Recent developments on the interplay between AI and financial institutions

Recent developments signal a coordinated approach to AI regulation in the financial sector. On 21 November 2025, the European Banking Authority (“EBA”) published a factsheet on the AI Act and its implications for the EU banking and payments sector. On 25 November 2025, the European Parliament adopted a resolution laying out their priorities regarding the use of artificial intelligence in the financial sector. Both documents emphasise proportionate implementation without unnecessary regulatory burden. In this blog, some key aspects are set out.

Key findings from the AI Act mapping exercise by the EBA 

In its factsheet, the EBA comes to the following conclusions:

• No significant contradictions have been found between the AI Act and the EU banking and payments regulations;
• The AI Act is complementary to the EU banking and payments sector legislation, which already provides a comprehensive framework to manage risks. Some efforts may be required by banks and other financial institutions to integrate the two frameworks effectively; and
• The co-existence of multiple authorities (prudential/conduct authorities and Market Surveillance Authorities (“MSAs”) the national authority carrying out activities under the AI ACT[1]) supervising financial entities’ compliance highlights the importance of supervisory cooperation to ensure the effective implementation of the AI Act. 

The EBA does not see any immediate need to introduce any new guidelines or to review existing guidelines. In 2026-2027, the EBA will undertake specific activities to support the implementation of the AI Act in the EU banking and payments sector, by:

• Promoting a common supervisory approach and supervisory cooperation among national competent authorities in charge of financial sector supervision and market surveillance authorities; and
• Providing input to the European AI Office (the centre of AI expertise across the EU), as appropriate, and participating in discussions of the AI Board Subgroup on Financial Services (a key advisory board that was created by the AI Act).

For banks and payment institutions, the practical implications centre on high-risk AI systems. Under the AI Act, based on the significance of each AI system's risk to fundamental rights, some systems are classified as high-risk. In the banking and payment sector, the use of AI systems to evaluate the creditworthiness or to establish the credit score of natural persons is classified as high-risk and the AI Act introduces additional safeguards for such AI systems. 

A key distinction for financial institutions is whether they develop their own AI systems or purchase them from external providers. In-house development means the financial institution is both the provider and deployer under the AI Act, whilst using third-party AI solutions means the institution is only a deployer—each role carrying different regulatory obligations.

Where derogations apply, EU sectoral obligations replace the AI Act requirements entirely. Most AI Act obligations, however, must be integrated with existing frameworks. Financial institutions complying with regulations on outsourcing, DORA and risk management have a solid foundation, but will need to adapt these frameworks to meet AI-specific requirements. Existing financial regulations alone are not always sufficient.

Parliament Resolution on AI use on the financial sector

On 25 November, the European Parliament adopted a resolution laying out its priorities regarding the use of artificial intelligence in the financial sector. Rapporteur Kokalari (European People’s Party Group) stated, for instance, “There is significant potential in the responsible use of AI in the financial sector, which can deliver safer and more efficient products for consumers. Policymakers must now ensure the right conditions for AI deployment, without adding administrative burdens.’’ Hence, the resolution asks the Commission and supervisors to issue clearer, proportionate guidance rather than producing new rules. It also urges supervisory authorities to cooperate better, including through consistent interpretations, information sharing and cross-border coordination. This is in line with the factsheet of the EBA.

Conclusion 

These developments demonstrate  the increasing regulatory focus on AI use by banks and payment institutions, whilst at the same time promoting  a pragmatic approach to implementation. The alignment between the Parliament's call for proportionate guidance and the EBA's findings that existing frameworks are harmonious suggests that regulators recognise the need to avoid duplicative requirements.

For financial institutions, this means that whilst AI compliance obligations are growing, the AI Act has been structured to build upon existing frameworks as much as possible, rather than imposing entirely new and duplicative requirements. The forthcoming Digital Omnibus on AI Regulation and further Commission guidance will be critical in clarifying the interplay between the AI Act and sectoral legislation, ensuring consistent supervisory approaches across Member States. In the meantime, financial institutions must therefore comply with both the AI Act and existing financial regulations monitoring regulatory developments as further guidance emerges.

[1] Article 3(26) Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)