The EU AI Act Applies to Models Already in Production

Three structural pressures are converging on European banks simultaneously, and the combination is what distinguishes this moment from prior years of incremental regulatory and competitive pressure. A regulatory acceleration that has produced the most demanding AI governance framework in the world, with a hard compliance deadline that is now twelve weeks away. A margin compression driven by AML compliance costs that have increased for 99% of European institutions and show no sign of stabilising. And a competitive disruption from digital-first banks and fintechs that are setting a decision speed benchmark — on credit, fraud, and payments — that most incumbents are structurally unable to match with their current architectures. Each of these forces, acting alone, would justify a fundamental redesign of how banks make decisions. Acting together, they create an urgency that is now measured in weeks, not years.

The EU AI Act is not a future risk — it applies to AI systems already in production

The EU AI Act’s high-risk AI obligations come into force on 2 August 2026. For any European bank with production AI models in credit scoring, that date is not abstract. Annex III of the Act explicitly classifies AI systems used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk systems, subject to the full compliance regime: documented risk management processes, data governance records, technical documentation, automatic logging of system behaviour, and human oversight provisions that amount to meaningful intervention capability — not perfunctory review. These obligations apply to AI systems already in production, not only to new deployments.

The compliance infrastructure required is substantial and cannot be assembled quickly. Providers must complete conformity assessments, register systems in the EU AI database, and implement quality management systems before August. Deployers must implement human oversight mechanisms, retain automated logs for a minimum of six months, and in many cases conduct Fundamental Rights Impact Assessments. Penalties for non-compliance with high-risk system obligations reach €15 million or 3% of global annual turnover, whichever is higher. For prohibited AI practices, that ceiling rises to €35 million or 7% of global annual revenue. The regulation has extraterritorial reach: any institution whose AI systems are used within the EU or produce outputs affecting EU residents falls within scope, regardless of where the institution is headquartered.

Two caveats are worth stating clearly. First, AI systems used purely for the purpose of detecting financial fraud are explicitly exempted from the creditworthiness high-risk classification under Annex III — the Act distinguishes between systems that evaluate credit and systems that detect fraud, and the two are not automatically in the same compliance bucket. Institutions with combined systems, or AML and transaction monitoring models that make decisions affecting fundamental rights, will need to assess their classification against the Act’s criteria individually. Second, the European Commission proposed in November 2025, as part of its Digital Omnibus package, to delay Annex III obligations to December 2027. That proposal has not been enacted into law. Experts across the legal and regulatory community advise treating August 2026 as the binding deadline. Planning around an extension that may not materialise is a material enterprise risk.

The practical question every European bank’s board should be able to answer today is direct: does your institution have a documented inventory of every AI system that touches credit decisions or customer-facing risk assessments? If the answer is no, that gap is the first thing to close, because compliance with every subsequent obligation — conformity assessment, technical documentation, human oversight, bias monitoring — depends on knowing which systems are in scope.

The cost of compliance is compounding — and rule-based systems are the primary driver

The regulatory urgency of the EU AI Act sits on top of an existing margin compression that has been building for years. Annual financial crime compliance spend for UK banks and fintechs alone reached £38.3 billion in 2023, according to UK Finance — equivalent to £21,400 per hour. Germany, France, and the Netherlands add tens of billions more. The false positive rate in rule-based AML alert systems at large European institutions runs at 90 to 95%, a figure consistent with the global benchmark: analysts are spending the majority of their available time investigating alerts that are not fraud.

The enforcement environment has deteriorated alongside the cost trajectory. According to Fenergo’s half-year enforcement analysis, AML-related penalties globally increased by 87% in H1 2024 compared to H1 2023, with transaction monitoring violations driving the majority of enforcement action. In H1 2025, global regulatory fines increased a further 417%, with Europe seeing a 147% increase in penalty values year on year. The direction of travel is not ambiguous. Every year a rule-based AML system operates without AI improvement is a year of growing analyst cost, false positive waste, and accumulating regulatory exposure.

The compounding dynamic is what makes the cost argument different from a one-time efficiency case. A rule-based system’s cost base does not hold steady — it grows as transaction volumes increase, as regulatory requirements add new monitoring obligations, and as enforcement actions require remediation programmes that cost multiples of the original compliance investment. AI-led alert quality improvement does not just reduce the cost of current operations. It changes the trajectory of future cost.

Digital-first competitors are setting a decision speed benchmark incumbents cannot match on current architecture

The third pressure arrives from the competitive rather than the regulatory direction, but it is increasingly shaped by regulatory requirements. PSD3 and the associated Payment Services Regulation mandate real-time transaction monitoring for fraud. Banks using batch-scoring architectures — where fraud decisions are made on a periodic rather than a per-transaction basis — will not only face competitive pressure on decision speed. They will face structural non-compliance with PSD3 liability provisions that link irrevocable payment authorisation to real-time fraud assessment.

DORA, the Digital Operational Resilience Act, entered into force in January 2025. Its requirements extend beyond business continuity planning to the operational resilience of AI inference systems specifically: recovery time and recovery point objectives that treat AI decisioning infrastructure as core banking infrastructure, not as a peripheral analytical capability. Most European institutions have not yet assessed their AI inference systems against DORA’s RTO/RPO requirements, and many will find gaps.

The combined effect of PSD3 and DORA is to make the architectural question unavoidable. Real-time payment monitoring cannot be delivered by a batch-scoring system. Operational resilience requirements cannot be met by AI infrastructure that has not been designed and tested to the same standards as core banking systems. Digital-first banks and fintechs, built on modern AI-native architectures, already meet both requirements as a consequence of how they were built. Incumbents need to close the gap deliberately, and the regulatory timeline for doing so is fixed.

The addressable value is $13.5 to $24.1 billion across European banking

Against that backdrop of cost, risk, and competitive pressure, the opportunity for institutions that act is material across five decision categories where AI-led improvement generates the most direct value.

The European total is somewhat lower than the North American figure, which reflects both market size differences and the different category mix. The EU AI Act compliance remediation line is specific to Europe and has no direct North American equivalent — it represents the cost of bringing currently non-compliant production systems into conformity with Annex III, and the three-to-five times cost premium of doing it retrospectively versus building it in from the start. The trade finance and sanctions screening category reflects a European concentration in correspondent banking, documentary credit, and complex cross-border transaction flows that make this a larger opportunity in Europe than in other regions.

As with North America, the ranges reflect genuine uncertainty in market sizing and should not be read as guaranteed outcomes. What they do not capture is the compounding dynamic: institutions that deploy better decision systems accumulate labelled outcome data that improves model quality continuously. The gap between early movers and followers grows with every quarter of outcome data that separates them.

Part 1 of 3.

Sources

UK Finance. Financial Crime Report 2024. European Central Bank. Report on Card Fraud. 2022. Fenergo. Half-Year Financial Institution Enforcement Report, H1 2024. August 2024. Fenergo. Half-Year Financial Institution Enforcement Report, H1 2025. EU Regulation 2024/1689 (EU AI Act). Annex III: High-Risk AI Systems. August 2024. European Commission. Digital Omnibus Package — proposed amendment to EU AI Act Annex III compliance deadline. November 2025. European Commission. Navigating the AI Act. digital-strategy.ec.europa.eu. European Parliament and Council. Regulation on Digital Operational Resilience for the Financial Sector (DORA). In force January 2025. European Parliament and Council. Payment Services Regulation (PSD3/PSR). In progress.