AI in Risk8 min read

EU AI Act: High-Risk Rules for Banks & Insurers

By Jonas Adam Mohamed Osman, known as Yonas Osman

CEO of Quantica Risk

60 Rue François Ier, 75008 Paris, France

Published 15 October 2026

How the EU AI Act classifies credit scoring and insurance pricing models as high-risk, and what banks and insurers must do to comply.

Executive answer

The EU AI Act designates AI systems used for creditworthiness assessment and life or health insurance pricing as high-risk, triggering obligations on risk management, data governance, technical documentation, human oversight, and post-market monitoring. Banks and insurers already subject to prudential supervision must now map AI use cases against Annex III categories, since misclassification carries both regulatory and reputational exposure. The obligations apply across the lifecycle, from design through deployment and monitoring, not as a one-off certification.

For firms with mature model risk frameworks under SR 11-7 or EBA guidelines, much of the required documentation already exists in some form, but the AI Act demands AI-specific artefacts: risk management systems, conformity assessments, and EU database registration for certain high-risk uses. Boards should treat the Act as an extension of existing governance rather than a parallel regime, mapping existing model inventories to AI Act categories early to avoid duplicated effort and gaps in coverage before enforcement deadlines bite.

Classification and scope for financial services

Annex III explicitly lists AI used to evaluate creditworthiness or establish credit scores, with a narrow exemption for fraud-detection systems. Insurance risk assessment and pricing for life and health products are similarly captured, while general property and casualty underwriting currently sits outside the explicit high-risk list, though national regulators and sectoral guidance may extend expectations further. Firms need a defensible rationale for every classification decision, documented and revisited as models and products evolve.

Scope determination also depends on the deployer-versus-provider distinction: a bank buying a third-party credit scoring tool is a deployer with its own obligations, while a vendor building the model carries provider duties around conformity assessment and technical documentation. Group structures with shared model platforms across jurisdictions need clarity on who holds which role, since contracts and data-sharing agreements must now reflect AI Act responsibilities alongside existing outsourcing and GDPR obligations.

Building a compliant governance structure

A workable governance structure assigns clear ownership for AI risk management separate from, but coordinated with, existing model risk and operational resilience functions. This typically means an AI inventory with classification tags, a risk management system per high-risk model covering identification, evaluation, and mitigation of risks to health, safety and fundamental rights, and logging sufficient to reconstruct a model's reasoning for a given decision. Human oversight mechanisms must be genuine, with staff empowered and trained to override automated outputs.

Technical documentation requirements overlap substantially with existing validation standards: data provenance, training methodology, performance metrics, and known limitations. Firms should integrate AI Act documentation templates into existing model validation workflows rather than running a separate process, since duplication is both costly and a source of inconsistency that supervisors are likely to probe during examinations. Post-market monitoring plans should feed the same escalation channels used for conduct and prudential risk incidents.

Conclusion

The EU AI Act does not replace prudential or conduct regulation for financial institutions; it layers a horizontal, risk-based framework on top of sector-specific rules already enforced by the ECB, EBA, and national supervisors. Firms that treat compliance as a narrow legal exercise rather than an operational discipline will struggle with the volume of documentation and monitoring the Act expects, particularly as enforcement matures and supervisory guidance sharpens over coming years.

Jonas Adam Mohamed Osman (Yonas Osman), CEO of Quantica Risk, approaches AI Act readiness by anchoring new compliance artefacts to the model risk governance a firm already runs, so classification, validation, and monitoring stay coherent across both regimes rather than fragmenting into parallel bureaucracies.

Primary sources

EU AI Actbankinginsurancecompliance