The EU AI Act Has a Category for Financial AI. Your Provider Hasn't Told You Which One.
Risk Classification of Financial AI Systems Under European AI Regulation
---
Your accounting software has a category. Your financial analysis AI has a category. Every AI tool your finance team uses for client risk assessment, decision support, or financial reporting has a risk classification under the EU AI Act (Regulation 2024/1689, which became law August 1, 2024) — and what you must implement before August 2, 2026 depends entirely on which category applies. Most providers assigned their systems to a category in 2024. Most haven't told their customers.
That silence matters because Article 26 of the EU AI Act places direct compliance obligations on "deployers" — any organization that puts an AI system to work in their operations, including financial entities using AI to process client data, analyze risk, or support financial decisions. Your obligations don't depend on what the AI vendor does. They depend on what your AI tool is classified as — and whether you can prove you've met the requirements for that classification.
Asking "does your AI comply with the AI Act?" gets you nowhere. The right question is: "Which risk category is your AI system classified under, and what does that mean for my obligations as a deployer?"
---
The Four Tiers — and Where Finance Lives
Every AI system in use today falls into one of four risk tiers under the EU AI Act. The tier your financial AI tools occupy determines what you must do before deploying them — and what you must maintain while running them.
Unacceptable risk is banned entirely. No standard financial use cases fall here.
High risk is where finance must pay close attention. Annex III of the regulation — the specific list of high-risk applications — explicitly names, at Point 5b, AI systems used for creditworthiness assessment or credit scoring of individuals, and AI systems used for risk assessment and pricing of life and health insurance. Every bank, insurer, and lending platform using AI for these purposes is deploying a high-risk system, whether or not their vendor has said so.
Deployer obligations for high-risk AI are specific and operational: a fundamental rights impact assessment (a formal review of how the AI might affect the rights of people whose decisions it influences), a designated human supervisor with genuine authority to override the AI's outputs, usage logs maintained for a minimum of six months, registration in the EU AI database (the centralized EU registry of high-risk AI deployments), and a functioning complaint mechanism for clients whose decisions were AI-assisted. All of it required by August 2, 2026.
General-purpose AI models — GPT-4, Gemini, Claude — have their own track under Chapter V of the regulation, which sets provider transparency and registration requirements for large-scale foundation models — AI models trained on vast datasets and deployed across many applications simultaneously. OpenAI has been required to register GPT-4 models with the EU AI Office since August 2025 under these provisions. If your finance team uses these tools for financial analysis, even informally, and the context meets a high-risk use case, Article 26 deployer obligations apply — regardless of whether the model provider has communicated this to you.
Minimal risk and no risk covers most office productivity AI: scheduling tools, writing assistants, basic automation. Minimal obligations. This is where most of the software your organization uses daily sits.
---
The Gap Your Vendor Created
An uncomfortable asymmetry sits at the center of this regulation: providers have known their classification since 2024 and have formal documentation requirements under Articles 9 through 15 — the regulation's provisions governing technical documentation, safety testing, conformity assessments (independent verification that the system meets the regulation's requirements), and accuracy testing across different user groups. They know their tier.
Deployers — the financial entities paying for the product — have no mandatory disclosure right in the base regulation. Whether you know your AI tool's risk classification depends entirely on whether your vendor chose to communicate it. Most haven't. That means many finance departments have been operating high-risk AI systems without the required oversight infrastructure, not out of negligence — nobody told them the infrastructure was required.
This gap has a practical cost. Article 26(9) is explicit: financial entities using high-risk AI must inform affected individuals that they are subject to an AI system's decision, explain the system's logic in plain terms, and provide a mechanism to contest the outcome. For any organization using AI in credit, insurance, or risk assessment processes, this obligation requires revising client-facing disclosures, updating terms and conditions, and establishing a functional AI decision review process. Entities that have not done this are not "in progress on compliance" — they are operating outside the regulation's requirements.
---
What Auditors Will Find Starting in 2027
External auditors are developing AI audit capabilities in parallel with the regulation's enforcement timeline. By 2027, audit firms will include EU AI Act compliance assessments as part of IT general controls reviews for EU-regulated financial entities.
Control failures they'll look for: no process for classifying AI tools before deployment, no documentation of intended use case boundaries, no fundamental rights impact assessment for AI systems used in client-facing financial decisions, and no designated human oversight responsible for AI system outputs. Any one of these gaps is a control deficiency. All four together constitute a material weakness in AI risk management.
