Chapters of EU AI Act

Chapters of EU AI Act
CHAPTER I - GENERAL PROVISIONS
CHAPTER II - PROHIBITED AI PRACTICES
CHAPTER III - HIGH-RISK AI SYSTEMS
CHAPTER IV - TRANSPARENCY OBLIGATIONS FOR PROVIDERS AND DEPLOYERS OF CERTAIN AI SYSTEMS
CHAPTER V - GENERAL-PURPOSE AI MODELS
CHAPTER VI MEASURES IN SUPPORT OF INNOVATION
CHAPTER VII - GOVERNANCE
CHAPTER VIII - EU DATABASE FOR HIGH-RISK AI SYSTEMS
CHAPTER IX - POST-MARKET MONITORING, INFORMATION SHARING AND MARKET SURVEILLANCE
CHAPTER X - CODES OF CONDUCT AND GUIDELINES
CHAPTER XI - DELEGATION OF POWER AND COMMITTEE PROCEDURE
CHAPTER XII - PENALTIES
CHAPTER XIII - FINAL PROVISIONS

Articles of EU AI Act

Chapters of EU AI Act
CHAPTER I - GENERAL PROVISIONS
CHAPTER II - PROHIBITED AI PRACTICES
CHAPTER III - HIGH-RISK AI SYSTEMS
CHAPTER IV - TRANSPARENCY OBLIGATIONS FOR PROVIDERS AND DEPLOYERS OF CERTAIN AI SYSTEMS
CHAPTER V - GENERAL-PURPOSE AI MODELS
CHAPTER VI MEASURES IN SUPPORT OF INNOVATION
CHAPTER VII - GOVERNANCE
CHAPTER VIII - EU DATABASE FOR HIGH-RISK AI SYSTEMS
CHAPTER IX - POST-MARKET MONITORING, INFORMATION SHARING AND MARKET SURVEILLANCE
CHAPTER X - CODES OF CONDUCT AND GUIDELINES
CHAPTER XI - DELEGATION OF POWER AND COMMITTEE PROCEDURE
CHAPTER XII - PENALTIES
CHAPTER XIII - FINAL PROVISIONS

EU AI Act Compliance for Banks, Insurers and Financial Services

AI Governance | Risk Management | Regulatory Compliance | Audit, Consulting & Training

Artificial intelligence is changing how financial institutions assess creditworthiness, price insurance, manage investments, detect financial crime and serve customers. It also creates regulatory obligations, operational risks and new expectations for governance and control.

Leitner & Associates, a professional service of Andreas Leitner GmbH, helps banks, insurance companies, asset managers, investment firms, leasing and factoring businesses, payment institutions and other financial services firms navigate the EU AI Act, Germany’s KI-MIG and applicable financial-sector requirements.

From an initial AI inventory and regulatory gap assessment to implementation, training, audit preparation and remediation, we turn complex requirements into proportionate governance arrangements, documented processes and testable controls.

Request an EU AI Act Readiness Assessment

Explore Our Services

EU AI Act, KI-MIG and DORA: What Financial Institutions Need to Know

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689), as amended by Regulation (EU) 2026/1744, introduces a risk-based framework for AI providers, deployers and other operators. The rules that apply depend on the AI system’s intended purpose, regulatory classification and the role of your organisation.

Key considerations include prohibited AI practices, AI literacy, transparency, high-risk AI requirements, human oversight, appropriate records and ongoing monitoring. Not every AI system used by a bank or insurer is high-risk; each application requires an individual assessment.

In Germany, the AI Market Surveillance and Innovation Promotion Act (KI-MIG) designates BaFin as market surveillance authority for specified AI systems directly connected with regulated financial activities and involving financial firms within the statutory scope. This responsibility complements, rather than replaces, existing financial supervision.

Where applicable, the Digital Operational Resilience Act (DORA) requires financial entities to manage AI-related ICT risks, information security, resilience and ICT third-party dependencies. Personal-data processing must also comply with relevant GDPR requirements.

AI compliance should therefore be integrated into existing governance, risk management and internal control frameworks — not built as a disconnected parallel system.

Find Out Which AI Act Obligations Apply

Our AI Governance & Compliance Services

AI Audit & Regulatory Readiness

Identify regulatory gaps before they become supervisory or internal audit findings. We review AI applications, governance arrangements, policies, risk assessments and controls against applicable requirements.

EU AI Act and KI-MIG readiness and applicability assessments
AI governance, high-risk AI and internal control reviews
AI-related DORA and ICT third-party risk assessments
BaFin examination preparation and audit evidence reviews
Remediation assessments and effectiveness testing

Typical deliverables: Gap analysis, risk and control matrix, audit report, prioritised findings register and remediation roadmap.

