparency under Article 50.
Creditworthiness assessment in detail
For a scoring system, the AI Act requires lifecycle risk management, data governance with attention to bias, technical documentation, automatic logging, transparency towards the deployer and effective human oversight. For banks as deployers, the fundamental rights impact assessment under Article 27 is added, expressly required for creditworthiness assessments. Banks developing models themselves are also providers and carry the duties of both roles.
Connecting to existing supervisory requirements
Financial institutions already have model risk management, validation and governance for credit models, based for example on the EBA guidelines on loan origination and on DORA for ICT risk. The most efficient route is to build AI Act requirements into these processes rather than create a second documentation world. In Germany, under the KI-MIG, BaFin is the competent market surveillance authority for the financial sector, which eases integration with ongoing supervision.
What applies to Swiss institutions with EU links
Swiss banks are subject to the AI Act when they offer AI systems in the EU or their output is used in the EU, for example for clients resident in an EU state or through an EU subsidiary. Domestically, FINMA expects appropriate AI governance under its Guidance 08/2024: inventory, risk classification, responsibilities, testing and monitoring. The two sets of expectations overlap considerably.
Where to start
- A complete AI inventory with the role as provider or deployer for each system.
- Classification of each system, with particular attention to creditworthiness and insurance pricing.
- Alignment with model risk management and validation to avoid duplicate work.
- Preparation of the fundamental rights impact assessment for creditworthiness assessments.
- Supplier contracts for purchased models extended with documentation and information duties.
The terms are explained in our glossary entries on high-risk AI and the fundamental rights impact assessment; a structured assessment is offered by the EU AI Act gap assessment.