The EU AI Act and ISO/IEC 42001: what a bank has to do, and by when

In most banks, AI arrived without a project. Staff use public chat services. Microsoft 365 Copilot comes with a licence upgrade. A vendor adds a scoring model to the loan origination system in a routine release. The EU AI Act asks three questions about each of these: what the system does, who is responsible for it, and which risk class it falls into. ISO/IEC 42001 adds a fourth: how the bank runs all of this as one system, year after year.

In July 2026 the EU moved the Act's high-risk deadlines with the Digital Omnibus on AI, Regulation (EU) 2026/1744. The high-risk deadlines moved. Most of the obligations did not. This article sets out what the Act asks of a bank, how ISO/IEC 42001 turns those duties into a management system, and the order in which we would do the work.

What moved in 2026, and what did not

• Requirements for stand-alone high-risk systems listed in Annex III, which include credit scoring, now apply from 2 December 2027 instead of 2 August 2026.
• High-risk AI that is part of regulated products (Annex I) moves from 2 August 2027 to 2 August 2028.
• The AI literacy duty in Article 4 is reworded: providers and deployers must take measures to support the AI literacy of their staff and others who use AI on their behalf.
• New prohibitions on AI that generates non-consensual intimate content apply from 2 December 2026. The same date ends the grace period for marking synthetic content from systems already on the market.

The extra sixteen months for high-risk systems are time to prepare, not a reason to wait. A credit scoring model that needs new documentation, logging and human oversight takes a full budget cycle to change. The same months are enough to build an ISO/IEC 42001 management system around that work, so it is done once.

A high-risk system already in use before 2 December 2027 falls under these rules only if its design changes significantly afterwards (Article 111(2)). Whether retraining a scoring model counts is not settled, so plan as if it does.

The AI Act timeline as it stands

• 2 Feb 2025 · Prohibited practices; AI literacy. Check that no AI use falls under the bans, such as emotion recognition at work. Train the staff who use AI.
• 2 Aug 2025 · General-purpose AI models. Obligations sit with the model providers. A bank that only uses such models is a deployer. A bank that builds its own chatbot on one is the provider of that chatbot.
• 2 Aug 2026 · Transparency, Article 50. Customers must be told when they talk to an AI system. The tool's provider marks generated content; deepfakes the bank publishes must be disclosed.
• 2 Dec 2026 · New prohibitions; end of the watermarking grace period. Check generative tools in marketing and customer channels.
• 2 Dec 2027 · High-risk systems in Annex III. Credit scoring of individuals, life and health insurance pricing, AI in recruitment and staff decisions.
• 2 Aug 2028 · High-risk AI in regulated products, Annex I. Rarely relevant to a bank.

Which of your systems are high-risk

Annex III names the areas where AI is high-risk. Three of them touch a bank directly:

• Creditworthiness and credit scoring of natural persons. Fraud detection is explicitly excluded from this point.
• Risk assessment and pricing in life and health insurance, for bancassurance and insurance subsidiaries.
• Employment: CV screening, decisions on promotion or termination, task allocation and monitoring of staff.

Most other AI in a bank is not high-risk under the Act. AML transaction monitoring is not listed in Annex III. Chatbots carry the transparency duty and become high-risk as well if they make decisions in one of the Annex III areas. Copilot on internal documents is usually minimal risk under the AI Act, but it still raises data protection and outsourcing questions under GDPR and DORA.

We do not stop at the legal class. Every system is classified on four questions: who built it, who it reaches, how far it acts on its own and what is at stake. The answers set one of four tiers of controls, so a public chat service used by staff gets light rules and an in-house scoring model gets the full set. The AI Act class then adds the legal duties on top.

Provider or deployer

A bank is usually a deployer: it uses a system someone else built. It becomes a provider when it develops a high-risk system itself, puts its own name on one, or substantially modifies one. An in-house scoring model makes the bank a provider.

