# EU AI Act Source: https://ordergroup.co/glossary/eu-ai-act/ Last updated: 2026-10-20 > The EU AI Act (Regulation 2024/1689) after the Digital Omnibus: timeline, high-risk credit scoring, provider and deployer duties, penalties and the Polish supervisor. [Fintech](https://ordergroup.co/glossary/fintech/)[AI](https://ordergroup.co/glossary/ai/) 8 min read # EU AI Act Artificial Intelligence Act, Regulation (EU) 2024/1689 Also known as: AI Act, Artificial Intelligence Act, Regulation (EU) 2024/1689 Definition The EU AI Act, Regulation (EU) 2024/1689, is the EU law that sorts AI systems by risk. It bans some practices, sets requirements for high-risk systems such as credit scoring of individuals, adds transparency duties and regulates general-purpose AI models. Cite this entry Text "EU AI Act". Order Group, Software glossary, 20 October 2026. https://ordergroup.co/glossary/eu-ai-act/ HTML `EU AI Act - Order Group` Reviewed by [Łukasz Gajownik](https://ordergroup.co/experts/lukasz-gajownik/), Head of AI & Frontend Last reviewed 20 October 2026 ## How the EU AI Act works The AI Act regulates AI systems according to what they are used for. An AI system is a machine-based system that infers from its input how to generate outputs such as predictions, content, recommendations or decisions (Article 3(1)). The same model can be minimal risk in one product and high-risk in another. Duties follow roles. A provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority in a professional activity (Article 3(3) and 3(4)). A company that builds its own scoring model and uses it is both. A deployer can also become a provider. Article 25(1) names three cases: you put your name on a high-risk system, you make a substantial modification to one, or you change the purpose of another system so that it becomes high-risk. That last case covers general-purpose systems too. The original provider then has to hand over the documentation and technical access the new provider needs, unless it said that its system must not be turned into a high-risk one (Article 25(2)). General-purpose AI models, such as the large language models behind chat assistants, have their own chapter. Their providers keep technical documentation, give information to the companies that build on the model, have a copyright policy and publish a summary of the training content (Article 53). Models with systemic risk carry extra duties (Article 55). Risk categories in the EU AI Act | Category | What it covers | What the Act requires | |---|---|---| | Prohibited (Article 5) | Social scoring, manipulation or exploitation of vulnerabilities that causes significant harm, emotion recognition at work and in education, untargeted scraping of facial images, among others. From December 2, 2026 also AI that generates non-consensual intimate images or child sexual abuse material | Banned in the EU | | High-risk (Article 6, Annexes I and III) | Safety components of regulated products, and the uses listed in Annex III, among them employment, education, access to essential services, credit scoring of natural persons, and life and health insurance pricing | Risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, conformity assessment, registration | | Transparency (Article 50) | Chatbots, systems that generate audio, images, video or text, emotion recognition, deepfakes | Disclosure that people are dealing with AI, machine-readable marking of generated content, labels on deepfakes | | Minimal risk | Everything else, for example spam filters or AI in video games | No new obligations; voluntary codes of conduct | ## When the EU AI Act applies: timeline after the Digital Omnibus The Act entered into force on August 1, 2024 and applies in stages (Article 113). The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026 and moved the high-risk dates. Many texts written before then still give August 2, 2026 for high-risk systems, which was the original date. EU AI Act application dates after the Digital Omnibus on AI | Date | What applies | |---|---| | August 1, 2024 | Entry into force | | February 2, 2025 | Prohibited practices and AI literacy (Article 4) | | August 2, 2025 | Obligations of providers of general-purpose AI models, governance and penalties | | August 2, 2026 | Most of the remaining rules, including the transparency duties of Article 50 and the Commission's fines for providers of general-purpose AI models | | December 2, 2026 | New prohibitions on generated intimate images and child sexual abuse material; machine-readable marking for generative systems placed on the market before August 2, 2026 | | August 2, 2027 | Deadline for general-purpose AI models placed on the market before August 2, 2025 | | December 2, 2027 | High-risk systems listed in Annex III, credit scoring included (originally August 2, 2026) | | August 