workflows
AI Agent Compliance in the EU: A Guide for Fintechs and Banks
Which EU rules apply to AI agents at banks, payment and e-money institutions: AI Act dates after the AI Omnibus, DORA, GDPR Art. 22, EBA, and AML. Plain guide.
Three sets of EU rules apply to AI agents at banks, payment institutions, e-money institutions, and fintechs today: DORA for ICT risk, the GDPR for personal data and automated decisions, and the EU AI Act's AI literacy and transparency duties. The AI Act's high-risk rules, which cover uses like credit scoring of individuals, apply from 2 December 2027 after the AI Omnibus moved the date. Your existing EBA, PSD2, and AML obligations keep applying to whatever work an agent takes over.
This is the EU companion to AI agent risk management, written for compliance, risk, and IT leaders. It covers what each rule asks, when it applies, what your supervisor will ask to see, and how Runtime produces the evidence. For other regions, see the US guide and the UK guide.
What it does. Maps the EU rules that touch AI agents to the controls you need: an inventory, approvals, scoped access, a record of every run, and a way to export it.
What it is not. It is not legal advice and does not decide which of your agents are in scope. Every material improvement comes from a human questioning a premise. Plan for that.
At a glance
| Rule | Who it applies to | What it asks of agents | Status |
|---|---|---|---|
| EU AI Act, AI literacy (Art. 4) | Providers and deployers of any AI system | Support the AI literacy of staff who run agents | Applies since 2 Feb 2025 |
| EU AI Act, transparency (Art. 50) | Providers and deployers of systems that talk to people or generate content | Tell people they are dealing with AI | Applies since 2 Aug 2026 |
| EU AI Act, high-risk (Annex III) | Deployers of AI for credit scoring of individuals, life and health insurance pricing | Risk management, logs, human oversight, accuracy | Applies from 2 Dec 2027 |
| DORA | Banks, payment and e-money institutions, most financial entities | ICT risk management, incident reporting, testing, third-party register | Applies since 17 Jan 2025 |
| GDPR Art. 22 and 35 | Anyone processing personal data in the EU | Human review of significant automated decisions; DPIA | Applies since 25 May 2018 |
| EBA guidelines | Credit institutions, payment and e-money institutions | Governance and outsourcing controls | Apply now |
| PSD2 | Payment and e-money institutions | Security, fraud, and access controls on payment data | Applies now; PSD3 and PSR agreed, not yet in force |
| AML package (AMLR) | Obliged entities, incl. banks and payment institutions | Accountable KYC and monitoring | AMLR applies from 10 Jul 2027 |
The timeline
| Date | What happened or happens |
|---|---|
| 25 May 2018 | GDPR applies |
| 7 Dec 2023 | CJEU SCHUFA ruling on credit scores and Art. 22 |
| 1 Aug 2024 | EU AI Act enters into force |
| 17 Jan 2025 | DORA applies |
| 2 Feb 2025 | AI Act prohibitions and AI literacy apply |
| 2 Aug 2025 | AI Act rules for general-purpose AI models apply |
| 18 Nov 2025 | European Supervisory Authorities designate the first critical ICT third-party providers under DORA |
| 27 Nov 2025 | Political agreement on PSD3 and the Payment Services Regulation |
| 7 Jul 2026 | ECB asks the banks it supervises for action plans on AI-enabled cyber threats, due 31 Oct 2026 |
| 27 Jul 2026 | AI Omnibus enters into force, moving high-risk dates |
| 2 Aug 2026 | AI Act transparency duties (Art. 50) apply |
| 10 Jul 2027 | Anti-Money Laundering Regulation applies |
| 2 Dec 2027 | AI Act high-risk rules apply to Annex III uses, including credit scoring |
| 2 Aug 2028 | AI Act high-risk rules apply to AI in products under EU product-safety law |
The EU AI Act
The AI Act (Regulation (EU) 2024/1689) sorts AI by use, not by technology. Most agents in a payments or fintech company are not high-risk, but some duties apply to every deployer.
