S2 / Banking, finance and compliance
Banks, payment institutions and insurers have operated under DORA since January 2025. On top of it come the AI Act, which makes credit scoring high-risk from 2 December 2027, and the EU anti-money laundering regulation, applicable in July 2027, which frames automated decisions. The question is no longer whether AI enters compliance processes, but how to prove that a human still makes the decision.
Submit a briefInventory AI and data uses, classify them under DORA, the AI Act and the AML regulation, and cost each option in full before the decision.
Draft requirements and clauses (DORA register, logs, audit rights, reversibility, exit plan), run the supplier consultation and sign off acceptance on evidence.
Design private document analysis for credit or due diligence files: sourced extraction, uncertain fields flagged, sign-off by the authorised analyst.
Formalise human intervention, customer explanations and decision traceability; prepare the impact assessment and the files the supervisor expects, with your lawyers.
Other sectors
No. Annex III expressly excludes systems intended to detect financial fraud from the credit scoring category. The GDPR, DORA and due diligence rules still apply.
Partly. From 10 July 2027, Regulation (EU) 2024/1624 allows decisions resulting from automated processes or AI, but requires meaningful human intervention to enter into, refuse or maintain a relationship, and gives the customer a right to an explanation and to challenge it.
Article 74 of the AI Act gives market surveillance of high-risk systems used by regulated financial institutions to their financial supervisor, for uses directly linked to financial services. The European Banking Authority (EU) stressed in November 2025 that cooperation between authorities will be decisive.
Independent analysis, not legal advice. Facts checked as at 29 October 2026.