AI systems used in creditworthiness assessment, insurance risk pricing, and financial decision-making affecting natural persons are high-risk under Annex III, points 5(b) and 6. Mandatory obligations apply from August 2026.
Article 99 penalty for high-risk financial AI non-compliance
Financial AI that does not meet Articles 9–17 obligations by the deadline carries a penalty of up to €15,000,000 or 3% of global annual turnover, whichever is higher. This is separate from — and in addition to — existing DORA and GDPR penalties. The deadline is 2 August 2026.
Not sure if your credit scoring or fraud detection model is high-risk?
Describe what your system does and Regumatrix checks it against Annex III, Article 6, and the full regulation — in about 30 seconds. Your first 3 analyses are free.
Check my financial AI system — 3 free analyses includedFinancial entities are already subject to DORA (Digital Operational Resilience Act) and GDPR Article 22 on automated decision-making. The EU AI Act adds a third compliance layer: the AI system itself must pass high-risk conformity requirements regardless of existing DORA or GDPR controls. These frameworks are complementary, not substitutable.
The boundary between high-risk and limited-risk in financial AI turns on whether a system directly affects access to financial products for individuals. Many firms underclassify their tools. Check if any of these scenarios apply:
Financial services AI sits at the intersection of three major regulatory frameworks: the EU AI Act, DORA, and GDPR Article 22. Compliance with one does not satisfy the others. Get a clear picture of your AI Act exposure specifically.
Describe your AI system in plain language. Regumatrix checks it against every article of the EU AI Act and returns your risk tier, Annex classification, the exact obligations that apply, and your fine exposure under Article 99. Eight sections. About 30 seconds.
8-section report · Article citations · ~30 seconds · No credit card