The AI Omnibus. The Commission proposed the Digital Omnibus in November 2025. The AI part was adopted and entered into force on 27 July 2026. It moved Annex III high-risk rules from 2 August 2026 to 2 December 2027 and Annex I rules to 2 August 2028. It also softened the wording of the AI literacy duty. It delayed the high-risk obligations; it did not remove them.
Which financial uses are high-risk. Annex III lists AI used to assess the creditworthiness or establish the credit score of individuals (fraud detection is excluded), and AI used for risk assessment and pricing of life and health insurance. An agent that recommends declining a consumer loan is likely in scope. An agent that investigates a payout or drafts a dispute reply usually is not.
What it asks
| Article | Requirement | Applies to |
|---|---|---|
| Art. 4 | Take measures to support the AI literacy of staff who run AI | All providers and deployers, now |
| Art. 50 | Tell people when they interact with AI or see AI-generated content | Systems that talk to people or generate content, now |
| Art. 9 | A risk management system across the lifecycle | High-risk providers |
| Art. 12 | Automatic logs of events | High-risk systems |
| Art. 13 | Instructions and information so deployers can use the system properly | High-risk providers |
| Art. 14 | Effective human oversight, including the ability to stop the system | High-risk systems |
| Art. 15 | Accuracy, robustness, and cybersecurity | High-risk systems |
| Art. 26 | Deployers use the system as instructed, assign trained people to oversee it, monitor it, and keep logs at least six months | High-risk deployers |
| Art. 27 | Fundamental rights impact assessment before first use | Deployers using high-risk AI for credit scoring or life and health insurance pricing |
If you build your own agent for a high-risk use, or put your name on one, you may count as the provider and carry Articles 9 to 15 directly. Your legal team should decide this per agent.
How Runtime helps
- Record of every run covers the logs in Art. 12 and the six-month log retention in Art. 26.
- Approvals in the dashboard or Slack give you the human oversight in Art. 14. Sensitive actions wait for a named person.
- Risk scoring and guardrails feed the risk management system in Art. 9.
- Each agent's skills, tools, and access are visible to its owners, which supports Art. 13 and the people you train under Art. 4.
- Evals on every change, isolated sandboxes, and masking support accuracy, robustness, and cybersecurity under Art. 15.
DORA
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025. It covers banks, payment institutions, e-money institutions, and most other financial entities. Agents are not named, but an agent, its model, and the platform it runs on are ICT assets and, when bought in, ICT third-party services.
What it asks
- ICT risk management. A framework owned by the management body that identifies, protects, detects, responds to, and recovers from ICT risk. Agents belong in your asset inventory.
- Incident reporting. Classify ICT incidents and report major ones to your supervisor on set timelines. An agent that misbehaves in production is an ICT incident.
- ICT third-party risk. Contract terms, exit plans, and a register of information covering every ICT third-party arrangement. Your agent platform and model providers go in it. The European Supervisory Authorities designated the first critical ICT third-party providers on 18 November 2025, including major cloud providers.
- Testing. Regular resilience testing, with threat-led penetration testing for larger entities.
For banks under direct ECB supervision, the ECB wrote on 7 July 2026 asking for action plans on AI-enabled cyber threats by 31 October 2026, covering patching, monitoring and detection, and third-party risk, with DORA as the framework.
How Runtime helps
- Agent inventory with an owner, scoped API keys, and the systems each agent can reach feeds your ICT asset inventory.
- Guardrails: egress allowlists, command allow and deny lists, and approval gates limit what an agent can do if it goes wrong.
- Record of every run gives incident responders the steps, tool calls, and approvals behind an event.
- Run in your own cloud account (AWS, GCP, or Azure) in the region you choose, or self-host, which keeps exit and concentration questions in your hands.
- SOC 2 audit and audit export give you the vendor evidence your register and due diligence need.
