The AI Regulation, also known as the EU AI Act, is the European law that, for the first time, establishes specific rules governing the use of artificial intelligence. Financial institutions are at the top of the list: credit scoring, insurance underwriting, and fraud detection are AI systems that almost always fall under the strictest category of the AI Act. For anyone who builds or manages AI systems for the financial sector, the rules of the AI Regulation represent the most far-reaching legislation of this decade. <\/p>\n\n
The AI Regulation is the comprehensive European law that took effect in August 2024. The law categorizes AI systems based on risk levels: higher risk categories entail stricter obligations. The European Commission drafted the law to ensure the safe and fair use of artificial intelligence in the European market. <\/p>\n\n
The AI Act distinguishes four risk categories, with higher risk categories entailing more stringent obligations:<\/p>\n\n
The AI Regulation will take effect in phases. Prohibited AI systems will no longer be permitted as of February 2, 2025. The first obligations for providers of general-purpose AI will take effect on August 2, 2025. For AI systems in the strictest category\u2014the class that most affects the financial sector\u2014the full requirements of the AI Regulation will apply starting August 2, 2026. In addition, large AI models with a significant impact must report incidents to the European Commission. <\/p>\n\n
The financial sector is the context in which AI systems have the most direct impact on individual citizens. Decisions regarding credit, premiums, or payments based on personal characteristics have a significant impact. Annex III of the AI Regulation explicitly identifies which AI applications are considered high-risk. The use of AI in financial decision-making is the most concrete application of the law. Proper use of AI systems begins with a fair assessment of all active AI applications. <\/p>\n\n
AI systems that assess whether someone is eligible for a loan, mortgage, or credit products are considered high-risk AI systems under the AI Act. The use of AI in credit assessment has direct consequences for people. Providers of these AI systems must comply with specific obligations regarding documentation and bias monitoring. <\/p>\n\n
The use of AI in insurance underwriting\u2014specifically, high-risk AI models that calculate premiums based on personal characteristics\u2014is also subject to the strictest requirements of the AI Regulation. The law requires providers to demonstrate that datasets are of high quality and free of bias in order to prevent discrimination. <\/p>\n\n
AI systems in critical sectors such as financial services, critical infrastructure, healthcare, and law enforcement must meet strict requirements regarding data quality, data logging, and oversight. High-risk AI systems that block accounts or refuse payments\u2014with direct consequences for customers\u2014fall under the provisions of the AI Act. <\/p>\n\n
The AI Regulation also imposes requirements on providers of general-purpose AI, which are large AI models designed for general purposes. Generative AI used by financial institutions for customer communication is one of the AI applications subject to the law\u2019s transparency rules. AI models that are incorporated into products on a large scale must comply with additional traceability requirements. <\/p>\n\n
The AI Regulation sets forth a series of requirements for AI systems in the highest-risk category that go beyond existing regulations. Institutions are typically deployers, but the law makes deployers at the European level just as responsible as the builders of AI systems. <\/p>\n\n
Documentation and traceability are essential for oversight by national authorities, including the Dutch Data Protection Authority. The AI Act requires documentation of AI systems: what data was used, how the model works, and what risk assessments were conducted. Developers must conduct risk analyses, verify the origin and quality of data, validate input data, and ensure that built-in oversight mechanisms are in place. <\/p>\n\n
Organizations that use AI systems must incorporate human oversight: a human must evaluate the output and be able to override it. The AI Regulation requires that AI systems be used in accordance with the provider\u2019s instructions and that active oversight be exercised. <\/p>\n\n
When using AI systems in the highest-risk category, organizations are required to report serious incidents to the provider and the national authorities. In the Netherlands, the Dutch Data Protection Authority oversees compliance with the AI Regulation. Large AI models with a significant impact must also report incidents to the European Commission. <\/p>\n\n
Organizations are required to ensure that employees who work with AI systems understand how they operate, their ethical risks, and their societal impact. The AI Act sets requirements for AI literacy at organizations that deploy AI systems in the highest-risk category. <\/p>\n\n
The AI Regulation requires a Fundamental Rights Impact Assessment (FRIA) for the use of AI systems in the highest-risk category. This assessment evaluates whether the use of AI systems infringes upon fundamental rights, a requirement that the law adds on top of the existing DPIA obligation under the GDPR. <\/p>\n\n
