EU AI Act for Financial Services:
What Fintechs, Lenders, and Payment Firms Must Do Before August 2026

Annex III Area 5: which financial AI systems are high-risk?

Explicitly high-risk: creditworthiness assessment (Area 5a)

AI systems used to evaluate the creditworthiness of natural persons or establish their credit score are explicitly classified as high-risk under the EU AI Act. That includes automated credit scoring models, AI-driven loan approval/denial, credit limit assignment algorithms, affordability assessment tools, and automated underwriting for consumer lending. The key phrase is "creditworthiness of natural persons" — B2B credit assessment (scoring a company, not a person) isn't explicitly listed, but may still be captured if natural persons are directly affected, such as SME lending where the owner is personally assessed.

FRIA is mandatory for deployers in this category (Article 27). No exceptions.

Explicitly high-risk: insurance risk and pricing (Area 5b)

AI for risk assessment and pricing in life and health insurance is also explicitly high-risk. If your firm operates in insurance, see our dedicated coverage on this (cross-reference: eu-ai-act-for-insurance.html when live).

The grey zone: fraud detection, AML, and KYC

This is where most fintech compliance teams get stuck. Fraud detection is NOT automatically high-risk under Annex III. However, if a fraud detection system functionally denies access to financial services — blocks a transaction, freezes an account, rejects an onboarding application — it may cross into "access to essential services" territory and trigger high-risk classification.

AML transaction monitoring that generates alerts for human review is likely not high-risk — it's decision support, not decision-making. But AML systems that automatically file suspicious activity reports or freeze accounts are closer to the high-risk line. KYC/KYB onboarding that auto-rejects applicants directly affects access to financial services and may trigger classification.

ECB Opinion CON/2026/10 (March 13, 2026)

The ECB recommended excluding linear/logistic regression models from Annex III(5)(b) credit scoring classification when adequate human supervision exists. This is an advisory opinion, not binding — the Digital Omnibus negotiations may or may not adopt it. Current law doesn't distinguish by model type. All AI credit scoring is high-risk regardless of model complexity. Don't plan around the ECB opinion becoming law.

What financial services deployers must do under the EU AI Act

Human oversight

For credit decisioning, a human must be able to review and override AI-generated credit decisions before they affect applicants. Fully automated rejection without human review is a compliance gap under both the EU AI Act (Articles 14/26) and GDPR (Article 22). The oversight person needs competence in credit risk — not just a rubber stamp on an algorithm's output.

FRIA (mandatory for credit scoring deployers)

Article 27 requires a Fundamental Rights Impact Assessment before deploying high-risk AI for creditworthiness assessment. The FRIA must assess: impact on specific affected persons (applicants), context of use (consumer lending vs SME lending vs credit cards), and risk of harm to fundamental rights (access to financial services, non-discrimination). Use the FRIA Generator to build yours.

Monitoring and logging

Retain AI system logs for at least 6 months (Article 26(5)). For financial services, sector-specific regulations — PSD2, MiFID II record-keeping requirements — may demand longer retention. Apply the stricter requirement. Track performance drift, bias emergence, and false positive/negative rates monthly.

Input data governance

If you control the data fed into credit models — applicant data, bureau data, alternative data — you must ensure it's relevant and sufficiently representative (Article 26(4)). Bias in input data leads to bias in output, which leads to discriminatory credit decisions, which leads to regulatory and legal exposure. The Input Data Validator helps assess this.

Incident reporting

Report serious incidents — AI system causing significant harm or systematic failure — to the national market surveillance authority AND the AI system provider. For financial services firms, this sits alongside existing incident reporting to financial regulators (ECB, NCAs, FCA for UK-exposed firms).

For the complete deployer obligation breakdown, see our High-Risk Deployer Guide.

Financial services cross-regulation: EU AI Act + PSD2 + DORA + GDPR

Financial services firms don't comply with the EU AI Act in isolation. You comply with a stack. Here's how they intersect — and why a single AI governance programme can satisfy most of them simultaneously.

A robust AI governance programme built to EU AI Act standards will substantially satisfy DORA ICT risk management, GDPR DPIA/Article 22, and PSD2 monitoring requirements — because they share overlapping concerns: risk management, oversight, logging, incident response, and vendor management. Build once, satisfy multiple regulators. For the framework implementation path, see our complete EU AI Act compliance guide.

Common scenarios: how the EU AI Act applies to your financial AI

Consumer lending platform using AI credit scoring

Classification: Annex III Area 5a — explicitly high-risk. Full deployer obligations apply. FRIA mandatory. No ambiguity. Use the Fraud vs Credit Delimiter to document your classification.

Payment processor using AI fraud detection

Classification: depends on decision authority. If the system autonomously blocks transactions, it likely qualifies as high-risk because it denies access to services. If it flags for human review, it likely doesn't. Document the distinction carefully.

Neo-bank using AI for KYC/onboarding

Classification: if the AI auto-rejects applicants (denying account access), likely high-risk. If it flags for human review, lower risk. The functional effect on the applicant is what matters, not the technical architecture.

AML compliance using AI transaction monitoring

Classification: AI generating alerts for human investigation is likely not high-risk. AI automatically filing SARs or freezing accounts is closer to the high-risk boundary. The key question: does the AI make the decision, or does it inform a human who makes the decision?

FAQ: EU AI Act for financial services

Sources & legal basis