Regulation (EU) 2024/1689, the EU AI Act, was published in the Official Journal on July 12, 2024 and entered into force on August 1, 2024. It is a risk-based horizontal law: it bans a list of unacceptable practices (Article 5), imposes a full compliance regime on high-risk systems (Articles 8–27 and Annex III), sets transparency duties (Article 50) and regulates general-purpose AI models (Chapter V). For banks the key provision is Annex III, point 5(b): AI used to evaluate the creditworthiness of natural persons or establish their credit score is high-risk, except systems used solely to detect financial fraud. Following the 2026 Digital Omnibus amendment, stand-alone Annex III obligations apply from December 2, 2027.
| Document | Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) |
| Issued by | Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act |
| Type | Regulation |
| Status | In force |
| Published | Jul 12, 2024 |
| Effective | Aug 1, 2024 |
| Applies to | Providers and deployers of AI systems placed on the market or used in the EU, including banks, lenders, insurers and fintechs, and non-EU firms whose AI outputs are used in the EU |
| Official source | eur-lex.europa.eu ↗ |
| Use cases | Credit scoring & underwriting · Fair lending & discrimination · Model risk management · Generative & agentic AI · Third-party & vendor AI · AI governance (general) · Fraud detection |
What are the key points of Regulation (EU) 2024/1689?
- Annex III 5(b) lists credit scoring and creditworthiness evaluation of natural persons as high-risk; 5(c) covers risk assessment and pricing in life and health insurance; a carve-out applies to AI used solely to detect financial fraud.
- High-risk providers must implement a risk-management system (Art. 9), data governance (Art. 10), technical documentation (Art. 11), automatic logging (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15) and a quality-management system (Art. 17).
- Deployers — the role most banks occupy when they buy or configure models — must use systems per instructions, ensure human oversight, monitor operation, keep logs for at least six months, and (for Annex III credit/insurance uses) complete a fundamental-rights impact assessment (Art. 26–27).
- Financial-sector conformity: for credit institutions regulated under CRD, several AI Act quality-management and monitoring duties are deemed met through existing internal-governance rules, and the financial supervisor acts as market-surveillance authority (Art. 74(6)).
- Staged application: prohibited practices and AI literacy from Feb 2, 2025; GPAI rules from Aug 2, 2025; transparency (Art. 50) from Aug 2, 2026; stand-alone high-risk from Dec 2, 2027 and product-embedded high-risk from Aug 2, 2028 (as amended by Regulation (EU) 2026/1744).
- Penalties (Art. 99): up to €35M or 7% of worldwide turnover for prohibited practices; up to €15M or 3% for most other obligations including high-risk requirements; up to €7.5M or 1% for supplying incorrect information.
- Extraterritorial reach: applies to providers and deployers outside the EU where the AI system's output is used in the EU (Art. 2(1)(c)).
What did Regulation (EU) 2024/1689 change for banks?
Before the AI Act, EU banks' use of ML was governed indirectly — through GDPR Article 22, consumer-credit rules and prudential model-governance expectations. The AI Act makes credit-scoring AI a regulated product category with documented risk management, data-quality, logging and human-oversight requirements, and puts financial supervisors in charge of enforcing them. For US banks it matters because any credit or insurance model whose outputs are used in the EU is in scope regardless of where it runs.
Which bank AI uses are high-risk under the EU AI Act?
Annex III lists credit scoring or creditworthiness evaluation of natural persons (point 5(b)) and risk assessment and pricing for life and health insurance (5(c)). Fraud detection is expressly carved out of 5(b), and employment-related AI (Annex III point 4) catches HR uses inside banks.
Is the bank a provider or a deployer under the AI Act?
A bank that uses a vendor's credit-scoring system as intended is a deployer. It becomes a provider — with the full high-risk regime — if it develops the system itself, puts its own name on it, or substantially modifies a vendor system or its intended purpose (Art. 25).
Who enforces the AI Act against banks?
For AI systems used by financial institutions regulated under EU financial-services law, Article 74(6) designates the national financial supervisor as the market-surveillance authority, coordinated by the EBA and the Commission's AI Office.
| Date | Document | Status |
|---|---|---|
| Jul 24, 2026 | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) | In force |
| May 19, 2026 | Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act | Proposed |
| Nov 21, 2025 | EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) | Final |
| Jul 10, 2025 | General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) | In force |
| Feb 4, 2025 | Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) | In force |
| Oct 30, 2023 | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →