EU AI Act: What Financial Institutions Need to Know in 2025

Executive Summary

The EU AI Act is the world’s first comprehensive AI regulation. For financial institutions, whether headquartered in the EU or serving EU customers, understanding its requirements is no longer optional.

Risk-Based Classification

The Act categorizes AI systems into four risk tiers:

• Unacceptable Risk: Banned outright (e.g., social scoring, real-time biometric surveillance)
• High Risk: Subject to strict requirements (creditworthiness assessment, insurance pricing, fraud detection)
• Limited Risk: Transparency obligations (chatbots, AI-generated content)
• Minimal Risk: No specific obligations

Most AI systems in financial services fall into the High Risk category.

Key Requirements for High-Risk AI

1. Risk Management System: Continuous identification and mitigation of risks throughout the AI lifecycle
2. Data Governance: Training data must be relevant, representative, and free from errors
3. Technical Documentation: Detailed records of system design, development, and testing
4. Human Oversight: Mechanisms for human intervention and override
5. Accuracy, Robustness, Cybersecurity: Systems must perform consistently and resist manipulation

Timeline

• August 2024: Act entered into force
• February 2025: Prohibited AI practices apply
• August 2025: GPAI model obligations apply
• August 2026: General application date; transparency obligations (Article 50) begin to apply
• December 2027: High-risk requirements for standalone systems (Annex III, including credit scoring and life and health insurance) apply, delayed from August 2026
• August 2028: High-risk requirements for AI embedded in regulated products (Annex I) apply

Update, September 2026: The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since July 27, 2026) postponed the high-risk obligations. Preparation should not stop: the requirements are unchanged, and only the dates moved.

Action Items for Financial Institutions

Financial services firms should start now:

1. Inventory all AI systems and classify them under the Act’s risk tiers
2. Gap analysis against high-risk requirements
3. Align with existing frameworks: NIST AI RMF and ISO 42001 map well to EU AI Act requirements
4. Engage legal counsel on cross-border implications

The EU AI Act has extraterritorial reach. If your AI system’s output affects EU residents, you’re likely in scope, regardless of where your servers are located.

---

This analysis is based on the publicly available EU AI Act text (Regulation (EU) 2024/1689), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

References

• European Parliament: Regulation (EU) 2024/1689: The EU AI Act (August 2024).
• European Commission: AI Omnibus enters into force (July 2026).
• European Union: Regulation (EU) 2026/1744 (Digital Omnibus on AI) (July 2026).