The EU AI Act for financial services: what the Digital Omnibus changed, and what already applies

The short answer

The Digital Omnibus pushed the EU AI Act's high-risk obligations back to 2 December 2027, but it didn't shrink what counts as high-risk, and several parts of the Act already apply. Credit scoring of individuals and life and health insurance pricing are still squarely in scope. The transparency rules, which cover things like a customer-facing chatbot, have applied since 2 August 2026.

This guide is for compliance and risk teams at financial services firms in Ireland and the UK. It covers what the Omnibus changed, what already applies, which obligations land on your firm, and where to start with the extra time.

Which financial services uses are high-risk

Two of the Act's high-risk categories sit squarely in financial services. Annex III, point 5(b), covers AI used to evaluate the creditworthiness of individuals or establish their credit score. Point 5(c) covers AI used for risk assessment and pricing of individuals in life and health insurance.

Both are narrower than they're often described. Credit assessment of companies isn't covered, because the category is about natural persons. General insurance pricing, such as motor or home, isn't covered either. And 5(b) explicitly carves out AI used to detect financial fraud, which catches a lot of people out.

There's an exemption in Article 6(3), but it rarely helps here. An Annex III system isn't high-risk if it doesn't pose a significant risk, for example because it doesn't materially influence the decision. A system that profiles individuals is always high-risk, though, and credit scoring and insurance pricing are profiling almost by definition.

One point for KYC teams: remote biometric identification is high-risk, but one-to-one verification that simply confirms a customer is who they say they are is excluded.

What the Digital Omnibus changed

The Omnibus, formally Regulation (EU) 2026/1744, entered into force on 27 July 2026, six days before the original high-risk deadline. It mostly moved dates. It didn't change which uses count as high-risk, and it didn't exempt any sector or size of firm.

It also pushed back the deadline for AI built into regulated products, such as medical devices, to 2 August 2028. That matters far less to most financial services firms. Dates are taken from Regulation AI's record of the changes, with the publication and entry-into-force dates confirmed on EUR-Lex.

What already applies

The high-risk deadline moved, but three parts of the Act already bind financial services firms today.

• Banned practices, since February 2025. Most won't touch a regulated firm, but they're worth checking against anything customer-facing. The Omnibus adds two more bans from 2 December 2026, on AI that generates child sexual abuse material or non-consensual intimate imagery.
• AI literacy, since February 2025. The Omnibus reworded this as a duty to take measures that support AI literacy, rather than to guarantee a set level. In practice, you should be able to show what training and guidance you've given the people who use AI tools.
• Transparency, since 2 August 2026. Under Article 50, a customer talking to an AI chatbot has to be told it's AI, unless that's obvious. Building that in is the provider's job, so if you use a vendor's chatbot, check your contract covers it and that the notice actually appears in your app or website. Deepfakes are different: if your firm publishes AI-generated or manipulated images, audio or video, disclosing that is your duty, not the vendor's.

Generative AI providers also have to mark their output as AI-generated in a machine-readable way. Systems launched since 2 August 2026 must do this now, and systems already on the market before then have until 2 December 2026. This sits with your vendors, as do the rules for general-purpose AI models, which apply to the companies building them rather than the firms using them.

Provider or deployer: which duties land on you

Most financial services firms buy their credit scoring or underwriting tools rather than build them, which makes them deployers. The heaviest obligations, such as risk management systems, technical documentation and conformity assessment, sit with the provider. Build a model in-house and you're the provider, and putting your own name on a vendor's system or changing what it's used for can make you one too.

As a deployer of a high-risk system, from 2 December 2027 you'll need to meet Article 26:

• use the system in line with the provider's instructions
• assign human oversight to people with the competence, training and authority to do it
• make sure any input data you control is relevant and representative
• monitor how it's working, and report risks and serious incidents to the provider
• keep its logs for at least six months
• tell customers when a high-risk system is used in decisions about them

There's some relief for regulated firms. If you're already subject to internal governance rules under EU financial services law, meeting those rules counts as meeting the monitoring duty, and the logs can sit within the documentation you already keep.

