Banks and insurers face layered rules for AI pilots

Banks and insurers can adopt AI in supporting workflows, but must establish accountability, classify each use and assess overlapping regulatory requirements. Under the amended AI Act timetable, transparency obligations apply from 2 August 2026, while requirements for high-risk systems under Annex III begin on 2 December 2027. Relevant high-risk uses include assessing individuals’ creditworthiness, life and health insurance risk assessment and pricing, and recruitment or employee evaluation. Building a system under an institution’s own name, or substantially changing its purpose, can create provider obligations rather than only deployer duties.

The AI Act does not replace GDPR or financial-sector rules. Meaningful human oversight matters: an employee merely approving an automated recommendation does not resolve concerns about automated decisions. Personal-data pilots may require a data protection impact assessment. Cloud-based language models also fall within DORA’s third-party ICT framework, making pre-contract risk assessment and contractual safeguards important. Supplier checks should cover training restrictions, processing locations, retention, subprocessors, model changes and usable data exports.

Suitable initial projects include document triage, internal-policy search, draft customer replies and form prefilling, with staff checking outputs before external effects. Teams should define permitted data, approved tools, ownership and measurable success criteria before starting. Pilots should not proceed when accountability is unclear, suppliers cannot document data handling, or unreliable source data prevents meaningful evaluation.