EU AI Act delay: what it means for banks

In July 2026 the EU changed the AI Act timetable. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was adopted on 8 July 2026 and published in the Official Journal on 24 July 2026 [1]. The Commission announced its entry into force on 27 July 2026 [2].

For banks the headline is simple. The rules for high-risk AI systems listed in Annex III, which include credit scoring, now apply from 2 December 2027 instead of 2 August 2026 [3]. That is about 13 months from today. It is not a pause. Several duties already apply, and the work needed for December 2027 takes longer than most project plans assume.

What moved

The amended Article 113 now sets two later dates for the high-risk rules in Chapter III, Sections 1 to 3 [3]:

2 December 2027 for AI systems that are high-risk because they are listed in Annex III (Article 6(2)).
2 August 2028 for AI systems that are high-risk because they are part of products covered by the EU laws in Annex I (Article 6(1)).

The regulation explains why. Standards, common specifications and guidance were late, and national authorities were not yet in place, so keeping the August 2026 date risked higher costs without better protection [1, recital 40].

Two Annex III entries matter most for financial institutions [4]:

Point 5(b): AI systems used to evaluate the creditworthiness of natural persons or to establish their credit score. Systems used to detect financial fraud are excluded.
Point 5(c): AI systems used for risk assessment and pricing of natural persons in life and health insurance.

One rule removes most room for argument. Article 6(3) lets some Annex III systems escape the high-risk label if they only do narrow or preparatory tasks. But an Annex III system that performs profiling of natural persons is always high-risk [5]. Most credit scoring involves profiling.

What banks must do as deployers from 2 December 2027

Most banks will be deployers of high-risk systems, and some will also be providers of systems they build themselves. Article 26 sets the deployer duties [6]. In short, a deployer must:

use the system according to the provider's instructions;
assign human oversight to people with the necessary competence, training, authority and support;
make sure input data it controls is relevant and sufficiently representative;
monitor the system and report risks and serious incidents;
keep the logs the system generates for at least six months;
tell people when a high-risk system makes, or helps make, decisions about them.

There are two adjustments for financial institutions. The monitoring duty is treated as met when the bank follows the internal governance rules of EU financial services law, and the logs are kept as part of the documentation those rules already require [6].

Deployers of credit scoring systems (5(b)) and of life and health insurance pricing systems (5(c)) must also carry out a fundamental rights impact assessment before first use (Article 27) [7]. Because Article 27 sits in Chapter III, Section 3, it follows the same December 2027 date.

What did not move

The delay covers the high-risk chapter only. These parts of the Act are already in force:

AI literacy (Article 4) and prohibited practices (Article 5) have applied since 2 February 2025 [3]. The Omnibus reworded Article 4. Providers and deployers must still take measures to support the AI literacy of their staff, but the text now says this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual" [8].
New prohibitions on AI that generates non-consensual intimate images or child sexual abuse material apply from 2 December 2026 [3, 9]. These rarely touch bank use cases, but they belong in your acceptable-use policy for generative AI tools.
The general date of application, 2 August 2026, still stands for the rest of the Act [3]. That includes the transparency duties in Article 50, for example making clear to people that they are dealing with an AI system and disclosing deepfakes [10]. According to the Council, providers get until 2 December 2026 to put marking solutions for AI-generated content in place [9].
Rules for general-purpose AI models (Chapter V) have applied since 2 August 2025 [3]. They fall mainly on model providers, not on banks that use the models.

Two other things did not move either.

DORA. The Digital Operational Resilience Act has applied since 17 January 2025 [11]. Article 28(3) requires a register of information on all contractual arrangements for ICT services from third-party providers [11]. In our reading, most AI services a bank buys, from model access to agent platforms, are ICT services, so they belong in that register today.

Supervision. The ECB does not wait for the AI Act. In February 2026 its representative to the Supervisory Board said that more than 85% of large banks under European supervision already use AI in some form. He named "fragmented ownership" as a recurring concern and said the ECB will keep monitoring AI under its 2026 to 2028 supervisory priorities, with a closer look at generative AI [12].

A timeline for banks

Date	What applies	Source
17 January 2025	DORA, including the register of information	[11]
2 February 2025	AI literacy (Art. 4) and prohibited practices (Art. 5)	[3]
2 August 2025	General-purpose AI model rules (mainly providers)	[3]
2 August 2026	General application, including transparency (Art. 50)	[3]
2 December 2026	New prohibitions (Art. 5(1)(ba), (bb)); deadline for content-marking solutions	[3, 9]
2 December 2027	High-risk duties for Annex III systems, including credit scoring and life and health insurance pricing	[3]
2 August 2028	High-risk duties for AI in Annex I products	[3]

What to do with the next 13 months

The hard part of December 2027 is not writing policies. It is knowing, for every AI system, what it is, who owns it, whether it is high-risk, and what was decided about it. That takes months in a bank, and the number of systems keeps growing as staff build agents on platforms such as Microsoft Copilot Studio.

A practical order of work:

Build the inventory now. You cannot classify what you have not found. Include agents built by business teams and AI features inside vendor software, not only models built by data science.
Classify each system against Annex III and Article 6(3), and write down the reasoning. Profiling means high-risk.
Name an owner and the people who provide oversight for each high-risk system, and record their training. Article 26(2) asks for competence and authority, not just a name.
Record decisions as they happen. Approvals, assessments and changes are much harder to reconstruct a year later. Keep a history you can show as it stood on a given date.
Plan log retention inside the documentation your banking rules already require.
Prepare the fundamental rights impact assessment for credit scoring and for life and health pricing.
Link AI providers to your DORA register of information, so one system has one record seen from both laws.
Keep evidence of AI literacy measures. That duty already applies.

Where Signoria fits

Signoria is a register for the AI agents, models and tools a regulated institution connects, with a named owner, approvals and an audit trail. It runs inside the institution's own infrastructure. Read-only connectors find agents on Microsoft Copilot Studio and Amazon Bedrock and ask their owners to confirm, and existing spreadsheets load row by row. The register can be viewed as it stood on any date.

It does not replace legal advice or your GRC tool. It gives you the inventory and the evidence trail the steps above depend on.

Request the free 90-day pilot and build your register on your own estate.

Sources

Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 24.7.2026, including recital 40. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
European Commission, "AI Omnibus enters into force". https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
AI Act, Article 113 (consolidated text as at 27 July 2026), AI Act Service Desk, European Commission. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113
AI Act, Annex III. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
AI Act, Article 6. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6
AI Act, Article 26. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
AI Act, Article 27. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27
AI Act, Article 4 (as amended). https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4
Council of the EU, "Timeline: Artificial intelligence" (entry of 29 June 2026). https://www.consilium.europa.eu/en/policies/artificial-intelligence-act/timeline-artificial-intelligence/
AI Act, Article 50. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
Regulation (EU) 2022/2554 (DORA), Articles 28 and 64. https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng
Pedro Machado, ECB, "Technology is neutral, governance is not: AI adoption in the banking sector", 24 February 2026. https://www.bankingsupervision.europa.eu/press/speeches/date/2026/html/ssm.sp260224~6c5b64a77a.en.html

This article explains the law in general terms. It is not legal advice. Check the current text on EUR-Lex before relying on any date.

EU AI Act: what the delay means for banks