One obligation is specific to this sector. Under Article 27, deployers of credit scoring and life and health insurance pricing systems must complete a fundamental rights impact assessment before first use, then notify the market surveillance authority of the results. Apart from public bodies and firms providing public services, these are the only deployers it applies to, so most other high-risk AI a private firm uses won't trigger it. It can build on an existing data protection impact assessment, so it doesn't have to start from a blank page.

Who supervises it, in Ireland and the UK

In Ireland, the Central Bank supervises AI Act compliance by regulated financial services firms. The Regulation of Artificial Intelligence Act 2026 came into force on 31 July 2026. It set up the AI Office of Ireland as a central coordinator and named sector regulators, including the Central Bank, as market surveillance authorities. Fines for breaching operator obligations, which include the deployer duties above, run up to €15 million or 3% of worldwide turnover, whichever is higher.

In practice, that means your AI Act supervisor is the same regulator that already supervises your DORA, outsourcing and governance arrangements. It's one more reason to run AI governance through the framework you already have rather than as a separate programme.

For UK firms, the Act's reach depends on where the AI is used. Under Article 2, it covers providers placing systems on the EU market and firms outside the EU whose AI output is used in the EU. A UK-only lender scoring UK customers sits outside it. A UK group with an Irish entity, or one lending or insuring into the EU, probably doesn't.

Where to start

December 2027 is about 14 months away, and the slow part isn't the controls. It's working out what AI you actually have. A sensible order:

1. List every AI system the firm uses. Include the ones inside vendor tools, which is where most of it will be. Your third-party register, including the DORA Register of Information if you keep one, is a good place to start the questions.
2. Classify each one. Does it score individuals for credit, or price life or health cover? Is it fraud detection, which is carved out? Does it profile people?
3. Decide whether you're the provider or the deployer for each system, because that decides which obligations apply.
4. Give each system an owner and put it on the risk register you already run, with its controls: human oversight, log retention, and a fundamental rights impact assessment where one's needed.
5. Check your vendor contracts for instructions for use, access to logs, incident notification and, for chatbots, the Article 50 disclosure.

None of this needs a separate AI programme. It needs the AI systems to show up in the same register, with the same owners and the same reporting line to the board, as every other risk you manage.

Frequently asked questions

When do the EU AI Act's high-risk rules apply to financial services firms?

From 2 December 2027 for Annex III systems, which include credit scoring and life and health insurance pricing. The Digital Omnibus moved the date from 2 August 2026.

Is credit scoring high-risk under the EU AI Act?

Yes, when it evaluates the creditworthiness of individuals or sets their credit score. Credit assessment of companies isn't covered.

Is fraud detection high-risk under the EU AI Act?

No. AI used to detect financial fraud is explicitly excluded from the credit scoring category, though the transparency rules can still apply if customers interact with it.

Does the EU AI Act apply to UK financial services firms?

Only where the AI system is placed on the EU market or its output is used in the EU, for example through an Irish entity or EU customers. A UK-only firm serving UK customers sits outside it.

Who supervises the EU AI Act for financial services in Ireland?

The Central Bank of Ireland, designated as a market surveillance authority under the Regulation of Artificial Intelligence Act 2026.

How Regulyst fits

Regulyst is a compliance and risk platform for financial services firms in Ireland and the UK. It keeps your risk register, controls, policies and third-party risk in one place, so an AI system can be logged, given an owner and managed alongside DORA and the rest of your programme. If that's the problem you're working through, book a walkthrough.

Sources

This article is general information, not legal advice. Check how the Act applies to your firm with your own advisers.

• Regulation (EU) 2026/1744, the Digital Omnibus on AI, EUR-Lex
• Changes to the AI Act as amended, Regulation AI
• Annex III, Article 26, Article 27 and Article 50, EU AI Act Explorer
• Article 6, European Commission AI Act Service Desk
• Ireland's new AI enforcement framework, Arthur Cox via Legal 500