GDPR
The GDPR (Regulation (EU) 2016/679) applies whenever an agent reads or writes personal data.
What it asks
- Art. 22, automated decisions. People have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, such as refusing credit, with narrow exceptions and safeguards including human intervention.
- The SCHUFA ruling. In Case C-634/21 (7 December 2023), the CJEU held that producing a credit score is itself an automated decision when a lender draws strongly on it. In Case C-203/22 (27 February 2025), it added that people are owed an explanation they can understand and challenge.
- Art. 35, DPIA. A data protection impact assessment before processing likely to pose a high risk, which includes systematic evaluation of people and new technologies at scale.
- Minimization and security. Only the data the task needs, protected appropriately.
How Runtime helps
- Approvals keep a named person on any decision with significant effects, so the agent prepares and a human decides.
- Masking removes card numbers, national IDs, and secrets before any prompt or log, and Runtime never trains on your data.
- Scoped identity limits each agent to the data its task needs.
- Record of every run shows which data an agent used and why, which supports explanations and your DPIA.
EBA guidelines, PSD2, and AML
What it asks
- Governance and outsourcing. The EBA's internal governance guidelines (EBA/GL/2021/05) keep firms fully responsible for outsourced activities. The outsourcing guidelines (EBA/GL/2019/02) apply to banks, payment institutions, and e-money institutions and ask whether an outsourced function is critical or important. An agent platform running a critical function falls under both, alongside DORA.
- PSD2. Directive (EU) 2015/2366 requires security, fraud monitoring, and strong customer authentication around payment data. Its successors, PSD3 and the Payment Services Regulation, reached political agreement on 27 November 2025 and are not yet in force.
- AML. The Anti-Money Laundering Regulation (EU) 2024/1624 applies from 10 July 2027, with the new EU AML Authority (AMLA) supervising alongside national authorities. Agents doing KYC, KYB, or monitoring work do not shift accountability: the obliged entity and its compliance officer still answer for every decision.
How Runtime helps
- Approvals on KYB decisions, sanctions dispositions, and money movement keep regulated judgment with qualified staff.
- RBAC and scoped identity for humans and agents limit who can call each agent and what it can touch.
- Audit export gives your partner bank or supervisor the agents, runs, approvals, and change history in one packet.
Also on the list: ISO/IEC 42001, PCI DSS, SOC 2
- ISO/IEC 42001 is the international standard for an AI management system. It is voluntary, but its controls (inventory, risk assessment, monitoring) line up with the AI Act and make a useful structure.
- PCI DSS applies when agents touch card data. Masking card numbers before any prompt or log keeps them out of the agent's reach.
- SOC 2 is what your partner bank will ask of any vendor. Runtime is SOC 2 audited.
What your supervisor or auditor will ask
| Question | Rule behind it | Where the answer lives in Runtime |
|---|---|---|
| Which AI agents do you run, and who owns each one? | DORA, AI Act Art. 26 | Agent inventory |
| Are any of them high-risk under the AI Act? | AI Act Annex III | Your legal team's classification, recorded per agent |
| What can each agent access? | DORA, GDPR | Scoped API keys, RBAC, systems listed per agent |
| Who approved this decision? | AI Act Art. 14, GDPR Art. 22 | Approvals in the run record |
| How do you protect personal and card data? | GDPR, PCI DSS | Masking before any prompt or log; isolated sandboxes; no training on your data |
| Where do the agents run? | DORA, GDPR | Isolated sandboxes, wiped at session end, in your own cloud account in the region you choose, or self-hosted |
| What happens when you change the model? | AI Act Art. 9 and 15, DORA | Evals re-check the agent; results kept with the record |
| Is the agent platform in your register of information? | DORA | Your register; Runtime provides SOC 2 and contract evidence |
| Can you show every run last quarter? | AI Act Art. 12 and 26, DORA | Filter by date and export |
A 30-day plan
| Week | What to do |
|---|---|
| Week 1 | Write your risk appetite for agents. Inventory every agent, give each an owner and scoped access, and add the platform and model providers to your DORA register. |
| Week 2 | Classify each agent with counsel: high-risk under Annex III or not, Art. 22 decisions or not, Art. 50 disclosure needed or not. Start a DPIA for agents touching personal data. |
| Week 3 | Turn on approvals for money movement, customer communications, and any decision with significant effects. Mask personal and card data. Set egress allowlists. |
| Week 4 | Build eval sets from resolved cases. Run an AI literacy session for agent owners. Export a sample evidence packet and review it as your auditor would. |
The parent guide covers the risk scoring, evals, and audit steps in detail.
