Why the financial sector is in focus
Annex III No. 5(a) of Regulation (EU) 2024/1689 explicitly classifies AI systems for creditworthiness assessment of natural persons as high-risk. Only the detection of financial fraud is excluded.
Additionally, AI systems for risk assessment and pricing in life and health insurance fall under Annex III No. 5(b).
High-risk AI systems in the financial sector
| Application | Annex III | High-risk? |
|---|---|---|
| Credit scoring of natural persons | Nr. 5(a) | Yes |
| Creditworthiness assessment | Nr. 5(a) | Yes |
| Insurance pricing (life/health) | Nr. 5(b) | Yes |
| AML/KYC-Screening | — | No (fraud detection) |
| Algorithmic trading | — | No (no natural person affected) |
| Customer service chatbot | — | No (Art. 50 transparency obligation) |
Regulatory interplay
Financial service providers must implement the EU AI Act in the context of existing financial regulation:
- MiFID II (Directive 2014/65/EU) – Algorithmic trading requirements, best execution for AI systems
- CRD/CRR – Credit risk models and internal ratings
- Solvency II – AI in the insurance sector (risk assessment, pricing)
- DORA (Regulation (EU) 2022/2554) – Digital operational resilience, ICT risk management
- GDPR – Automated individual decisions (Art. 22 GDPR) in credit decisions
Market surveillance: BaFin as primary authority
Under Art. 74 EU AI Act, the sector-specific authorities are primarily responsible for the financial sector:
| Country | Primary authority | Horizontal authority |
|---|---|---|
| Germany | BaFin | Bundesnetzagentur |
| Austria | FMA | RTR |
| Netherlands | AFM/DNB | ACM |
| France | ACPR/AMF | ARCOM |
FRIA obligation for credit scoring
Art. 27(1)(b) EU AI Act explicitly obliges deployers of AI systems under Annex III No. 5(a) – i.e. credit scoring systems – to conduct a Fundamental Rights Impact Assessment (FRIA).
This applies regardless of whether the deployer is a public or private entity. The FRIA must specifically analyse discrimination risks in credit decisions.
Documentation obligations for financial AI
- Technical Documentation – Providers of credit scoring AI must document all 13 Annex IV sections
- Transparency notice – Borrowers must be informed that AI is involved in the decision
- FRIA – Deployers must assess fundamental rights risks (non-discrimination under Art. 21 EU Charter)
- Art. 22 GDPR disclosure – Right to explanation of automated decisions continues to apply in parallel
Next steps
- Inventory – Identify all AI systems in credit, scoring and insurance
- Risk check – Use the free risk check
- BaFin requirements – Review current BaFin circulars on AI in financial services
- Documentation – Generate compliance drafts with industry-specific context