# Regulation (EU) 2024/1689: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

Source: https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689
Last updated: Aug 26, 2026

Regulation (EU) 2024/1689, the EU AI Act, was published in the Official Journal on July 12, 2024 and entered into force on August 1, 2024. It is a risk-based horizontal law: it bans a list of unacceptable practices (Article 5), imposes a full compliance regime on high-risk systems (Articles 8–27 and Annex III), sets transparency duties (Article 50) and regulates general-purpose AI models (Chapter V). For banks the key provision is Annex III, point 5(b): AI used to evaluate the creditworthiness of natural persons or establish their credit score is high-risk, except systems used solely to detect financial fraud. Following the 2026 Digital Omnibus amendment, stand-alone Annex III obligations apply from December 2, 2027.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) |
| Type | Regulation |
| Status | In force |
| Published | Jul 12, 2024 |
| Effective | Aug 1, 2024 |
| Applies to | Providers and deployers of AI systems placed on the market or used in the EU, including banks, lenders, insurers and fintechs, and non-EU firms whose AI outputs are used in the EU |
| Official text | https://eur-lex.europa.eu/eli/reg/2024/1689/oj |

## Key points

- Annex III 5(b) lists credit scoring and creditworthiness evaluation of natural persons as high-risk; 5(c) covers risk assessment and pricing in life and health insurance; a carve-out applies to AI used solely to detect financial fraud.
- High-risk providers must implement a risk-management system (Art. 9), data governance (Art. 10), technical documentation (Art. 11), automatic logging (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15) and a quality-management system (Art. 17).
- Deployers — the role most banks occupy when they buy or configure models — must use systems per instructions, ensure human oversight, monitor operation, keep logs for at least six months, and (for Annex III credit/insurance uses) complete a fundamental-rights impact assessment (Art. 26–27).
- Financial-sector conformity: for credit institutions regulated under CRD, several AI Act quality-management and monitoring duties are deemed met through existing internal-governance rules, and the financial supervisor acts as market-surveillance authority (Art. 74(6)).
- Staged application: prohibited practices and AI literacy from Feb 2, 2025; GPAI rules from Aug 2, 2025; transparency (Art. 50) from Aug 2, 2026; stand-alone high-risk from Dec 2, 2027 and product-embedded high-risk from Aug 2, 2028 (as amended by Regulation (EU) 2026/1744).
- Penalties (Art. 99): up to €35M or 7% of worldwide turnover for prohibited practices; up to €15M or 3% for most other obligations including high-risk requirements; up to €7.5M or 1% for supplying incorrect information.
- Extraterritorial reach: applies to providers and deployers outside the EU where the AI system's output is used in the EU (Art. 2(1)(c)).

## What changed for banks

Before the AI Act, EU banks' use of ML was governed indirectly — through GDPR Article 22, consumer-credit rules and prudential model-governance expectations. The AI Act makes credit-scoring AI a regulated product category with documented risk management, data-quality, logging and human-oversight requirements, and puts financial supervisors in charge of enforcing them. For US banks it matters because any credit or insurance model whose outputs are used in the EU is in scope regardless of where it runs.

## Use cases it governs

- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [Fair lending & discrimination](https://www.bankingnewsai.com/ai-regulation/by-use-case#fair-lending)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)

## FAQ

### Which bank AI uses are high-risk under the EU AI Act?

Annex III lists credit scoring or creditworthiness evaluation of natural persons (point 5(b)) and risk assessment and pricing for life and health insurance (5(c)). Fraud detection is expressly carved out of 5(b), and employment-related AI (Annex III point 4) catches HR uses inside banks.

### Is the bank a provider or a deployer under the AI Act?

A bank that uses a vendor's credit-scoring system as intended is a deployer. It becomes a provider — with the full high-risk regime — if it develops the system itself, puts its own name on it, or substantially modifies a vendor system or its intended purpose (Art. 25).