The point
Most EU rules for AI agents ask for the same few things: know which agents you run, limit what they touch, keep a person on decisions that matter, keep the record, and re-check when something changes. The AI Omnibus gave high-risk uses more time, not a pass, and DORA and the GDPR already apply. Build the controls once and every supervisor's question has an answer on file.
Frequently asked questions
What rules apply to AI agents in EU financial services?
Four sets of rules do most of the work: the EU AI Act, DORA, the GDPR, and the sector rules you already follow (EBA guidelines, PSD2, and the AML framework). DORA and the GDPR apply today to almost every agent at a bank, payment institution, or e-money institution. The AI Act's AI literacy and transparency duties apply now, and its high-risk rules apply from 2 December 2027 for uses like credit scoring.
Is an AI agent high-risk under the EU AI Act?
Only if it is used for a purpose listed as high-risk. In financial services that mainly means assessing the creditworthiness or credit score of individuals, and risk assessment and pricing for life and health insurance. An agent that investigates payouts, drafts support replies, or summarizes cases is usually not high-risk, though AI literacy and transparency duties can still apply. Your legal team makes the call for each agent.
When do EU AI Act high-risk rules apply?
From 2 December 2027 for the stand-alone high-risk uses in Annex III, which include credit scoring of individuals. The AI Omnibus, in force since 27 July 2026, moved that date from 2 August 2026. High-risk AI built into products covered by EU product-safety law follows from 2 August 2028.
Did the Digital Omnibus delay the EU AI Act?
It delayed the high-risk obligations, not the whole Act. The AI Omnibus entered into force on 27 July 2026 and moved Annex III high-risk rules to 2 December 2027 and Annex I rules to 2 August 2028. Prohibitions, AI literacy, general-purpose AI rules, and the Article 50 transparency duties keep their original dates.
Does DORA apply to AI agents?
Yes. DORA has applied since 17 January 2025 to banks, payment institutions, e-money institutions, and most other EU financial entities, and it covers every ICT system they rely on. An AI agent and the model, platform, and tools behind it are ICT assets and, when bought in, ICT third-party services. That means risk management, incident reporting, testing, and an entry in your register of information.
Does GDPR Article 22 apply to AI agents?
It applies when an agent makes a decision based solely on automated processing that has legal or similarly significant effects on a person, such as refusing credit or closing an account. After the CJEU's SCHUFA ruling in December 2023, even producing a score can count if a lender relies heavily on it. Keep a person in the loop on those decisions, and run a DPIA for agents that process personal data at scale.
Do we need a fundamental rights impact assessment for AI agents?
Only in specific cases. Article 27 of the AI Act requires one from deployers of high-risk systems used for credit scoring of individuals or life and health insurance pricing, and from public bodies and private entities providing public services. Like the other high-risk duties, it applies from 2 December 2027.
How does Runtime help with EU AI agent compliance?
Runtime records every agent run, enforces approvals and scoped access, masks sensitive data, scores each run's risk, re-checks agents when they change, and exports the evidence. You can run it in your own AWS, GCP, or Azure account in the region you choose, or self-host. Runtime is SOC 2 audited; it does not certify your compliance, which stays with your team and counsel.
Get your agents ready for EU supervisors
Bring one agent or one policy. A forward-deployed AI engineer sets up the inventory, approvals, and audit export with your team.