EU AI Act delay: what changes for credit scoring and insurance pricing

Global reference

• Region: European Union, with reach to non-EU firms whose AI is used in the EU
• Law: AI Act (Regulation (EU) 2024/1689), amended by Regulation (EU) 2026/1744
• Topic: High-risk AI in financial services
• Key date: Annex III high-risk obligations from 2 December 2027

What changed

• The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force three days later.
• Stand-alone high-risk systems in Annex III now apply from 2 December 2027, instead of 2 August 2026.
• High-risk AI built into regulated products under Annex I applies from 2 August 2028.
• Generative AI systems on the market before 2 August 2026 have until 2 December 2026 to meet the content-marking rule.
• A new Article 4a allows strictly necessary use of sensitive personal data to detect and correct bias.
• Some benefits for small and medium-sized enterprises now extend to small mid-caps.

Financial services uses that are high-risk

• AI used to assess the creditworthiness of individuals or set their credit score. AI used only to detect financial fraud is excluded.
• AI used for risk assessment and pricing in life and health insurance for individuals.
• AI used in recruitment and staff management, which applies to every firm.

What already applies

• Prohibited practices, since 2 February 2025.
• The AI literacy duty, since 2 February 2025, now softened to supporting staff literacy.
• General-purpose AI model rules, since 2 August 2025.
• Transparency duties under Article 50, such as telling people they are talking to a chatbot, from 2 August 2026.

What to do now

• List AI systems used for lending, credit scoring and insurance pricing, including vendor tools.
• Decide whether you are the provider or the deployer of each one: the obligations differ.
• Use the extra 16 months to build risk management, data governance, logging and human oversight, not to pause.
• Non-EU groups, including Gulf groups, should check whether their AI output is used in the EU.

Our take

The delay gives time, not an exemption. Banks and insurers that start now can build compliance into their model risk process instead of rushing in late 2027.