EU AI Act — Sector Guidance
EU AI Act Compliance — Financial Services
Financial services firms face some of the most significant obligations under the EU AI Act. Several core use cases are explicitly classified as high-risk.
Which AI uses are high-risk in financial services?
Annex III identifies particular financial uses. Classification follows the intended use and the relevant criteria, rather than the fact that a financial services firm uses the tool. Provider and deployer duties differ.
Check the applicable timetable
The Commission's current timetable sets December 2027 for the relevant Annex III requirements and August 2028 for the relevant regulated-product requirements. Existing-system and other transition provisions need checking. AI literacy, prohibited practices and applicable transparency duties have separate dates.
- Creditworthiness assessment or credit scoring of natural persons, subject to the financial-fraud exception
- Risk assessment and pricing for natural persons in life and health insurance
- Other tools need individual assessment; AML, trading and customer-service AI are not automatically high-risk
Central Bank of Ireland overlap
Ireland's financial services firms already operate under Central Bank of Ireland expectations around explainability, consumer protection and human oversight of automated decisions. The EU AI Act does not replace these expectations — it adds a structured compliance layer on top. Firms that have begun addressing Central Bank requirements will have a head start, but should not assume existing measures are sufficient. The Act introduces new documentation obligations, conformity assessments and registration requirements that go beyond what the Central Bank currently mandates.
Deployer obligations apply even to purchased tools
Most financial services firms are deployers of AI, not developers. The EU AI Act places significant obligations on deployers — the organisations that put AI systems into use. You cannot transfer these obligations to the vendor. Where you use third-party AI tools for credit decisions, fraud detection or customer engagement, you must maintain documentation of intended use, ensure human oversight is operational, and be able to demonstrate compliance to regulators.
Understand your organisation's AI obligations
Discuss how your organisation uses AI and which governance questions need attention. We scope the work around your operations and responsibilities.
Talk to usCommon questions
Are credit scoring tools classified as high-risk under the EU AI Act?
Annex III covers AI evaluating the creditworthiness of natural persons or establishing their credit score, with an exception for detecting financial fraud. It also covers risk assessment and pricing for natural persons in life and health insurance. Other banking or insurance tools are not automatically high-risk; assess their intended use and the applicable rules.
How does the EU AI Act interact with Central Bank of Ireland requirements?
The EU AI Act and Central Bank of Ireland frameworks address overlapping risks but from different angles. The Central Bank's Consumer Protection Code and expectation of explainable automated decisions already requires human oversight of AI-driven customer decisions. The EU AI Act adds a more structured regime of technical documentation, conformity assessment and registration for high-risk systems. Firms subject to both regimes should map their AI use against both frameworks simultaneously to identify gaps and avoid duplicate compliance efforts.
Does the EU AI Act apply to AI tools we purchase from vendors?
Yes. The EU AI Act distinguishes between providers (who build AI systems) and deployers (who use them). As a financial services firm deploying AI — even tools purchased from third-party vendors — you carry deployer obligations. These include maintaining documentation of the system's intended use, ensuring human oversight, monitoring for bias and accuracy, and logging decisions where required. You cannot fully outsource compliance to the vendor.
Next step
Keep a practical record of the AI literacy support provided and review whether it fits the tools and responsibilities involved.
The AI literacy obligation explainedBook an EU AI Act Readiness Review
Delivered as a fixed-fee readiness review, typically completed within two to three weeks.