The EU AI Act (Regulation (EU) 2024/1689) is the only binding, cross-sector AI law that directly regulates banks. Credit scoring of natural persons is explicitly listed as high-risk (Annex III, point 5(b)), which will require risk management, data governance, technical documentation, logging, human oversight, and post-market monitoring. Those high-risk obligations were due to apply on August 2, 2026, but the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026) deferred stand-alone Annex III systems to December 2, 2027 and product-embedded (Annex I) systems to August 2, 2028. Penalties for non-compliance with high-risk obligations reach €15 million or 3% of global annual turnover.
| Full name | Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act |
| Role | Binding horizontal AI law |
| Force on banks | Binding law |
| Applies to | Any bank, lender, or fintech that develops or uses AI systems in the EU — including non-EU firms whose AI outputs are used in the EU |
| Key document | Regulation (EU) 2024/1689 (in force Aug 1, 2024), as amended by the Digital Omnibus on AI (EU) 2026/1744 |
| Latest move | Regulation (EU) 2026/1744 (Digital Omnibus on AI) entered into force July 27, 2026, deferring Annex III high-risk obligations — including credit scoring — from Aug 2, 2026 to Dec 2, 2027 |
| Documents tracked | 8 · all documents → |
The AI Act entered into force on August 1, 2024 and applies in stages. Prohibited practices (such as social scoring) and AI-literacy duties took effect February 2, 2025; obligations for general-purpose AI models followed on August 2, 2025; and Article 50 transparency duties applied from August 2, 2026. The core high-risk regime — the part that matters most to banks — was originally due on August 2, 2026, but the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026) deferred it: stand-alone Annex III systems must comply from December 2, 2027, and AI embedded in regulated products (Annex I) from August 2, 2028.
For banks the two headline classifications are credit scoring of natural persons (Annex III 5(b)) and risk assessment and pricing in life and health insurance (5(c)). The deferral buys time but does not change the substance: from December 2, 2027 these systems need risk management, data governance, technical documentation, logging, human oversight, accuracy and post-market monitoring, and supervisors have signalled they expect remediation of legacy ML portfolios rather than indefinite grandfathering. The EBA published a factsheet on what the Act means for the banking and payments sector in November 2025 and is coordinating supervisory implementation across national authorities through 2026–27.
What has the EU AI Act actually published on AI?
| Date | Document | Status |
|---|---|---|
| Jul 24, 2026 | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) | In force |
| May 19, 2026 | Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act | Proposed · comment period closed |
| Nov 21, 2025 | EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) | Final |
| Jul 10, 2025 | General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) | In force |
| Feb 4, 2025 | Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) | In force |
| Jul 12, 2024 | Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) | In force |
| Oct 30, 2023 | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions | Final · applies from Nov 20, 2026 |
| May 4, 2016 | GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling | In force |
| Date | Type | Document / event |
|---|---|---|
| Aug 2, 2028 | Milestone | Deferred deadline for high-risk AI embedded in regulated products. Article 6(1) / Annex I high-risk systems tied to EU product-safety legislation now apply from this date (moved from August 2, 2027 by the Digital Omnibus on AI). |
| Dec 2, 2027 | Milestone | High-risk AI obligations for stand-alone Annex III systems become applicable. Deferred from August 2, 2026 by the Digital Omnibus on AI. Annex III high-risk systems — including credit scoring of natural persons — must comply with risk management, data governance, documentation, logging, human oversight, accuracy, and post-market monitoring requirements. Fines up to €15M / 3% of turnover. |
| Aug 2, 2026 | Milestone | Article 50 transparency obligations apply; Annex III high-risk start deferred. Transparency duties (e.g., telling customers they are interacting with an AI system, marking AI-generated content) apply from this date as originally scheduled. The Annex III high-risk regime — including credit scoring — did NOT start on this date: Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force July 27, 2026) deferred it to December 2, 2027. |
| Jul 24, 2026 | Regulation | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Regulation (EU) 2026/1744, the Digital Omnibus on AI, was proposed by the European Commission on November 19, 2025, agreed by Parliament and Council in May 2026, adopted July 8, 2026, published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026. source ↗ |
| May 19, 2026 | Consultation | Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act. On May 19, 2026 the European Commission published draft guidelines on classifying high-risk AI systems under Article 6 of the AI Act, originally due by February 2, 2026. source ↗ |