2, 2028 | High-risk systems in products covered by Annex I (originally August 2, 2027) | ## What the EU AI Act means for your system For a lender the line that matters is point 5(b) of Annex III. AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are high-risk. Systems used to detect financial fraud are excluded. Point 5(c) adds risk assessment and pricing in life and health insurance. Under Article 6(3) an Annex III system is not high-risk if it poses no significant risk and, for example, only performs a narrow procedural task, improves the result of a completed human activity or performs a preparatory task for an assessment. A system that profiles natural persons is always high-risk. The provider of a high-risk system carries most of the work. It needs a risk management system, governance of training, validation and test data, technical documentation, automatic event logs, instructions for use and human oversight (Articles 9 to 14). The system must also be accurate, resilient to errors and attacks, and secure (Article 15). Then come a conformity assessment (Article 43) and registration in the EU database (Article 49). A lender that uses a scoring tool built by someone else is a deployer and must (Article 26): - use the system according to the provider's instructions and assign human oversight to people with the competence, training and authority for it, - make sure that input data under its control is relevant and sufficiently representative, - monitor the system and report risks and serious incidents, - keep the logs under its control for at least six months; financial institutions keep them as part of the documentation that financial services law requires, - tell applicants that a high-risk AI system is used in decisions about them. Deployers of credit scoring systems also carry out a fundamental rights impact assessment before first use (Article 27). Where the GDPR data protection impact assessment already covers a point, the deployer can cross-reference it or reuse its parts (Article 27(4), as amended by the Omnibus). A person affected by a decision based on the system's output has the right to a clear explanation of the role the system played (Article 86). For consumer credit, [CCD2](https://ordergroup.co/glossary/ccd2/) adds a right to human intervention after an automated creditworthiness assessment. Both sets of rules end up in the same places in the product: a way for the applicant to ask for human intervention, a queue for the people who review, and a record of how each decision was made. If you build on someone else's general-purpose model, the model duties stay with the model provider. Your duties depend on the use. A chatbot must make clear to people that they are talking to an AI (Article 50(1)). A system that generates audio, images, video or text must mark its output in a machine-readable way (Article 50(2)). A deployer that publishes deepfakes must label them (Article 50(4)). If you point the same model at an Annex III use such as credit scoring, you become the provider of a high-risk system (Article 25(1)(c)). Since February 2, 2025 providers and deployers have had to take measures for the AI literacy of their staff (Article 4). The Omnibus rewrote this as a duty to support AI literacy, without a duty to ensure any particular level of it. Writing the specification? Add EU AI Act to your requirements checklist Collect the terms your project touches and get their system requirements in one e-mail, ready for an RFP. Provider or deployer? A quick check under Articles 3 and 25 | Step | Question | If yes | If no | |---|---|---|---| | 1 | Did you develop the AI system, or have it developed, and do you place it on the market or put it into service under your own name? | You are its provider (Article 3(3)) | Go to step 2 | | 2 | Do you use the system under your authority in a professional activity? | You are a deployer (Article 3(4)). Go to step 3 | Check the importer and distributor duties (Articles 23 and 24); the provider and deployer duties do not apply to you | | 3 | Have you put your name or trademark on a high-risk system that is already on the market? | You become its provider (Article 25(1)(a)) | Go to step 4 | | 4 | Have you made a substantial modification to a high-risk system, and it is still high-risk? | You become its provider (Article 25(1)(b)) | Go to step 5 | | 5 | Have you used a system that was not high-risk, a general-purpose model included, for an Annex III purpose such as credit scoring? | You become the provider of a high-risk system (Article 25(1)(c)) | You stay a deployer | ## What to do now - List every AI feature and model in your products and internal tools, with its purpose and the model behind it. - Classify each one as prohibited, an Annex III use, a transparency case or minimal risk, and write down