The EU AI Act is the only binding, cross-sector AI law that directly regulates banks today. Its high-risk obligations began applying on August 2, 2026, and credit scoring is explicitly listed as high-risk (Annex III, point 5(b)) — meaning AI creditworthiness systems now require risk management, data governance, technical documentation, logging, human oversight, and post-market monitoring. Penalties for non-compliance with high-risk obligations reach €15 million or 3% of global annual turnover.
| Full name | Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act |
| Role | Binding horizontal AI law |
| Force on banks | Binding law |
| Applies to | Any bank, lender, or fintech that develops or uses AI systems in the EU — including non-EU firms whose AI outputs are used in the EU |
| Key document | Regulation (EU) 2024/1689 (in force Aug 1, 2024) |
| Latest move | High-risk obligations, including for credit scoring, became applicable Aug 2, 2026 |
The AI Act entered into force on August 1, 2024 and applies in stages. Prohibited practices (such as social scoring) and AI-literacy duties took effect February 2, 2025; obligations for general-purpose AI models followed on August 2, 2025; and the core high-risk regime — the part that matters most to banks — became applicable on August 2, 2026.
For banks the two headline classifications are credit scoring of natural persons (Annex III 5(b)) and risk assessment and pricing in life and health insurance (5(c)). High-risk systems already on the market before August 2, 2026 are generally caught when they undergo significant modification — but supervisors have signalled they expect remediation of legacy ML portfolios, not indefinite grandfathering. The EBA published a factsheet on what the Act means for the banking and payments sector in November 2025 and is coordinating supervisory implementation across national authorities through 2026–27.
| Date | Type | Document / event |
|---|---|---|
| Aug 1, 2024 | Regulation | AI Act enters into force. Regulation (EU) 2024/1689 becomes law, with staged application dates from 2025 to 2027. |
| Feb 2, 2025 | Milestone | Prohibited practices and AI-literacy obligations apply. Bans on unacceptable-risk AI (e.g., social scoring) take effect, along with the duty to ensure staff AI literacy — which applies to banks as deployers. |
| Aug 2, 2025 | Milestone | General-purpose AI (GPAI) obligations apply. Transparency and documentation duties for GPAI model providers begin; relevant to banks consuming foundation models through vendors. |
| Nov 21, 2025 | Guidance | EBA factsheet on the AI Act for banking and payments. The European Banking Authority maps AI Act obligations onto the existing EU banking framework, finding the Act complementary to — not contradicting — existing banking and payments legislation. |
| Aug 2, 2026 | Milestone | High-risk AI obligations become applicable. Annex III high-risk systems — including credit scoring — must comply with risk management, data governance, documentation, logging, human oversight, accuracy, and post-market monitoring requirements. Fines up to €15M / 3% of turnover. |
| Aug 2, 2027 | Milestone | Extended deadline for high-risk AI embedded in regulated products. Article 6(1) high-risk systems tied to EU product-safety legislation get an additional year. |
- National market-surveillance authorities beginning enforcement of the high-risk regime that started Aug 2, 2026
- EBA-coordinated supervisory convergence on how AI Act duties interact with existing model governance (CRD/CRR, EBA guidelines) through 2026–27
- Treatment of legacy credit-scoring models: how strictly 'significant modification' is read for systems deployed before Aug 2026
Is credit scoring high-risk under the EU AI Act?
Yes. AI systems used to evaluate the creditworthiness of natural persons or establish their credit score are listed in Annex III, point 5(b), and are high-risk regardless of whether the AI makes the final decision or supports a human decision-maker. A narrow exception exists for systems used solely to detect financial fraud.
When did the AI Act start applying to banks?
In stages: AI-literacy and prohibited-practice rules from February 2, 2025; general-purpose AI rules from August 2, 2025; and the high-risk regime — the one covering credit scoring — from August 2, 2026.
What are the penalties for banks under the AI Act?
Non-compliance with high-risk system obligations carries administrative fines of up to €15 million or 3% of global annual turnover, whichever is higher. Prohibited-practice violations carry up to €35 million or 7%.
Do models deployed before August 2026 have to comply?
High-risk systems placed on the market before August 2, 2026 are generally brought into scope when they undergo a significant modification. In practice, EU banks began remediating legacy ML credit portfolios ahead of the deadline, because retraining and material model changes can trigger full compliance.
Follow every move these regulators make
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →