Every compliance officer in European financial services has had 2 August 2026 circled on the calendar for months. It is the point at which the EU AI Act's obligations for high-risk AI systems stop being a preparation exercise and start being an operating requirement. For banks and insurers, the date matters more than for most industries, because two of their core activities — creditworthiness assessment and risk-based pricing in life and health insurance — sit squarely in the Act's high-risk category.
The uncomfortable truth is that many institutions have treated the AI Act the way they once treated GDPR: as a documentation project to be completed shortly before the deadline. That approach failed in 2018 and it will fail again now, because the AI Act does not primarily ask for documents. It asks for a functioning management system around every high-risk model — and functioning systems cannot be back-dated.
What "high-risk" actually demands For a high-risk AI system, the Act requires a risk management system that runs across the model's whole lifecycle, data governance that can demonstrate training data is relevant and representative, technical documentation and logging that make the system's behaviour reconstructable, human oversight that is real rather than ceremonial, and demonstrated accuracy and robustness. Each of these maps to something financial institutions already do for regulated models — which is both the good news and the trap.
The good news: a bank with a mature model risk management framework, or an insurer that has implemented EIOPA's 2025 opinion on AI governance, already owns most of the scaffolding. The trap: existing frameworks were built around statistical models with stable inputs and outputs. Generative and agentic systems — the ones procurement teams are buying fastest — fit those frameworks poorly, and regulators on both sides of the Atlantic have openly said so.
Five controls that matter more than paperwork First, a complete AI inventory: you cannot classify what you have not catalogued, and shadow AI in business units is the most common gap examiners find. Second, a defensible high-risk classification methodology, applied consistently and reviewed by someone other than the system's owner. Third, human oversight with authority — a named person who can halt the system, not merely a review committee that receives reports. Fourth, vendor traceability: most high-risk AI in finance is bought, not built, and the deployer keeps obligations it cannot outsource. Fifth, logging sufficient to answer, months later, why a specific decision was made about a specific customer.
Institutions that treat August 2026 as the finish line will spend 2027 in remediation. The ones that treat it as the starting gun for continuous AI assurance — the same way Solvency II and CRD became business as usual — will find the next supervisory cycle unremarkable. In regulation, unremarkable is the goal.
Related reading - [EIOPA's AI opinion is the Rosetta Stone between Solvency II and the AI Act](/insights/eiopa-ai-opinion-solvency-ii-ai-act-jonas-osman-abdelghafour) - [You didn't build it, but you own it: third-party AI risk comes of age](/insights/third-party-ai-vendor-risk-financial-services-jonas-osman-abdelghafour) - [Generative AI just fell out of model risk guidance. What fills the gap?](/insights/generative-ai-model-risk-management-gap-jonas-osman-abdelghafour)
See also Regulatory Compliance, Model Risk and Insurance Risk.
About the author Jonas Osman Abdelghafour writes about AI governance, risk management, and regulation in insurance and banking. Follow Jonas Osman Abdelghafour for analysis of how supervisors, carriers, and banks are adapting to artificial intelligence.
Frequently asked questions
What "high-risk" actually demands?
For a high-risk AI system, the Act requires a risk management system that runs across the model's whole lifecycle, data governance that can demonstrate training data is relevant and representative, technical documentation and logging that make the system's behaviour reconstructable, human oversight that is real rather than ceremonial, and demonstrated accuracy and robustness. Each of these maps to something financial institutions already do for regulated models — which is both the good news a...
What should risk leaders know about five controls that matter more than paperwork?
First, a complete AI inventory: you cannot classify what you have not catalogued, and shadow AI in business units is the most common gap examiners find. Second, a defensible high-risk classification methodology, applied consistently and reviewed by someone other than the system's owner. Third, human oversight with authority — a named person who can halt the system, not merely a review committee that receives reports. Fourth, vendor traceability: most high-risk AI in finance is bought, not bui...
What should risk leaders know about related reading?
See also [Regulatory Compliance](/expertise/regulatory-compliance), [Model Risk](/expertise/model-risk) and [Insurance Risk](/expertise/insurance-risk).
What should risk leaders know about about the author?
Jonas Osman Abdelghafour writes about AI governance, risk management, and regulation in insurance and banking. Follow Jonas Osman Abdelghafour for analysis of how supervisors, carriers, and banks are adapting to artificial intelligence.