why. If you rely on Article 6(3), document the assessment before the system is placed on the market or put into service, and register the system in the EU database (Articles 6(4) and 49(2)). The Omnibus kept this registration and shortened the information it requires (Annex VIII, Section B). - Decide your role for each system (provider, deployer or both) and check your contracts with model and tool vendors against it. - For a high-risk use, design logging, human review and explanations into the product now. They are hard to add later. - Test every model or prompt change on a fixed evaluation set with agreed acceptance criteria ([LLM evaluation](https://ordergroup.co/glossary/llm-evaluation/)) and keep the results. - Map what personal data reaches the model, where the model runs (a [self-hosted LLM](https://ordergroup.co/glossary/self-hosted-llm/) or an external API) and what is anonymized before reuse ([data anonymization](https://ordergroup.co/glossary/data-anonymization/)). ## Penalties and related rules Article 99 sets maximum fines. Prohibited practices can cost up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Breaching most other obligations, including those of providers and deployers of high-risk systems and the transparency duties of Article 50, can cost up to EUR 15 million or 3%. Giving incorrect or misleading information to authorities can cost up to EUR 7.5 million or 1%. For SMEs, startups included, the lower of the two amounts applies (Article 99(6)). The Digital Omnibus extends that rule to small mid-cap enterprises (SMCs) for the two lower tiers, but not for prohibited practices (Article 99(6a)). The Commission can fine providers of general-purpose AI models up to EUR 15 million or 3% (Article 101). National market surveillance authorities enforce the rules for AI systems, and the AI Office in the Commission supervises general-purpose models. Other law still applies alongside the AI Act. Personal data in training sets and prompts stays under the GDPR, consumer credit decisions under CCD2, and identity checks under anti-money laundering rules ([KYC](https://ordergroup.co/glossary/kyc/)). Harmonized standards, prepared by the European standardization bodies CEN and CENELEC, will give providers that follow them a presumption of conformity with the high-risk requirements (Article 40). ## The AI Act in Poland: the national supervisor and the KNF Poland supervises the AI Act under the Act on Artificial Intelligence Systems of July 3, 2026 (Journal of Laws 2026, item 1003), in force since August 11, 2026. It sets up the Commission for the Development and Safety of Artificial Intelligence (KRiBSI), the market surveillance authority for AI systems and the single point of contact for EU institutions. The KNF, the Polish financial supervisor, nominates one member of KRiBSI, and the two bodies work together on the matters covered by Article 74(6) of the AI Act, which concern high-risk AI systems used by financial institutions (Articles 5, 19 and 20 of the Polish act). From October 28, 2026 KRiBSI can run inspections, conduct proceedings and impose fines (Chapters 3, 4 and 8 of the Polish act). From the same date a company can ask KRiBSI for an individual opinion on how the AI Act applies to its case (Articles 8 to 18 of the Polish act). ## From our projects We [build software around language models](https://ordergroup.co/ai-software-development/) and add AI features to existing products, usually as a separate service the application calls. On the [energy procurement](https://ordergroup.co/glossary/energy-procurement/) advisory platform we built for [Enerace](https://ordergroup.co/case-studies/enerace-energy-trading-software/), AI writes market news from current market data. For a product platform in the home renovation market we run an in-app AI chat and a product-search agent. For PSONI we are building Generator ETR, a web and mobile app that uses a self-hosted language model to turn documents such as official letters into [easy-to-read](https://ordergroup.co/glossary/easy-to-read/) text. In features like these, Article 50 decides what the user sees: a notice that they are talking to an AI and marking of generated content. In lending we [build the customer side](https://ordergroup.co/fintech-software-development/) for lenders supervised by the KNF: the loan app, KYC and the integrations with the lender's core system. The app is where the applicant sees the credit decision. If the lender's scoring falls under Annex III, the app is also where the applicant learns that a high-risk AI system was used and asks for human intervention and an explanation (Articles 26(11) and 86 of the AI Act, Article 18 of CCD2). Credit decisions, scoring and pricing stay in the lender's core system. The client's lawyer confirms the legal classification of each