AI Consulting & Implementation

Build an AI governance framework that reflects your business model, AI use cases and regulatory status. We support both initial implementation and the enhancement of existing compliance arrangements.

AI system inventories and provider/deployer role assessments
Classification of AI applications and identification of applicable obligations
AI strategies, governance policies, responsibilities and approval workflows
AI risk assessments, controls, model governance and human oversight
High-risk AI compliance and relevant fundamental rights impact assessments
Generative AI, large language model and AI assistant governance
Integration with DORA, GDPR and existing financial-sector requirements
Continuous monitoring, incident escalation and change management

Typical deliverables: AI governance framework, implementation roadmap, policies, procedures, risk assessments, control plans and management reporting.

AI Training & AI Literacy

Develop the knowledge employees and management need to use, oversee and control AI responsibly. Article 4 of the AI Act requires providers and deployers to take appropriate measures supporting AI literacy; it does not prescribe one universal course or certificate.

Formats: Open seminars, in-house training, live webinars, eLearning and executive workshops.

Topics: EU AI Act and KI-MIG; AI governance and risk management; AI literacy for staff and management; DORA and AI-related ICT risks; generative AI; high-risk AI in credit and insurance; AI applications in AML/CTF, KYC and fraud prevention; and AI audit and compliance controls.

Typical deliverables: Role-specific programmes, learning materials, competency assessments, attendance records and management evidence.

AI Interim Management & Programme Delivery

Access specialist regulatory capacity for implementation programmes, governance projects or remediation assignments. Interim roles may include AI governance programme lead, AI compliance manager, AI risk and controls lead or AI-related DORA integration manager.

Typical deliverables: Defined milestones, implemented controls, management reports, remediation tracking and documented handover. Statutory responsibilities remain with the relevant institution and its governing bodies.

AI Managed Services & Outsourcing Support

Maintain AI compliance as systems, suppliers and regulatory requirements evolve. Our External AI Governance & Compliance Office can provide ongoing regulatory monitoring, documentation updates, periodic controls, AI inventory maintenance, vendor assessments, management reporting and training administration.

Services are tailored to the institution’s regulatory status and applicable outsourcing requirements. External support does not transfer the institution’s legal accountability.

Typical deliverables: Periodic compliance reports, updated documentation, control-testing records and an auditable action tracker.

AI Compliance Products: Policies, Procedures, Checklists & Toolkits

Alongside our professional services, we provide adaptable compliance documentation for financial institutions and AI solution providers.

AI Governance & Compliance Toolkit

AI governance policy, AI system inventory, regulatory classification checklist, responsibilities matrix, acceptable-use policy and approval procedures.

AI Risk Management & DORA Toolkit

AI risk assessment methodology, risk and control matrix, AI-related ICT risk checklist, third-party due diligence templates, monitoring plan and incident escalation procedures.

High-Risk AI Compliance Toolkit

Requirements matrix, human oversight checklist, data governance assessment, fundamental rights impact assessment template where applicable, evidence register and provider/deployer responsibility checklist.

AI Audit & Remediation Toolkit

Audit work programmes, compliance testing checklists, gap assessment forms, findings register, remediation plan and effectiveness review templates.

AI Literacy & Training Toolkit

Training policy, role-specific competency matrix, learning plan, knowledge assessment, training register and participation records.

Our documentation is designed to be customised to the institution’s role, AI systems and legal obligations. Not every document or control is mandatory for every organisation.

Enquire About AI Compliance Templates

AI Act Compliance by Financial Sector

Banks & Credit Institutions

AI governance for creditworthiness assessments, lending, fraud detection, anti-money laundering, customer due diligence and generative AI, with integration into applicable banking governance and DORA requirements.

Insurance Companies

Controls for underwriting, risk assessment, pricing, claims handling and fraud prevention, with particular attention to relevant high-risk applications in life and health insurance.

Asset Managers, Fund Management Companies & Investment Firms

AI governance for investment research, portfolio management, investment advice, trading support, model risk and compliance under the applicable investment services and fund management framework.

Leasing & Factoring Companies

Risk-based assessment of AI used in credit analysis, receivables management, contract review, residual value estimation, fraud detection and process automation, reflecting the firm’s specific regulatory status.

Payment & Electronic Money Institutions

AI governance for payment monitoring, financial crime prevention, fraud detection, customer interaction and relevant ICT and third-party risks.

FinTech, RegTech & AI Solution Providers

Support for AI providers supplying regulated financial firms, including AI classification, technical documentation, relevant conformity assessment preparation, post-market monitoring and contractual allocation of responsibilities.

