What the EU AI Act Means for Banks in 2026

Most European banks have spent the last two years experimenting with generative AI - copilots inside operations, retrieval-augmented assistants for analysts, and pilots in credit, AML and customer servicing. Far fewer have a clear, board-defensible answer to the question that will define the next supervisory cycle: which of those systems will be classified as high-risk under the EU AI Act, and what evidence will you produce when asked?

Under the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, the main obligations for stand-alone high-risk AI systems under Annex III of the AI Act, Regulation (EU) 2024/1689 apply from 2 December 2027, and 2 August 2028 for high-risk systems embedded in regulated products under Annex I. Transparency obligations apply from 2 August 2026 and content marking from 2 December 2026 (see the European Commission AI Act pages). For banks, those dates sit inside the same horizon as DORA enforcement maturity, the ongoing rollout of EBA model risk expectations, and continued ECB attention on internal models and outsourcing. This article sets out, in plain terms, what banks should plan for - and what should already be in motion.

1. The use cases that trigger high-risk obligations

Annex III of the EU AI Act lists the use cases that are presumptively high-risk. For banks, three areas are immediately in scope:

• Creditworthiness assessment and credit scoring of natural persons - explicitly listed under Annex III(5)(b)
• Risk assessment and pricing in life and health insurance, where it sits inside a bancassurance group - see also EIOPA's opinion on AI governance and risk management
• AI used for the recruitment, evaluation or management of bank employees

Beyond Annex III, banks should assume that AI systems embedded in AML triage, sanctions screening and certain fraud-detection workflows will draw supervisory attention even when the legal classification is debated. The pragmatic posture is to govern those systems as if they were high-risk - because by the time the legal question is settled, the operational gap is too expensive to close in time.

2. Annex IV: the documentation that will be asked for

The EU AI Act gives high-risk AI systems a documentary spine, and that spine is Annex IV. It is the file an internal auditor, a notified body or a national competent authority will request when they want to know how a system actually works. Annex IV requires, among other things, a clear description of the system and its intended purpose, the data governance practices behind training and validation sets, a record of validation and performance, an articulation of the risk management measures and residual risks, and a post-market monitoring plan.

In most banks today, this information exists - but distributed across model cards, MRM validation memos, Confluence pages, vendor documentation and engineers' heads. The work between now and December 2027 is to consolidate it into a maintained, versioned dossier per high-risk system, owned by a named first-line model owner and independently reviewed by the second line.

3. Governance: extending model risk management to generative AI

Existing model risk management (MRM) frameworks in European banks were largely built around traditional statistical models: credit scoring, market risk, capital and stress-testing. The EU AI Act forces an honest conversation about whether that perimeter still holds. Generative and agentic AI systems behave differently. They are non-deterministic, frequently rely on third-party foundation models, ingest unstructured data, and produce outputs that are harder to validate with classical challenger methods.

A credible governance posture today requires four things: an enterprise AI inventory that includes shadow and vendor AI; risk classification per use case against Annex III; extended MRM standards that cover generative and agentic systems; and human oversight design that is real, not nominal. The latter is the area where supervisors will probe hardest. 'Human in the loop' written into a policy document is not the same as a documented operator workflow with training records and override telemetry.

Where the second line needs to invest

• AI-specific validation methods, including red-teaming, prompt-injection testing and hallucination measurement
• Third-party AI due diligence aligned with the EBA guidelines on outsourcing arrangements and DORA, Regulation (EU) 2022/2554
• Continuous monitoring of drift, bias and post-deployment performance
• Independent review of human oversight design, not just its existence on paper

4. The intersection with DORA, EBA and ECB expectations

The EU AI Act does not arrive into an empty room. For banks, it overlays an already dense regulatory stack: DORA on operational and ICT resilience, EBA SREP guidance on internal models, ECB expectations on risk data aggregation and outsourcing, and GDPR Article 22 on automated decision-making. The right answer is not four parallel programmes but one integrated control set. A single AI inventory, a single set of risk classifications, and a single evidence base that can be sliced for AI Act, DORA, EBA and GDPR purposes.

5. The timeline you are actually planning against

The sequence set by Regulation (EU) 2026/1744 is now fixed, and it is the only calendar worth planning against. Transparency obligations, including disclosure where people interact with an AI system, apply from 2 August 2026. Marking of AI-generated content applies from 2 December 2026. Obligations for stand-alone high-risk systems under Annex III, which is where credit scoring and HR use cases sit for banks, apply from 2 December 2027. High-risk systems embedded in regulated products under Annex I follow on 2 August 2028. The Commission's digital omnibus pages track the implementing work behind those dates.

• 2 August 2026: transparency obligations apply, including disclosure to people interacting with an AI system
• 2 December 2026: marking and machine-readable labelling of AI-generated content applies
• 2 December 2027: obligations for stand-alone Annex III high-risk systems apply, including credit scoring of natural persons
• 2 August 2028: obligations for Annex I high-risk systems embedded in regulated products apply

Translating that into a bank programme: transparency and content marking are 2026 work and largely sit with customer-facing channels and marketing operations. Annex III readiness is 2027 work, but the evidence it requires, an AI inventory, written classification rationales, Annex IV dossiers, extended model risk standards and a documented human oversight design, takes four to six quarters to build and one internal audit cycle to test. Banks aiming to be defensible on 2 December 2027 should have classification complete and dossier production under way well before the end of 2026.

Two caveats worth stating plainly. First, the sectoral supervisors move on their own schedule: EBA and EIOPA expectations on outsourcing, governance and model risk apply today, irrespective of AI Act phase-in. Second, classification depends on the intended purpose of each system, not on the sector you operate in. An AML monitoring model is not automatically high-risk; a credit scoring model very likely is.

6. A pragmatic 12-month plan

• Months 1-2: enterprise AI discovery and risk classification against Annex III
• Months 2-4: extended MRM standards, governance operating model, board AI oversight pack
• Months 3-7: Annex IV dossiers for the top tier of high-risk systems
• Months 5-9: human oversight redesign and operator training for in-scope systems
• Months 7-10: third-party AI due-diligence remediation and post-market monitoring rollout
• Months 9-12: internal audit dry-run, supervisory readiness pack, board sign-off

Done in this sequence, the work is demanding but tractable. Done in reverse, assembling evidence after a supervisory request has already landed, it is neither.