system. ## Related terms - [CCD2](https://ordergroup.co/glossary/ccd2/) Consumer Credit Directive 2 CCD2 is the common name of Directive (EU) 2023/2225 on credit agreements for consumers, which replaces Directive 2008/48/EC. Member States must apply the national rules implementing it from November 20, 2026. - [Data anonymization](https://ordergroup.co/glossary/data-anonymization/) Data anonymization is processing personal data so that no one can identify the person by any means reasonably likely to be used. Anonymous data falls outside the GDPR; pseudonymized data, which can be re-linked with separately kept information, remains personal data under the GDPR. - [KYC](https://ordergroup.co/glossary/kyc/) Know your customer Know your customer (KYC) is the process in which a financial company identifies a customer and verifies their identity, usually at onboarding, as part of its anti-money laundering duties. eKYC is the remote, digital form of that process. - [LLM evaluation](https://ordergroup.co/glossary/llm-evaluation/) LLM evaluation is the systematic testing of a language model's outputs on a fixed set of inputs against agreed acceptance criteria, using automatic checks, model-based grading and human review. It decides whether a model, prompt or version is good enough to ship. - [Self-hosted LLM](https://ordergroup.co/glossary/self-hosted-llm/) A self-hosted LLM is a large language model whose weights run on infrastructure you control, your own servers or rented GPUs. Prompts and outputs never reach a model vendor. ## Read more on the blog - Article [CCD2 for Lending Apps: What Changes in Your Loan Application Flow on 20 November 2026](https://ordergroup.co/blog/ccd2-lending-app-loan-application-flow/) ## Sources 1. [Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) - EUR-Lex 2. [Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744) - EUR-Lex 3. [Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz. U. 2026 poz. 1003)](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20260001003) - ISAP, Kancelaria Sejmu 4. [AI Act](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) - European Commission 5. [AI Omnibus enters into force](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force) - European Commission 6. [Artificial intelligence: Council and Parliament agree to simplify and streamline rules (May 7, 2026)](https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/) - Council of the European Union Łukasz Gajownik reviewed this entry. Ask how it applies to your project. [Ask an engineer](https://ordergroup.co/contact-us/) ## FAQ ![Łukasz Gajownik](https://ordergroup.co/media/images/T02DHCC1Z-UT420UBA7-d74022d27c3c-512.format-webp.webp) Łukasz Gajownik Head of AI & Frontend [Talk to an engineer](https://ordergroup.co/contact-us/) ### Does the EU AI Act apply to companies outside the EU? Yes, when they place AI systems or general-purpose models on the EU market or put them into service in the EU, and when the output of their AI system is used in the EU (Article 2(1)). ### Is credit scoring high-risk under the EU AI Act? Yes. An AI system used to evaluate the creditworthiness of natural persons or to establish their credit score is high-risk under point 5(b) of Annex III; systems that detect financial fraud are excluded. The high-risk rules for it apply from December 2, 2027. ### Does using an LLM API in our product make us subject to the AI Act? Yes, but usually not for the model itself, whose duties sit with the model provider. You have the transparency duties for chatbots and generated content, and you take on the high-risk duties if you use the model for an Annex III purpose such as credit scoring. ### When do the high-risk rules apply? For uses listed in Annex III from December 2, 2027, and for AI in products covered by Annex I from August 2, 2028. These dates come from the Digital Omnibus on AI, in force since July 27, 2026; the original dates were August 2, 2026 and August 2, 2027. ### Who supervises the AI Act in Poland? The Commission for the Development and Safety of Artificial Intelligence (KRiBSI) supervises the AI Act in Poland. It was set up by the Act on Artificial Intelligence Systems of July 3, 2026 as the market surveillance authority for AI systems. The KNF nominates one member of KRiBSI and works with it on high-risk AI systems used by financial institutions. KRiBSI can inspect and fine from October 28, 2026. ## Building a system with EU AI Act in scope? See how we build software for this domain, with case studies and the stack we use. [See Fintech Software Development Services](https://ordergroup.co/fintech-software-development/) Requirements checklist For each term we send the definition and what it requires from your software. Free, no sales call needed. Your checklist is empty. Use the plus next to a term to add it.