What does the EU AI Act regulate?

The EU AI Act sorts AI into four groups, each in its own chapter. Chapter II lists prohibited AI practices. Chapter III sets the rules for high-risk AI systems. Chapter IV holds transparency obligations, for example for AI systems that interact directly with people (Article 50). Chapter V covers general-purpose AI models.

Which practice is banned under the EU AI Act? One example is social scoring: AI that rates people over time by their social behavior or personal traits, where the score leads to unfavorable treatment in unrelated contexts or treatment out of proportion to the behavior (Article 5(1)(c)).

Two high-risk use cases in Annex III, point 5 concern banks and insurers directly. Point 5(b) covers "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud". Point 5(c) covers "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance".

The implications for the EU banking sector follow from these two lines. A consumer credit scoring model is high-risk AI under the EU AI Act. A fraud detection model is not high-risk under point 5(b). Scoring of companies is not in point 5(b), which names natural persons.

Those who must follow the EU AI Act are providers that build or sell AI systems and deployers that use them in the EU, wherever the provider sits (Article 2(1)). A bank that buys a scoring model is a deployer. Under Article 26 it must use the system according to the instructions for use, assign human oversight to people with "the necessary competence, training and authority", keep input data relevant and representative where it controls that data, and monitor the operation.

Before it uses a credit scoring or insurance pricing system, a deployer carries out a fundamental rights impact assessment (Article 27(1)). EU AI Act compliance also includes AI literacy: Article 4, as amended in 2026, asks providers and deployers to support the AI literacy of their staff. These are the training requirements of the law; it does not require a specific level for each person.

The EU AI Act entered into force on August 1, 2024 and applies in stages. Article 113 sets the timeline below. Regulation (EU) 2026/1744 of July 8, 2026, in force since July 27, 2026, moved the dates for high-risk systems.

For a bank in 2026, the bans, the AI literacy duty and the general rules already apply. The high-risk duties for credit scoring systems start on December 2, 2027.

The EU AI Act applies directly in Germany and Austria. For AI systems that financial institutions use in direct connection with their financial services, the market surveillance authority is the authority responsible for the financial supervision of those institutions (Article 74(6)). In Germany the financial supervisor is BaFin, in Austria the FMA. Article 74(7) lets a Member State name another authority in appropriate cases.

Under the German Act Implementing the European Artificial Intelligence Act, in effect since July 29, 2026, BaFin supervises AI systems that supervised firms use in direct connection with regulated financial activities, including credit assessment and insurance risk evaluation. BaFin can impose fines for violations.

The EU supervisor for insurers is in Frankfurt: EIOPA, at Westhafenplatz 1 in Frankfurt am Main, published its Opinion on AI governance and risk management on August 6, 2025. It explains how insurance law applies to AI systems, from data governance and fairness to explainability and human oversight.

Switzerland is outside the EU, so the EU AI Act does not apply there. FINMA Guidance 08/2024 of December 18, 2024 sets out its expectations for governance and risk management when supervised institutions use AI, including model risks such as a lack of robustness, correctness, explainability or bias. This page gives no legal advice.