EU AI Act raises compliance questions for U.S. broker-dealers

U.S.-based broker-dealers and financial services firms with business in the European Union face a more direct regulatory environment for AI than they do domestically. The EU Artificial Intelligence Act, enacted in March 2024, defines AI systems broadly and can apply to firms outside the EU when system outputs are used in the region.

The rules may capture several roles in the AI supply chain. Providers include companies that develop and market AI systems under their own name, while deployers include organizations using AI under their authority for professional purposes. Importers and distributors can include European subsidiaries of U.S. firms that bring parent-developed AI tools into the EU market.

Financial firms could fall within the Act if they use third-party AI for risk monitoring or fraud detection, or if employees in the EU access tools developed by a U.S. parent. Higher-risk uses, such as systems involved in assessing investor creditworthiness, may trigger stronger requirements for risk management, data governance, transparency, documentation, and human oversight.

Firms are encouraged to document AI usage, user access, business purpose, policies, training, testing, and compliance controls. Even organizations that prohibit AI use may need clear policy language, as regulators in the U.S. and abroad are expected to scrutinize how firms assess and control AI-related risks.