The EU AI Act and finance: credit scoring, insurance pricing and the dates

The EU AI Act reaches some finance uses directly. It lists AI systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score" as high-risk, with an exception for systems used to detect financial fraud, and it lists risk assessment and pricing for natural persons in life and health insurance.² The European Commission says the rules for these high-risk uses apply from 2 December 2027, while the AI literacy duty has applied to every provider and deployer since 2 February 2025.¹

What the Act is, in the Commission's words

The AI Act is Regulation (EU) 2024/1689. The Commission's page calls it a risk-based framework with four levels: unacceptable risk (banned practices), high risk, transparency risk and minimal or no risk.¹ It says "the vast majority of AI systems currently used in the EU" fall in the minimal or no risk category, for which the Act introduces no rules, and gives spam filters as an example.¹ The text on the Commission's AI Act Service Desk is the consolidated version as at 27 July 2026, which includes the amendments made by the Digital Omnibus on AI and marks them.⁴

The finance uses Annex III lists

Annex III is the list of high-risk areas. Point 5 covers access to essential private and public services.² Two of its items are finance uses:

• Credit. Point 5(b): AI systems to evaluate the creditworthiness of natural persons or establish their credit score, "with the exception of AI systems used for the purpose of detecting financial fraud."²
• Insurance. Point 5(c): AI systems "intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance."²

Both items are about natural persons. The Commission's own example for this area is "credit scoring denying citizens opportunity to obtain a loan."¹ Point 4, employment, also reaches finance teams as employers: it lists AI systems used to recruit or select people, including to "analyse and filter job applications," and systems used to monitor and evaluate the performance and behaviour of workers.²

Annex III has no item for accounting, invoice processing, the financial close or financial reporting tools. A finance team's use of AI for that work is not listed as high-risk by this annex; whether another part of the Act reaches a given system depends on that system, and this page does not decide it.

What a deployer of a high-risk system must do

Article 26 sets the duties of deployers of high-risk systems.³ Deployers must use the system in line with its instructions for use, assign human oversight "to natural persons who have the necessary competence, training and authority," ensure input data they control is relevant and sufficiently representative, monitor the system, and keep its automatically generated logs for at least six months unless other law provides otherwise.³ An employer must inform workers' representatives and affected workers before putting a high-risk system into use at the workplace.³

Article 26 has two provisions written for banks and other regulated finance firms. For deployers that are financial institutions subject to internal governance requirements under Union financial services law, the monitoring duty "shall be deemed to be fulfilled" by complying with those governance rules, and the logs are kept as part of the documentation that financial services law already requires.³

The AI literacy duty

Article 4 applies to providers and deployers of any AI system, high-risk or not. As amended, it says they "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf," and adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."⁴ The Service Desk marks both sentences as amended by the Digital Omnibus.⁴

The dates

The Commission's timeline, as its page gives it:¹

• The Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions.
• Prohibited practices and the AI literacy obligations applied from 2 February 2025.
• Governance rules and the obligations for general-purpose AI models applied from 2 August 2025.
• Rules for the Annex III high-risk uses, which include credit scoring, were extended to 2 December 2027 under the AI Omnibus; rules for high-risk systems built into regulated products apply from 2 August 2028.
• The transparency rules, such as telling people they are dealing with a chatbot and labelling deep fakes, apply from August 2026.

The Commission says the AI Omnibus was adopted as a proposal on 19 November 2025, reached political agreement on 7 May 2026 and entered into force on 27 July 2026.¹

Where this meets the filings

The log on this site quotes what US filers tell the SEC about AI next to their finance work. For those passages see how to read an AI risk factor and the risk-factor tracker. This page describes what the Commission's pages say. It is not legal advice, and it does not say whether any company's system is high-risk.