High-risk AI in banking: What the EU AI Act really means for credit institutions

When AI becomes a regulatory issue

Hardly any other sector is as data-driven as the financial sector. This is precisely why the EU AI Act (Regulation (EU) 2024/1689) has a particular impact on the banking sector: many typical banking use cases fall within the regulation’s strictest non-prohibited risk category, namely high-risk AI.

Was bereits gilt und was ab Dezember 2027 kommt

Viele Pflichten gelten schon länger. Neu ist, dass im Finanzsektor nun die BaFin über ihre Einhaltung wacht. Ab sofort prüft sie ^[2]:

• ob eingesetzte KI-Systeme verbotene Praktiken enthalten (gilt seit Februar 2025),
• ob die Transparenzpflichten eingehalten werden, Menschen also erkennen können, dass sie etwa mit einem Chatbot kommunizieren oder Inhalte mit KI erzeugt wurden (gilt seit August 2026) ^{[1], [2]},
• ob Unternehmen Maßnahmen ergreifen, um die KI-Kompetenz ihrer Mitarbeitenden zu fördern (gilt seit Februar 2025) ^[4].

Ab dem 2. Dezember 2027 kommen die Anforderungen an Hochrisiko-KI im Banking hinzu. Im Zuständigkeitsbereich der BaFin betrifft das KI-Systeme zur Kreditwürdigkeitsprüfung und Bonitätsbewertung natürlicher Personen sowie zur Risikobewertung und Preisbildung in der Lebens- und Krankenversicherung ^[2]. Ursprünglich sollten diese Pflichten schon im August 2026 greifen, doch die Digital-Omnibus-Verordnung zur KI hat den Stichtag um 16 Monate verschoben ^[5]. Die Institute gewinnen damit Zeit, aber keine Entlastung, denn an den Anforderungen selbst ändert sich im Kern nichts.

What makes an AI system in the banking sector ‘high-risk AI’?

The EU AI Act distinguishes between four risk categories: prohibited practices, high risk, limited risk (in particular transparency requirements, such as for chatbots) and minimal risk. A system is classified as high risk if it constitutes a safety component of an already regulated product or falls within one of the eight sensitive areas of application listed in Annex III.¹

Of key importance to banks is Annex III, No. 5(b): AI systems used for creditworthiness checks and credit rating assessments of natural persons are explicitly classified as high-risk AI, regardless of whether a human ultimately makes the formal decision.² This also includes HR screening in banks’ internal recruitment processes.¹

Not all related use cases are legally equally clear-cut: pure fraud detection is expressly excluded²; fully automated lending remains, contrary to what is often claimed, highly relevant to high-risk activities³; and, in the area of anti-money laundering, there is as yet no clear legal basis for a blanket classification.⁴

When institutions develop their own systems: the obligations of providers

If institutions develop an AI system themselves or have it developed under their own name, they are subject to the more comprehensive provider obligations set out in Articles 9–15. In this case, rather than merely monitoring its correct use, they must themselves ensure the system’s safety throughout its entire life cycle, from data quality to cyber security. Specifically, this encompasses continuous risk management, data governance with active bias detection, technical documentation, record-keeping obligations, transparency towards operators, human oversight as a design principle, as well as robustness and accuracy.¹⁴

Breaches are punishable by fines of up to 15 million euros or 3 per cent of global annual turnover, whichever is higher.¹⁵

Hebel 1: Das KI-Inventar