Regulation, European Union

The EU AI Act, for banks, insurers, health systems and public bodies

Regulation (EU) 2024/1689, the Artificial Intelligence Act, entered into force on 1 August 2024. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the high-risk dates: Annex III systems, including credit scoring and life and health insurance pricing, apply from 2 December 2027, and Annex I systems, including medical devices, from 2 August 2028.

Read in the Official Journal on 21 October 2026.

The dates, as amended

1 August 2024: The Act enters into force
2 February 2025: Chapters I and II apply: definitions, AI literacy and the prohibited practices
2 August 2025: General-purpose AI models, governance and penalties apply
27 July 2026: The Digital Omnibus on AI enters into force (Regulation (EU) 2026/1744, published 24 July 2026)
2 August 2026: The Act’s general date of application, including the transparency duties of Article 50
2 December 2026: Two prohibitions added by the Omnibus apply; generative systems placed on the market before 2 August 2026 must carry the Article 50(2) marking
2 December 2027: High-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems
2 August 2028: High-risk rules apply to Annex I systems, including medical devices under Regulations (EU) 2017/745 and 2017/746
2 August 2030: High-risk systems intended to be used by public authorities, already on the market or in service, must comply

Which uses are high-risk for institutions

Annex III, point 5, covers access to essential private and public services. Among its high-risk uses:

evaluating the creditworthiness of natural persons or establishing their credit score, with the exception of AI systems used to detect financial fraud (5(b));
risk assessment and pricing for natural persons in life and health insurance (5(c));
public authorities evaluating eligibility for essential public assistance benefits and services, including healthcare (5(a));
evaluating and classifying emergency calls, and emergency healthcare patient triage (5(d)).

What a deployer of a high-risk system must do

A deployer is anyone using an AI system under its authority in a professional activity. Article 26 sets out its duties for high-risk systems (Regulation (EU) 2024/1689):

use the system according to its instructions for use, and monitor its operation;
assign human oversight to people with the necessary competence, training and authority;
keep the logs the system generates, to the extent they are under the deployer’s control, for at least six months; financial institutions keep them within the documentation their financial services law already requires;
inform workers before using a high-risk system at work, and inform the people an Annex III system makes or assists decisions about;
if the deployer is a public authority, register its use of the system in the EU database (Article 49(3)).

Bodies governed by public law, private entities providing public services, and deployers of the credit and insurance uses in points 5(b) and 5(c) must carry out a fundamental rights impact assessment before first use (Article 27). Since the Omnibus, it may cross-refer to the data protection impact assessment.

An inventory, in the Act’s terms

The Act does not use the word inventory, and uses register only for registering in the Commission’s EU database. Its duties attach to each high-risk system: logs, oversight, the impact assessment and, for public authorities, registration. A list of the institution’s AI systems is the practical way to know which duties apply to which system.

Penalties

Article 99 sets ceilings that Member States apply: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for most operator duties, including the deployer duties of Article 26; up to EUR 7.5 million or 1% for incorrect or misleading information, whichever is higher. For SMEs, the lower of the two applies. Each Member State decides whether, and how far, public authorities can be fined.

How GovernanceOS™ helps

Check a register, free, in your browser: goslint’s EU packs carry the registration information of Annex VIII, Sections A, B (as amended) and C, the ECB’s register of internal models and ESMA’s records on AI in retail investment services.
Download a register template with the columns each of those packs checks.
Each gate on a GovernanceOS record names one person and hashes the evidence at that moment, so who exercised oversight, and on what evidence, is on the record, by design. How it works
The EU rows, each dated and sourced, among the regulation rows.

Conformance with any framework is self-declared.

Questions

Questions about the EU AI Act.

When do the EU AI Act’s high-risk rules apply?

After the Digital Omnibus on AI, Regulation (EU) 2026/1744: from 2 December 2027 for Annex III systems, including credit scoring and life and health insurance pricing, and from 2 August 2028 for Annex I systems, including medical devices. High-risk systems intended for public authorities that are already in use must comply by 2 August 2030.

Does the EU AI Act require an AI inventory?

Not by that name. The Act never uses the word inventory, and uses register only for registering in the Commission’s EU database. Its duties attach to each high-risk system: logs, human oversight, the fundamental rights impact assessment and, for public authorities, registration of use. A list of AI systems is how an institution knows which duties apply where.

What must a deployer of a high-risk AI system keep?

The logs the system generates, where they are under the deployer’s control, for at least six months; financial institutions keep them within the documentation their financial services law already requires. Deployers must also assign human oversight to people with the competence and authority for it, and, where Article 27 applies, carry out a fundamental rights impact assessment.

Who must carry out a fundamental rights impact assessment?

Under Article 27: deployers that are bodies governed by public law or private entities providing public services, and deployers of the credit scoring and life and health insurance uses in Annex III, points 5(b) and 5(c). It is done before the first use of the system, and since the Omnibus it may cross-refer to the data protection impact assessment.

What are the penalties under the EU AI Act?

Article 99 sets ceilings for Member States to apply: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most operator duties, and up to EUR 7.5 million or 1% for incorrect information, whichever is higher. SMEs face the lower of the two.