EU AI Act high-risk classification: what financial services firms need to check before adopting an AI tool

If you're evaluating an AI meeting notetaker, a research tool, or an AML platform for a regulated financial firm, one question keeps coming up: does the EU AI Act actually apply to this, and how seriously? This guide answers that plainly, for the specific tools financial services firms are actually buying right now.

The short answer

Most of the AI tools regulated firms use day to day — meeting notetakers, general research assistants, communications archiving — are not classified as high-risk under the EU AI Act. They fall under lighter "limited risk" transparency obligations instead. But a smaller set of AI systems, the ones that actually make or materially influence a decision about a person's access to credit, insurance, or financial services, are named high-risk, and those carry real, ongoing obligations.

The deadline moved — here's what's actually current

The EU AI Act's high-risk obligations under Annex III were originally set to apply from 2 August 2026. That date has already passed. But it didn't take effect as planned: the European Commission's Digital Omnibus on AI package pushed the Annex III high-risk deadline back to 2 December 2027. That proposal cleared the European Parliament on 16 June 2026, received final Council sign-off on 29 June, and formally entered into force on 27 July 2026.

Separately, high-risk AI systems that are safety components embedded in already-regulated products (Annex I — things like medical devices or machinery) had their deadline pushed from August 2027 to 2 August 2028.

What actually counts as "high-risk" for a financial firm

Annex III lists specific use cases, not entire products. A tool isn't high-risk just because a bank uses it — it's high-risk if its output is genuinely used to make or materially shape one of these decisions:

• Creditworthiness assessment and credit scoring of individuals — deciding or meaningfully influencing whether someone gets a loan, a card, or a credit line, and on what terms.
• Risk assessment and pricing for life and health insurance — an AI system that sets or materially informs the premium or eligibility a person is offered.
• Fraud detection systems where the output affects someone's access to financial services — for example, a system that can trigger an account freeze or a declined application, not just flag something for a human to review with full discretion.

The distinction that matters most in practice: a tool that informs a human who retains real judgment is a very different case from a tool whose output determines the outcome. Where that line actually falls for your specific setup is a judgment call worth getting right with a compliance professional, not guessing at.

What "limited risk" tools still need to do

Meeting notetakers, general research assistants, and most communications archiving tools typically sit in the "limited risk" tier — which isn't the same as no obligations. The Article 50 transparency requirement already applies: if a system is generating or manipulating content that could be mistaken for human output, or engaging in something like a chatbot interaction, there's a disclosure obligation. For most B2B tools used internally by staff rather than facing end customers, this is a lighter lift — but it's still worth confirming with each vendor rather than assuming it doesn't apply.

What high-risk classification actually requires

If a system does fall under Annex III, the obligations are substantial — this isn't a checkbox exercise:

• A documented risk management system, maintained through the system's lifecycle
• Data governance requirements for the data used to train and operate the system
• Technical documentation and automatically generated logs
• Human oversight measures — a real, meaningful ability for a person to intervene
• A conformity assessment before the system goes into use
• Registration in an EU database for high-risk AI systems

This is why the classification question matters so much before you sign a contract — it determines whether you're looking at a straightforward vendor review, or a genuine compliance project.

What to actually do before adopting a tool

1. Map the tool's actual output to a decision. Does anything it produces feed into a credit, insurance pricing, or fraud-related decision that affects a customer? If not, you're very likely in the limited-risk tier.
2. Check the vendor's own EU AI Act positioning. A vendor that has thought about this will usually say so directly in their trust center or compliance documentation.
3. Don't assume "AI" plus "finance" automatically means high-risk. The classification is about the specific use case, not the industry or the fact that AI is involved at all.
4. Document the classification decision itself, not just the tool review — an examiner will want to see that you considered this, not just that you happened to land on the right answer.
5. Revisit this periodically. The Digital Omnibus delay shows this framework is still moving. A classification that's correct today is worth rechecking against the current rules before it becomes load-bearing for a major system.

Classification is only one part of a vendor review. For the wider checklist, covering security assurance, data handling, contract terms and exit planning, see our AI vendor due diligence checklist.

This article is a general summary for orientation purposes and is not legal advice. AI Act classification for a specific system and use case should be confirmed with a qualified compliance or legal professional. Regulatory timelines are subject to further change — always verify current status before relying on any date here.