High-Risk AI in Lending and Insurance

Annex III of the AI Act identifies particular financial-sector use cases that may qualify as high-risk, including AI systems intended to assess the creditworthiness of natural persons or establish their credit score (subject to the financial fraud detection exception), and AI systems intended for risk assessment and pricing concerning natural persons in life and health insurance.

Depending on the classification and the organisation’s role, applicable requirements can include risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity and monitoring.

Certain deployers must also perform a fundamental rights impact assessment under Article 27 before first use of relevant high-risk systems.

We help you determine which obligations apply and establish the associated processes, evidence and controls — without assuming that every AI use case is automatically high-risk.

EU AI Act Implementation Timeline

2 February 2025: AI literacy provisions and the original prohibited AI practices became applicable.
2 August 2026: General application of the AI Act, including relevant transparency provisions, subject to exceptions and transitional rules.
2 December 2027: Relevant Chapter III requirements for Annex III high-risk AI systems apply, subject to the statutory scope and transitional provisions.
2 August 2028: Relevant Chapter III requirements for Annex I product-related high-risk AI systems apply, subject to the statutory scope and transitional provisions.

These dates reflect the amendments introduced by Regulation (EU) 2026/1744. Requirements with separate dates or transitions must be assessed individually.

The priority now is to identify systems, assign responsibilities and close gaps before the relevant obligations apply.

Our Approach: From Readiness to Remediation

1. Assess. Identify AI systems, determine operator roles and obligations, review existing governance and prioritise gaps.

2. Design. Define responsibilities, policies, risk assessment methods, approval processes, controls and implementation milestones.

3. Implement. Embed requirements into business processes, train staff, test controls and address identified deficiencies.

4. Monitor. Maintain inventories and evidence, review changes, assess control effectiveness and report outstanding actions.

The result is a proportionate, operational AI governance framework designed to support management oversight, internal audit and supervisory review.

Why Leitner & Associates?

Financial-sector regulatory expertise. We focus on governance, risk management, compliance and internal controls in regulated financial services rather than generic AI deployment alone.

Practical, audit-ready implementation. Our work emphasises accountable decisions, documented procedures, measurable controls and traceable remediation.

Integrated regulatory perspective. We consider the EU AI Act and KI-MIG alongside applicable DORA, GDPR and sector-specific requirements, reducing duplication within existing control frameworks.

Experienced personal contact. Andreas Leitner has worked in consulting, compliance, anti-money laundering, risk control and regulatory programmes, including professional roles at Deloitte, BNP Paribas and Allianz.

Leitner & Associates is a professional service of Andreas Leitner GmbH. Learn more at https://leitnerassociates.com.

Frequently Asked Questions

Does the EU AI Act apply to banks, insurers and other financial institutions?

Yes, where they provide, deploy or otherwise operate AI systems within the regulation’s scope. Obligations depend on the use case, risk classification and the organisation’s role.

Are all AI applications in financial services high-risk?

No. Certain creditworthiness and life/health insurance applications are specifically listed in Annex III. Fraud detection, AML systems, customer-service tools and internal automation are not automatically high-risk merely because they use AI.

Is AI literacy training mandatory?

Article 4 requires appropriate measures to support AI literacy among relevant personnel and others dealing with AI systems on behalf of providers or deployers. It does not prescribe a standard external course, fixed training hours or a universal certificate.

Does every financial institution need a dedicated AI Officer?

No general standalone AI Officer role is required by the EU AI Act. Institutions must nevertheless allocate suitable governance and oversight responsibilities under the legislation applicable to them.

What is BaFin’s role under the KI-MIG?

Under § 2(3) KI-MIG, BaFin is the competent market surveillance authority for specified AI systems directly connected with regulated financial activities involving designated BaFin-supervised financial institutions. Responsibility for other AI systems may lie elsewhere.

Does purchasing an AI system transfer compliance responsibility to the vendor?

No. Providers and deployers have different obligations. Financial institutions using third-party AI systems must assess their own responsibilities, including relevant transparency, oversight, monitoring and ICT third-party risk requirements.

Can existing DORA and compliance processes be used for AI governance?

Yes. Existing risk management, information security, third-party oversight and internal controls often provide a strong foundation. The key is identifying and implementing the AI-specific additions required in your circumstances.

Prepare Your Financial Institution for the EU AI Act

Do you know which AI systems your organisation uses, which legal requirements apply and where the most significant control gaps lie?

Leitner & Associates supports you from initial assessment and programme design through practical implementation, training, audit preparation and ongoing compliance monitoring.

Request an Initial Consultation

Enquire About an AI Act Readiness Assessment