The EU combines horizontal AI legislation with existing financial-services rules. Creditworthiness and access-to-service uses can be high-risk, while DORA governs operational resilience and critical technology dependencies.
The AI Act is applicable with staged exceptions. Financial supervisors are clarifying overlap with banking, payments, conduct and resilience rules.
Providers and deployers placing AI systems on the EU market, including financial institutions; obligations depend on role and risk classification.
Summarised from the primary instruments below. Open the source before relying on an obligation for legal or compliance decisions.
Identify provider and deployer roles, classify systems and maintain accountable governance for high-risk uses.
Treat specified creditworthiness and essential-service decisions as potentially high-risk and preserve human oversight.
Integrate AI services into DORA controls for ICT risk, incidents, resilience testing and critical providers.
Maintain technical documentation, logs, post-market monitoring and incident processes where the AI Act applies.
The original authority remains the source of truth. Dates below are publication and effective dates, not OneBench ingest dates.
European Commission
Sets risk-tiered obligations for AI providers and deployers, with staged application and specific treatment of high-risk uses.
European Banking Authority
Maps AI Act requirements against EU banking and payments law and identifies areas for supervisory coordination.
EBA, EIOPA and ESMA
Calls for risk-based governance and operational-resilience controls for cyber risks arising from frontier AI models.