EU AI Act Tier-1 Obligations Enter Enforcement Phase
The European Union's AI Act high-risk provisions are now enforceable for financial institutions. Banks deploying AI in credit scoring, fraud detection, and customer onboarding face immediate compliance obligations.
What Happened
The EU AI Act's risk-based regime is phasing in on a fixed calendar: prohibitions and AI-literacy duties applied first, obligations for general-purpose AI models followed in August 2025, and the high-risk regime — the part that captures credit scoring, insurance pricing, and biometric identification — reaches full application in August 2026. For banks, systems long managed internally as 'models' are becoming regulated products with lifecycle obligations and penalties that scale to tens of millions of euros or a share of global turnover.
Why It Matters
Annex III explicitly lists creditworthiness assessment, which pulls much of a bank's core ML estate into the high-risk category by definition. High-risk status brings a package of obligations — a risk management system, data governance, technical documentation, human oversight, logging, and post-market monitoring. It overlaps with existing model risk management, but it is not the same discipline: this is conformity thinking, closer to product regulation than to validation memos.
Banking & Fintech Implications
Inventory AI systems against Annex III before the deadline does it for you; map existing model-risk artefacts (SR 11-7 style documentation, ECB expectations) onto AI Act requirements to avoid building a duplicate compliance stack; clarify provider-versus-deployer roles across the vendor chain — banks are usually deployers, but fine-tuning a vendor model can quietly turn a bank into a provider; and watch how national market-surveillance authorities staff up, because enforcement posture will vary by member state.
My Take
Treat the AI Act the way the industry eventually learned to treat GDPR: a painful first conformity exercise that becomes a competitive moat. The institutions that industrialize AI documentation and oversight now will onboard the next generation of models in weeks; the ones that wait will spend those weeks writing retroactive justifications.