Financial sector · AI Act

Financial sector — AI Act: high-risk use cases

The financial sector concentrates several high-risk AI use cases: individual credit scoring (banking) and risk assessment and pricing in life and health insurance. This guide provides a cross-cutting overview; details are found on the 'Banking' and 'Insurance' pages. This guide clarifies qualification, the exclusion of fraud, and the overlap with GDPR.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Financial entities using these systems are in scope as deployers, and as providers if they develop their own models under their own brand.
  • Classify use cases.
  • Mastering data and biases.
  • Document and assess.
  • Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk breaches, in addition to GDPR risk.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

Annex III of the AI Act classifies as high-risk the assessment of creditworthiness and credit scoring of natural persons (excluding fraud detection), as well as risk assessment and pricing in life and health insurance. High-risk obligations apply.

Internal or conversational use cases fall under lighter regulatory regimes.

Is the 'Financial sector' concerned?

Financial entities using these systems are in scope as deployers, and as providers if they develop their own models under their own brand.

Fraud detection, although AI-based, falls outside the high-risk classification provided here, but remains subject to GDPR.

Detailed obligations

Classify uses

Isolating high risk (scoring, pricing) from other uses.

Control data and biases

Guarantee data quality and representativeness, and control for bias.

Document and assess

Technical documentation and conformity assessment.

Supervise

Ensuring effective human oversight of decisions.

Articulate with GDPR

Coordinate information and profiling with GDPR.

Sanctions & risks

Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk breaches, in addition to GDPR risk.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2High risk. From 2 August 2026 (scoring, pricing).

Common mistakes in the sector

  • 1High risk not identified. Treating scoring or pricing as ordinary use cases.
  • 2Uncontrolled biases. Ignoring biases, a source of discrimination.
  • 3Cumulative GDPR forgotten. Failing to align the AI Act and GDPR.
  • 4Superficial oversight. Human oversight without real means.

Practical case

A financial group maps its AI use cases and identifies credit scoring and health pricing as high-risk uses, deploying documentation, bias controls, and oversight, coordinated with GDPR information requirements.

Compliance roadmap

  1. 1

    Inventory. Map AI use cases in the sector.

  2. 2

    Qualify. Isolate high-risk uses.

  3. 3

    Strengthen reliability. Addressing data quality and bias.

  4. 4

    Document. Producing documentation and assessment.

  5. 5

    Articulate. Coordinate with GDPR.

Frequently asked questions

Credit scoring of individuals and life/health pricing, primarily.

Back to the Financial sector guideFinancial sector & DORA

Take action on AI Act

Free assessment or a chat with an expert dedicated to financial sector.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the financial sector sector secured their compliance with DCO.

See testimonials