The EU AI Act:
What Financial Institutions
Must Prepare For

The EU Artificial Intelligence Act — adopted on 13 June 2024 and entered into force on 1 August 2024 — is the world's first comprehensive, binding legal framework governing the development, deployment, and use of artificial intelligence systems. It is a Regulation, not a Directive: directly applicable across all 27 EU Member States without national transposition, and applying equally to EU and non-EU entities offering AI systems within the EU market.

Unlike sector-specific AI guidance, the AI Act takes a horizontal, risk-tiered approach — classifying AI systems by the severity of risk they present and calibrating obligations accordingly. For financial institutions, the classification is unambiguous: credit scoring, loan approval, fraud detection, AML risk profiling, and automated customer decision-making are all explicitly classified as high-risk AI applications under Annex III. If your institution deploys AI in any of these functions — built in-house or procured from a vendor — you are a regulated deployer with binding legal obligations.

Importantly, the AI Act does not replace DORA, PSD3, or the Capital Requirements Regulation — it explicitly complements them, adding a new compliance layer targeting algorithmic governance, transparency, and fundamental rights protection. For many institutions, this means navigating the intersection of several major frameworks simultaneously.

The AI Act applies through a staged rollout. The key dates are accelerating rapidly, and the window for preparation is narrower than most institutions appreciate. This timeline reflects the current legal position, incorporating the latest Digital Omnibus developments (addressed in Section 5).

Annex III defines the categories of AI system classified as high-risk. For financial institutions, the classification is comprehensive and directly addresses core operational AI deployments. The table below maps the most significant use cases to their compliance implications.

Financial institutions deploying high-risk AI systems must satisfy six interconnected categories of obligation — each generating documentation requirements, governance structures, and operational processes that must be designed, tested, and evidenced ahead of the August 2026 deadline.

In November 2025, the European Commission introduced the Digital Omnibus proposal — a package designed to simplify and consolidate the EU's digital regulatory framework across the AI Act, GDPR, NIS2, DORA, and the Data Act simultaneously. For financial institutions, it introduces potentially significant timeline changes that are actively under negotiation.

Key Digital Omnibus proposals relevant to financial institutions include: a single incident reporting point consolidating DORA and AI Act notifications; aligned breach notification thresholds reducing duplicate reporting; clarified rules on personal data use in AI systems including creditworthiness assessments; and an extension of high-risk compliance deadlines linked to the availability of harmonised standards and support tools.

The CassConsult position is clear: plan for the 2 August 2026 deadline regardless of Omnibus negotiations. If the deadline is extended, institutions with mature programmes will be ahead of the curve. If negotiations stall, institutions that waited will face a compressed, costly scramble. The cost of early preparation is low; the cost of late enforcement exposure is not.

The AI Act's penalty framework is deliberately severe — designed to make non-compliance materially costlier than compliance investment. It applies to both EU-based and non-EU entities offering AI systems in the EU market. GDPR enforcement history is instructive: regulators are not afraid to take on institutions of any size.

Italy's national AI implementation law — Law No. 132/2025, in force from October 2025 — illustrates how Member States are adding domestic penalties on top of the EU framework, including fines up to €774,685 and disqualifying measures such as suspension of business licences, bans on public contracts, and exclusion from grants. Italy has also introduced a criminal offence for unlawful dissemination of AI-generated deepfake content, punishable by imprisonment of one to five years. Other Member States are expected to follow with their own national implementing measures through 2026 and 2027.

With the primary deadline now months away, the following actions are sequenced by urgency. Institutions that have not yet begun should treat this as a crisis programme, not a routine compliance exercise.

• !
  Complete your AI system inventory and risk classification immediately. Every AI system in production — whether built in-house or procured — must be catalogued, its intended purpose documented, and its Annex III classification determined. High-risk systems not yet identified cannot be brought into compliance by August 2026. This is the most urgent and foundational step.
• !
  Conduct conformity assessments for all high-risk AI systems. For Annex III systems, conformity assessments must be completed, technical documentation finalised, and EU database registration initiated before 2 August 2026. For procured systems, immediately request conformity evidence from vendors — if they cannot provide it, you carry the compliance risk, not them.
• !
  Implement human oversight as operational reality — not policy. For credit scoring, fraud detection, and AML profiling systems, designated individuals with genuine authority to review, challenge, and override AI outputs must be identified, trained, and embedded in operational workflows before August 2026. A policy document describing oversight is not the same as oversight.
• →
  Audit training data for bias and representativeness. Data governance documentation — including training data sources, quality controls, bias testing results, and mitigation measures — must be prepared for all high-risk systems. For legacy systems where training data documentation is incomplete, this is a material gap requiring immediate attention.
• →
  Build or procure your Quality Management System framework. Article 17 mandates a QMS with 12 core components. The European standard prEN 18286 provides a conformity pathway — institutions implementing it can presume compliance with Article 17. Third-party validation against prEN 18286 is increasingly expected by insurers and investors, not just regulators.
• →
  Review and update AI vendor contracts. Contracts with AI system providers must clearly allocate provider and deployer responsibilities under the AI Act, include audit rights, require documentation updates, and address incident notification obligations. Legacy AI procurement contracts drafted before August 2024 almost certainly do not contain these provisions.
• ✓
  Deliver AI literacy training to all relevant staff. AI literacy obligations have been active since February 2025. This covers not just data scientists and technology teams, but compliance officers, credit analysts, relationship managers, and senior management who use or oversee AI-assisted tools and their outputs.
• ✓
  Monitor the Digital Omnibus trilogue closely. With a second trilogue targeted for 28 April 2026, the next weeks may bring significant clarity — or further complexity — on timeline amendments. Assign a dedicated regulatory horizon-scanning function to track developments and adjust programme sequencing in real time.

The EU AI Act is not a future concern for financial institutions — it is a present compliance obligation with a critical enforcement deadline measured in months, not years. For an industry that has embedded AI into credit decisioning, fraud prevention, AML monitoring, and customer onboarding, the Act's high-risk classifications describe core operational systems at most banks, payment firms, and fintechs operating in the EU.

The Digital Omnibus may yet extend certain deadlines. Regulatory guidance will continue to develop. The AI landscape will evolve faster than any prior technology wave. None of these realities change the fundamental imperative: institutions that build rigorous AI governance frameworks now will be better placed to adapt to whatever the regulatory environment brings next. Those that defer will face a simultaneous compliance crisis and operational backlog with no margin for error.

At CassConsult, our Banking Regulation & Compliance Practice offers structured EU AI Act readiness assessments, AI system risk classification reviews, QMS framework design, vendor contract remediation, and Board-level AI governance advisory — calibrated to the specific AI systems, risk profile, and regulatory footprint of your institution.