Organizations in the financial sector are affected by both the AI Regulation and the Digital Operational Resilience Act (DORA). DORA takes effect on January 17, 2025, and sets out requirements for the digital resilience of financial institutions, including the AI systems and providers on which they rely. <\/p>\n\n
The two laws overlap significantly. Technical documentation, incident reporting, and requirements for providers of AI systems are included in both laws. The AI Act curbs hasty projects and compels organizations to exercise the utmost care to prevent discriminatory algorithms\u2014which is also the goal of DORA. A combined approach saves time and simplifies the application of both laws in critical processes. <\/p>\n\n
<\/p>\n\n
<\/p>
Identify which AI systems you use, manage, or offer, and what data they process. Many organizations are unaware of how many systems are in use, especially when it comes to purchased SaaS products. The legal requirements apply to every AI system you deploy on the European market. <\/p> <\/li>
Assess each AI system against Annex III of the AI Regulation. The key question: Does the use of this AI system have direct consequences for citizens in the areas of credit, insurance, or other critical decisions? The AI Act sets forth specific obligations for AI systems that impact citizens\u2019 fundamental rights. <\/p> <\/li>
Developers must conduct risk analyses and build in monitoring mechanisms. Record how AI models perform based on training data, monitor for bias, and document how datasets are compiled. Verify the quality of the data before deploying a model into production. Traceability is an ongoing legal obligation, not a one-time exercise. <\/p> <\/li>
The AI Act, the GDPR, and DORA impose overlapping requirements on AI systems in the areas of transparency and incident management. Conduct a single, combined impact assessment that covers both the DPIA and the FRIA. This prevents duplication of effort and provides a more comprehensive picture of the risks. <\/p> <\/li>
Under the AI Act, deployers are responsible for compliance, even if they did not build the AI systems themselves. The same obligations apply whenever a purchased AI system is used. Specify in contracts with providers what documentation and warranties you expect. <\/p> <\/li><\/ol><\/div>\n\n
<\/p>\n\n
<\/p>\n\n
The AI Regulation is the European AI law, officially known as the EU AI Act. The law establishes rules for the development and use of artificial intelligence in the EU based on risk levels. This law serves as the primary foundation for AI legislation in the Netherlands and at the European level. Anyone who wants to understand AI legislation should start here. <\/p> <\/div>
Prohibited AI systems will no longer be permitted as of February 2, 2025. AI systems in the highest-risk category will be subject to the full regulation starting August 2, 2026. Establishing governance, registering AI models, and adapting processes takes an average of 12 to 18 months; organizations that start now will comfortably meet the deadline. <\/p> <\/div>
The fine for using prohibited AI systems can be up to 35 million euros or 7% of global annual revenue. For failure to comply with the requirements for the most heavily regulated AI systems: up to 15 million euros or 3%. National authorities, including the Dutch Data Protection Authority, oversee compliance with the AI Regulation. <\/p> <\/div>
Yes. The law makes no exception for startups regarding AI systems in the highest-risk category. There are limited exceptions for small organizations regarding specific documentation requirements, but the core requirements\u2014high-risk classification, transparency, oversight, and incident reporting\u2014apply to all providers of AI systems on the European market. <\/p> <\/div>
The AI Act and the GDPR complement each other. The GDPR sets requirements for the processing of personal data; the Act sets requirements for AI systems themselves. Both laws contain specific provisions regarding automated decision-making and transparency. An integrated approach\u2014a single risk assessment covering both laws\u2014is the most efficient approach for organizations that use artificial intelligence. <\/p> <\/div> <\/div>\n\n
<\/p>\n\n
Disclaimer<\/strong><\/p>\n\n We take great care to ensure that the information in this article is accurate and up-to-date. Nevertheless, no rights can be derived from the contents. <\/em><\/p>\n","protected":false},"excerpt":{"rendered":" The AI Regulation, also known as the EU AI Act, is the European law that, for the first time, establishes specific rules governing the use of artificial intelligence. Financial institutions are at the top of the list: credit scoring, insurance underwriting, and fraud detection are AI systems that almost always fall under the strictest category […]<\/p>\n","protected":false},"featured_media":33411,"template":"","meta":{"_acf_changed":false,"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","content-type":"","hr_contact_first_name":"","hr_contact_image":"","hr_whatsapp_url":"","hr_phone_number":"","current_post_id":"33414","_members_access_role":[],"_members_access_error":"","_links_to":"","_links_to_target":""},"kennisbank-categorie":[],"class_list":["post-33414","kennisbank","type-kennisbank","status-publish","has-post-thumbnail","hentry"],"acf":{"kb_disable_cta_sidebar":false,"kb_disable_related_sidebar":false,"kb_featured":false,"auteur":20236,"kb_title":"","kb_cta_sidebar":{"title":"","image":null,"button":null,"content":""},"kb_related_items":null},"yoast_head":"\n