AI Act Countdown: What Applies When, Translated for Financial Firms

Update, 11 October 2026: The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026 and postpones the high-risk obligations. For stand-alone Annex III systems — including creditworthiness assessment and life and health insurance pricing — they now apply from 2 December 2027; for AI embedded in regulated products (Annex I) from 2 August 2028. The transparency duties under Article 50 still apply from 2 August 2026, with a grace period until 2 December 2026 for labelling synthetic content from systems already on the market. The work plan below remains valid — it simply gained sixteen months.

Regulation usually arrives as an event; the AI Act arrives as a staircase. Prohibited practices in February 2025, general-purpose model duties in August 2025, the general application of the framework on 2 August 2026 — and, as the step that matters most for finance, the high-risk regime, which follows on 2 December 2027 after the postponement by the Digital Omnibus.

Why finance specifically? Because Annex III of Regulation (EU) 2024/1689 names two financial use cases as high-risk by design: creditworthiness assessment of natural persons and risk assessment and pricing in life and health insurance. Every consumer-facing lender, BNPL provider, and insurtech operating models in these fields is either a provider or a deployer of a high-risk AI system — vocabulary the Act attaches concrete duty catalogues to.

The provider/deployer distinction carries the compliance economics. Providers — those developing the system or having it developed under their name — carry the full programme: risk management system, data governance, technical documentation, logging, human oversight design, accuracy and robustness testing, conformity assessment, and registration. Deployers — firms using the system professionally — carry a lighter but real set: using systems per instructions, ensuring human oversight, monitoring, and specific transparency duties toward affected persons. A bank buying scoring software is typically a deployer; the moment it substantially modifies the model or markets it under its own name, it can slide into the provider role — a boundary worth mapping before, not after, the deadline.

What “High-Risk Compliance” Actually Contains

• Data governance with teeth: training, validation, and test data must be relevant, representative, and examined for bias — documented in a way an auditor can follow.
• Human oversight that is real: a named function with the competence and authority to intervene, not a rubber-stamp screen at the end of an automated pipeline.
• Logging and traceability: automatically recorded events sufficient to reconstruct why a decision was produced.
• Transparency toward affected persons: in credit contexts this interlocks with CCD2 and GDPR rights around automated decisions — one explanation architecture should serve all three.

The Financial-Supervision Interlock

The Act was written knowing that finance already lives under model governance expectations. Financial institutions may integrate parts of the AI Act's requirements into their existing risk and governance frameworks, and supervision of financial-sector use cases is channelled toward the financial supervisors — in Germany, BaFin's role in market surveillance for these use cases makes the AI conversation part of the ordinary supervisory relationship rather than a separate universe. For firms with existing model-risk management, the practical task is mapping and closing deltas, not building from zero.

One honest caveat belonged in every briefing of the first half of 2026: Brussels was debating targeted simplifications and timing adjustments — and adopted them with the Digital Omnibus in July 2026. The AI Act's implementation ecosystem — standards, guidance, national authorities — is still racing the calendar. Prudent planning treats 2 December 2027 as the operative deadline; betting the roadmap on a further delay is not a strategy.

“

For credit scoring, the AI Act is not new philosophy — it is old model governance with legal force and a registration number.

The Vendor Dimension

Most DACH financial firms will meet the Act through their vendors. That converts procurement into the first line of compliance: contracts need the provider's conformity documentation, cooperation duties for oversight and logging, and clarity about who carries which role when the product is configured, fine-tuned, or white-labelled. SaaS vendors selling scoring, fraud, or underwriting components into the DACH market should treat a complete AI Act dossier as sales collateral — the firms that show up with it will clear procurement while competitors are still drafting answers.

A 60-Day Working Plan

1. 01Inventory every AI-supported decision touching natural persons; classify against Annex III and the prohibited-practices list.
2. 02Assign provider/deployer roles per system — including the modified-vendor-model edge cases.
3. 03Map existing model-governance artefacts against the high-risk catalogue; the gap list is your project plan.
4. 04Repaper critical vendor contracts for documentation, logging access, and cooperation duties.
5. 05Stand up the human-oversight function with real authority and train it on the specific systems.

Beyond Annex III: The Rest of the Estate

High-risk is the sharpest category, not the only one. Chatbots and customer-facing assistants carry transparency duties — users must know they are talking to a machine. Generated content meets labelling expectations. Internal copilots for developers and analysts sit largely in the unregulated comfort zone, but their outputs flow into regulated processes, which is why sensible governance inventories them anyway. And the general-purpose models most firms build on carry their own provider obligations upstream — meaning part of your compliance story is, once again, vendor selection: which foundation-model providers can evidence their AI Act posture, and what do your contracts inherit from them.

The organisational answer that is emerging across DACH financial firms is unspectacular and correct: an AI register maintained like the outsourcing register, a lightweight intake process that classifies new use cases before they ship, and clear ownership in the second line. Firms that have this running early will find the deadline an administrative event; firms improvising it at the last minute will discover how many models they run that nobody formally owns.

Conclusion

The AI Act turns AI governance in finance from a slide deck into an inspection topic — for credit and insurance models from December 2027. The firms that fare well will be those that treated credit and insurance models as regulated infrastructure all along — and documented it. Aegiron Capital Group supports financial firms and their technology vendors in classifying systems and building AI Act readiness into existing governance; legal advice comes from the law firm you engage.