Personal executive accountability becomes specific when AI intersects with financial reporting. If an AI system used in revenue recognition analysis, expense classification, or financial consolidation is a high-risk system without required Article 26 controls, any financial statement supported by that system's outputs carries a governance gap. External auditors reviewing the design and effectiveness of controls over financial reporting will eventually reach this question — and the CFO who can demonstrate AI governance documentation in 2027 is in a materially different position than the one who cannot.
Financial entities that have built compliant AI governance by then will experience routine audit inquiry: documentation requests, standard procedures, proportionate supervision. Those that haven't will face findings, management letters, and in severe cases qualification of audit opinions. The financial statement risk that flows from undocumented AI governance exceeds the compliance investment by a significant margin.
---
Four Questions Every AI Vendor Should Answer Immediately
Mature AI vendors — regardless of product quality — can answer four specific questions in writing, without delay:
1. What risk category have you assigned to your system, and can you provide the classification rationale? The answer should reference a specific article and annex of the regulation, not a generic compliance statement.
2. Can you provide your Article 11 technical documentation? This is the formal specification of the system's capabilities, limitations, and intended use cases — documentation providers of high-risk AI are required to maintain. Requesting it is your right as a deployer.
3. Are you registered in the EU AI database, and what is your registration reference? For high-risk systems, registration is mandatory. A vendor without a registration reference is either not high-risk (which should be documented) or non-compliant.
4. What are the intended use cases for your system, and what happens if a deployer uses it outside those cases? This question surfaces the boundary between your vendor's compliance and yours. Using an AI tool outside its documented intended use case shifts compliance obligations toward the deployer.
Vendors who deflect, reference "compliance in progress" without a concrete timeline, or provide generic assurances without specifics have not completed their AI Act compliance work. That is relevant information for any vendor selection or contract renewal decision in 2025 and 2026.
---
A Six-Month Roadmap
Building EU AI Act compliance from scratch takes roughly six months of focused work, with each month addressing a distinct layer of the requirement.
Month one: inventory every AI tool used in financial operations across all teams — including tools adopted informally by individual employees. Month two: request the four classification documentation items from each vendor. Month three: conduct fundamental rights impact assessments for any high-risk systems identified. Month four: implement human oversight designations and logging for high-risk systems, and revise client disclosures for any AI-assisted decision processes. Month five: register deployer status in the EU AI database for applicable systems. Month six: conduct the first compliance review, close documentation gaps, and add AI classification gates to the technology procurement process going forward.
Starting this work in 2025 leaves adequate time before August 2026. Starting it in April 2026 does not.
---
Architecture as Compliance Infrastructure
There is a meaningful difference between AI systems built with compliance infrastructure from inception and AI systems retrofitted with oversight mechanisms after deployment. Architecture determines whether compliance is structural or cosmetic.
Stralevo's source-cited, verified answers — where every response is traceable to a specific document, page, and field in your financial records — satisfy the EU AI Act's transparency and explicability requirements by design. Every answer comes with an audit trail. Human oversight is built into the workflow because every output includes the source data a reviewer needs to verify it. Logs are generated as a natural product of the architecture, not added as a compliance layer on top.
This architectural approach also satisfies the longer record-keeping period that financial services regulation requires. The EU AI Act's six-month logging floor is the minimum. MiFID II (the EU regulation governing financial instrument markets), GDPR, and national accounting law often require five to seven years. Financial AI that generates auditable, source-cited logs from day one satisfies both requirements without parallel infrastructure.
When a financial entity deploys Stralevo, the classification documentation, technical specifications, and EU AI database registration are provider-supplied and current. Article 26 deployer obligations are clearly scoped, documented, and proportionate to the actual risk level — not reconstructed from scratch against a classification gap discovered under audit pressure.
---
What Comes After August 2026
Europe's regulators have already signaled sector-specific AI governance requirements for financial services that will layer on top of the AI Act's baseline. The EBA (European Banking Authority), ESMA (European Securities and Markets Authority), and EIOPA (European Insurance and Occupational Pensions Authority) are coordinating AI oversight with EU AI Act authorities — meaning financial entities may face joint supervisory inquiries examining AI Act compliance and financial regulation compliance simultaneously.
By 2027, regulatory annual reports for banks and insurers may include AI governance disclosures: which AI systems are used in financial processes, their risk classification, and the oversight mechanisms in place. Financial entities that build this governance infrastructure now will complete those disclosures from existing documentation.
CFOs who ask the four classification questions today, build the compliance roadmap in the next quarter, and select AI vendors who answer those questions with documentation will find that the August 2026 deadline arrives as a routine milestone. The financial intelligence capability they build in the process — sovereign, auditable, source-cited — will be available for every question their board asks. And the governance record they compile will convert, year by year, into the kind of AI trust that clients, counterparties, and auditors don't have to take on faith.