The two roles carry different work:

• Provider: a quality management system, a risk management system, data governance, technical documentation, logging, human oversight, accuracy and robustness, a conformity assessment, registration in the EU database and post-market monitoring.
• Deployer: use the system as instructed, assign human oversight to trained people, monitor it, keep the logs for at least six months and inform the staff affected. Customers subject to decisions by credit scoring must be told the system is used (Article 26(11)) and can ask for an explanation (Article 86). Deployers of credit scoring and insurance pricing systems also carry out a fundamental rights impact assessment (Article 27) before first use. It can build on the bank's GDPR data protection impact assessment.

For banks, the market surveillance authority for AI used in providing financial services is the financial supervisor (Article 74(6)), and some quality management requirements can be met through the internal governance rules banks already follow under EU financial services law. This is where existing model risk management pays off.

What ISO/IEC 42001 adds

The AI Act sets requirements for each AI system. ISO/IEC 42001 is a management system standard: it sets how the bank governs AI as a whole, through an AI policy, roles and objectives, risk and impact assessment, internal audit and management review, with reference controls in its Annex A.

It is voluntary and certifiable, and it does not by itself give a presumption of conformity with the AI Act. For a bank, the two still fit closely:

• The Act's duties become controls. Risk management, documentation, logging and human oversight for credit scoring sit inside the management system, with owners, evidence and review dates.
• The rest of your AI is covered too. The standard applies to every AI system in scope, including the ones the Act leaves alone, such as Copilot, internal assistants and AML models. They get controls in proportion to their risk instead of none.
• Existing systems carry over. A bank certified to ISO/IEC 27001 already has policy, document control, internal audit and corrective action. The AI management system extends them rather than starting again.

How DORA and GDPR fit in

The AI Act and ISO/IEC 42001 are not the only rulebooks that apply to the same systems:

• DORA: an AI service from a vendor, such as Copilot or a cloud model API, is an ICT third-party service. It belongs in the register of information and needs the contract terms DORA requires.
• GDPR: automated decisions about individuals (Article 22) and data protection impact assessments overlap with the AI Act's risk and impact work.
• ISO/IEC 42001: a certifiable management system standard for AI. It is voluntary and does not by itself give a presumption of conformity with the AI Act, but its controls cover much of the same ground.

One AI system register, one risk assessment and one set of evidence can serve all four. Built separately for each rulebook, the same work gets done four times.

An order of work for 2026 and 2027

1. Inventory. List every AI use, including AI features switched on in bought software. Give each an owner.
2. Classify. For each system: the bank's role, the risk class under the Act, the tier of controls it needs and the dates that apply.
3. Now, and by 2 December 2026: transparency notices on chatbots and generated content, required since 2 August 2026, and a check against the new prohibitions that apply from 2 December 2026.
4. Through 2027: for credit scoring and HR systems, the provider or deployer duties, the fundamental rights impact assessment, human oversight, logging and the vendor contracts.
5. Build the management system. Policy, roles, risk and impact assessment, internal audit and management review to ISO/IEC 42001, extending what the bank already runs for ISO/IEC 27001 and model risk management.
6. Keep a decision log. Record why each control was chosen or excluded. When a new system appears or the rules change again, only the affected part is reopened.

Where to start

Our AI Governance & Security project starts with a 16-question scoping questionnaire about the AI you use, the data it touches, the decisions it makes and the standards you need. From the answers we classify each system, select controls from one catalogue mapped to the AI Act, ISO/IEC 42001, GDPR and DORA, and agree the list of documents you will receive: new ones where nothing exists, addenda where your own policies, risk method or DPIA already cover part of the ground. The answers set the scope and a fixed price before any work begins. If you aim for ISO/IEC 42001 certification, the same work prepares the internal audit and management review a certification body will look for.

This article is a planning guide, not legal advice. Check the final text of the Regulation and your supervisor's guidance for your case.