| Nov 21, 2025 | Report | EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet). On November 21, 2025 the European Banking Authority published a factsheet mapping the AI Act onto EU banking and payments legislation. source ↗ |
| Aug 2, 2025 | Milestone | General-purpose AI (GPAI) obligations apply. Transparency and documentation duties for GPAI model providers begin; relevant to banks consuming foundation models through vendors. |
| Jul 10, 2025 | Framework | General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters). The General-Purpose AI Code of Practice was published by the European Commission on July 10, 2025 as a voluntary tool for GPAI model providers to demonstrate compliance with Articles 53 and 55 of the AI Act, which applied from August 2, 2025. source ↗ |
| Feb 4, 2025 | Guidance | Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act). On February 4, 2025 — two days after the Article 5 prohibitions began applying — the European Commission published non-binding guidelines interpreting the AI Act's prohibited practices, including harmful manipulation, exploitation of vulnerabilities, social scoring, individual crime prediction, untargeted facial-image scraping, emotion recognition in workplaces and real-time remote biometric identification. source ↗ |
| Feb 2, 2025 | Milestone | Prohibited practices and AI-literacy obligations apply. Bans on unacceptable-risk AI (e.g., social scoring) take effect, along with the duty to ensure staff AI literacy — which applies to banks as deployers. |
| Jul 12, 2024 | Regulation | Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Regulation (EU) 2024/1689, the EU AI Act, was published in the Official Journal on July 12, 2024 and entered into force on August 1, 2024. source ↗ |
| Oct 30, 2023 | Statute | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions. Directive (EU) 2023/2225, the recast Consumer Credit Directive, was published in the Official Journal on October 30, 2023; member states had to transpose it by November 20, 2025 and its rules apply from November 20, 2026. source ↗ |
| May 4, 2016 | Statute | GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling. Article 22 of the General Data Protection Regulation (Regulation (EU) 2016/679, applicable since May 25, 2018) gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects — with automated credit refusal the textbook example. source ↗ |
Which of the 100 largest US banks answer to the EU AI Act on AI?
6 of the 100 bank pages on this site name the EU AI Act among the authorities their AI programme answers to. Each page lists the documents that apply and why.
- Final Commission guidelines on high-risk classification (Article 6), expected by end-2026 after the draft consultation closed July 23, 2026
- CEN-CENELEC harmonised standards for high-risk AI, now targeted for late 2026 at the earliest — the practical route to presumption of conformity before Dec 2, 2027
- EBA-coordinated supervisory convergence on how AI Act duties interact with existing model governance (CRD/CRR, EBA guidelines) through 2026–27
- Consumer Credit Directive 2023/2225 rules — including the right to human intervention in automated creditworthiness assessments — applying from November 20, 2026
Is credit scoring high-risk under the EU AI Act?
Yes. AI systems used to evaluate the creditworthiness of natural persons or establish their credit score are listed in Annex III, point 5(b), and are high-risk regardless of whether the AI makes the final decision or supports a human decision-maker. A narrow exception exists for systems used solely to detect financial fraud.
When did the AI Act start applying to banks?
In stages: AI-literacy and prohibited-practice rules from February 2, 2025; general-purpose AI model obligations from August 2, 2025; Article 50 transparency duties from August 2, 2026. The high-risk regime that covers credit scoring was deferred by the July 2026 Digital Omnibus and now applies from December 2, 2027 (stand-alone Annex III systems) and August 2, 2028 (AI embedded in regulated products).
What are the penalties for banks under the AI Act?
Non-compliance with high-risk system obligations carries administrative fines of up to €15 million or 3% of global annual turnover, whichever is higher. Prohibited-practice violations carry up to €35 million or 7%.
Do credit-scoring models deployed before December 2027 have to comply?
The Act's grandfathering only reaches high-risk systems placed on the market before the application date that are not subsequently significantly modified — and supervisors have made clear they expect legacy ML credit models to be brought into compliance rather than left untouched. With the deadline now December 2, 2027, banks should treat existing credit-scoring models as in scope and use the extra time for remediation, not exemption.
Did the Digital Omnibus delay the EU AI Act high-risk deadline for credit scoring?
Yes. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026. It moved the application date for stand-alone Annex III high-risk systems — the category that includes credit scoring of natural persons — from August 2, 2026 to December 2, 2027, and for AI embedded in regulated products (Annex I) from August 2, 2027 to August 2, 2028. Article 50 transparency obligations still applied from August 2, 2026.
Follow every move these regulators make
the daily brief · six sourced stories · in your inbox by 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning