As Artificial Intelligence (AI) increasingly transforms financial services, the EU AI Act, which has been effective from 12 July 2024, provides critical regulation to harness AI safely and responsibly. Understanding and preparing for this Act is essential for regulated financial services institutions aiming to leverage AI effectively.
Key messages:
- The EU AI Act establishes a clear regulatory framework aimed at fostering safe, transparent, and ethical AI innovation.
- Financial institutions already familiar with regulatory frameworks will find alignment with existing compliance processes.
- Proactive planning is essential to manage compliance risks and leverage AI benefits without disruption.
What the EU AI Act means for regulated firms
The Act’s principles closely align with the existing regulatory landscape in terms of implementing products safely through the understanding, assessment and governance of risks – an approach that will feel familiar to financial institutions while providing a structured approach to managing AI:
- Trustworthy AI: Ensuring AI systems are transparent, reliable, and safe, building consumer and market confidence.
- Protection of fundamental rights and safety: Preventing harm and protecting privacy and non-discrimination.
- Promotion of innovation: Encouraging AI development within clear ethical guidelines.
- Risk-based approach: Regulation intensity correlates with the potential impact, prioritising controls for high-risk AI systems.
- EU as a global leader: Establishing Europe’s influential role in global AI governance.
Practical steps for compliance
Financial institutions should integrate AI governance seamlessly into existing frameworks:
- Define your AI strategy clearly aligned with EU AI Act provisions.
- Develop or update AI policies detailing accepted uses and alignment with regulatory principles.
- Clarify risk appetite explicitly relating to AI risks.
- Conduct comprehensive risk assessments and maintain ongoing monitoring.
- Implement controls and assurance to ensure compliance and operational integrity.
- Embed AI considerations into due diligence for new technologies and vendor assessments.
- Update internal policies and procedures reflecting AI integrations.
- Conduct regular staff training to ensure compliance awareness and operational safety.
Key compliance deadlines
Institutions should prepare for three key deadlines:
Deadline 1: 2 February 2025
- Comply with initial provisions: understand scope, critical definitions, and prohibited AI practices.
- Immediate priority: Eliminate unacceptable AI risks from operational practices.
Deadline 2: 2 August 2025
- Ensure full transparency and confidentiality compliance concerning general-purpose AI.
- Evaluate potential regulatory breaches and operational impacts to mitigate risks.
- Establish compliant reporting protocols.
Note: Non-compliance risks significant penalties—up to €35 million or 7% annual turnover—highlighting the critical importance of proactive compliance management.
Deadline 3: 2 August 2027
- Obligations for managing high-risk AI systems become enforceable, requiring robust frameworks for risk management, data governance, documentation, transparency, human oversight, accuracy, and cybersecurity.
- Firms should utilise forthcoming EC guidelines (due by 2 February 2026) to finalise robust compliance strategies.
Conclusion
While the EU AI Act introduces new compliance obligations, it fundamentally serves to enable financial institutions to leverage AI safely and responsibly. By embedding AI within familiar regulatory frameworks and proactively planning for deadlines, institutions can confidently harness AI’s transformative potential, minimising compliance risks and maximising operational effectiveness. If you would like to discuss any aspects of this article, please feel free to reach out to Stuart Smith or your own fscom advisor.
This post contains a general summary of advice and is not a complete or definitive statement of the law. Specific advice should be obtained where appropriate.
