Understanding the EU AI Act Risk Tiers

The EU AI Act introduces a risk-based framework that classifies AI systems into four categories: unacceptable risk (prohibited), high risk, limited risk, and minimal risk. For financial institutions, the most significant obligations apply to high-risk AI systems — those used in credit scoring, insurance underwriting, and employment decisions.

Key Compliance Obligations for High-Risk AI

Organisations deploying high-risk AI systems must establish a risk management system, ensure data governance and training data quality, maintain technical documentation, enable human oversight, and achieve accuracy, robustness, and cybersecurity standards.

Practical Steps to Achieve Compliance

Begin with a comprehensive AI system inventory to identify which systems fall under the high-risk classification. Conduct a gap assessment against the Act's requirements, prioritise remediation based on risk level, and establish ongoing monitoring and audit processes.

Timeline and Enforcement

The EU AI Act applies in phases. Prohibited AI practices were banned from February 2025. High-risk AI system requirements apply from August 2026. Organisations should begin compliance programmes now to avoid significant penalties of up to €35 million or 7% of global annual turnover.