### Who enforces the AI Act against banks?

For AI systems used by financial institutions regulated under EU financial-services law, Article 74(6) designates the national financial supervisor as the market-surveillance authority, coordinated by the EBA and the Commission's AI Office.

## Compare

- [EU AI Act vs Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/compare/eu-ai-act-vs-colorado-ai-act): EU AI Act vs Colorado AI Act: AI in Credit Decisions

## Which AI tools for banks does Regulation (EU) 2024/1689 apply to?

- [Fraud detection](https://www.bankingnewsai.com/ai-tools/fraud-detection) — EU AI Act fraud carve-out: [Feedzai](https://www.bankingnewsai.com/vendors/feedzai) · [Featurespace](https://www.bankingnewsai.com/vendors/featurespace) · [BioCatch](https://www.bankingnewsai.com/vendors/biocatch) · [Sardine](https://www.bankingnewsai.com/vendors/sardine) · [Socure](https://www.bankingnewsai.com/vendors/socure) · [Alloy](https://www.bankingnewsai.com/vendors/alloy) · [Pindrop](https://www.bankingnewsai.com/vendors/pindrop) · [NICE Actimize](https://www.bankingnewsai.com/vendors/nice-actimize) · [Hawk](https://www.bankingnewsai.com/vendors/hawk) · [Unit21](https://www.bankingnewsai.com/vendors/unit21) · [Zest AI](https://www.bankingnewsai.com/vendors/zest-ai) · [Provenir](https://www.bankingnewsai.com/vendors/provenir) · [FICO](https://www.bankingnewsai.com/vendors/fico)
- [Credit decisioning](https://www.bankingnewsai.com/ai-tools/credit-decisioning) — EU AI Act high-risk credit scoring: [Zest AI](https://www.bankingnewsai.com/vendors/zest-ai) · [Provenir](https://www.bankingnewsai.com/vendors/provenir) · [FICO](https://www.bankingnewsai.com/vendors/fico) · [Scienaptic](https://www.bankingnewsai.com/vendors/scienaptic) · [Taktile](https://www.bankingnewsai.com/vendors/taktile) · [Covecta](https://www.bankingnewsai.com/vendors/covecta)
- [Model risk and AI governance](https://www.bankingnewsai.com/ai-tools/model-risk-governance) — EU AI Act: [ValidMind](https://www.bankingnewsai.com/vendors/validmind) · [Credo AI](https://www.bankingnewsai.com/vendors/credo-ai) · [SAS Model Risk](https://www.bankingnewsai.com/vendors/sas-model-risk) · [Monitaur](https://www.bankingnewsai.com/vendors/monitaur) · [Yields](https://www.bankingnewsai.com/vendors/yields-io)

## Related documents

- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://www.bankingnewsai.com/ai-regulation/documents/eu-digital-omnibus-ai-regulation-2026-1744) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026)
- [Commission guidelines on AI Act Article 50 transparency](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-ai-act-article-50-transparency-2026) — Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (AI Act) (Jul 20, 2026)
- [Draft Commission guidelines on high-risk classification](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-draft-guidelines-high-risk-classification-2026) — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026)
- [EBA factsheet on the AI Act](https://www.bankingnewsai.com/ai-regulation/documents/eba-ai-act-factsheet-banking-payments-2025) — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025)
- [Commission GPAI model guidelines](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025) — Commission Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act) (Jul 18, 2025)
- [General-Purpose AI Code of Practice](https://www.bankingnewsai.com/ai-regulation/documents/eu-gpai-code-of-practice-2025) — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025)
- [Commission guidelines on the AI system definition](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-ai-system-definition-2025) — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act) (Feb 6, 2025)
- [Commission guidelines on prohibited AI practices](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-prohibited-ai-practices-2025) — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025)

Last reviewed Aug 26, 2026. Cite the official text (https://eur-lex.europa.eu/eli/reg/2024/1689/oj) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.