When do the EU AI Act obligations apply?
The EU AI Act enters into application in several phases, from February 2025 to August 2028. For Austrian banks and insurers, this creates different implementation priorities.
| Date | What applies | Relevance for financial institutions |
|---|---|---|
| 2 February 2025 | Prohibition of certain AI practices; duty to take AI literacy measures (Art. 4) | Prohibited practices must be avoided. Providers and deployers must take measures that support the AI literacy of those involved; since the Digital Omnibus, no specific level of literacy is required. |
| 2 August 2025 | GPAI duties and governance structures at EU/member-state level | Use of external language models and AI models requires a clear internal control and supplier understanding. |
| 2 August 2026 | In force: transparency duties under Art. 50, right to lodge a complaint under Art. 85, right to explanation under Art. 86, fines for GPAI models | Providers must design AI systems so that people know they are interacting directly with an AI system (Art. 50(1)) and must mark AI-generated content in machine-readable form (Art. 50(2)). Deployers must inform people about emotion recognition and biometric categorisation (Art. 50(3)) and must label deepfakes and AI-generated text published on matters of public interest (Art. 50(4)); for such text the duty does not apply where there is substantive human review and editorial responsibility. A financial institution can hold both roles. The right to explanation under Art. 86 covers decisions based on Annex III high-risk systems with legal or similarly significant effects. The Commission's final guidelines on Art. 50 (20 July 2026) and the voluntary Code of Practice on Transparency of AI-generated Content (finalised on 10 June 2026) give these duties practical shape; the optional EU labelling icons do not replace the assessment of the legal duty itself. |
| 2 December 2026 | Ban on sexualised deepfakes without consent; transition period for legacy systems producing synthetic content | Systems generating synthetic content placed on the market before 2 August 2026 must meet Art. 50(2) by this date. |
| 2 December 2027 | Requirements for high-risk AI systems under Annex III (postponed by Regulation (EU) 2026/1744) | Credit, insurance and HR: inventory, classification and governance should be set up now despite the postponement, because conformity evidence needs lead time. |
| 2 August 2028 | Requirements for high-risk AI systems under Annex I (safety components in regulated products) | Usually less directly relevant for classic financial service providers, but relevant for embedded product or safety components. |
Austria has not yet formally designated its market surveillance authorities or the notifying authority under the AI Act, and no national implementing act was in place as of 20 October 2026; the FMA describes the implementing legislation as still outstanding. The RTR AI Service Desk acts as an information hub, not as a supervisory authority. For high-risk AI used by supervised financial institutions, Art. 74(6) AI Act in principle assigns market surveillance to the financial supervisor – in Austria the FMA – but the final allocation will only follow from national implementation.
Which AI systems count as high-risk in the financial sector?
Only the areas of use listed specifically in Annex III of the EU AI Act; not every AI system falls under the strict high-risk requirements. For financial institutions, creditworthiness assessment of natural persons, life and health insurance underwriting, and HR recruiting and performance evaluation are particularly relevant.
- Annex III No. 5(b): AI systems for evaluating the creditworthiness of natural persons or establishing a credit score.
- Annex III No. 5(c): AI systems for risk assessment and pricing in life and health insurance.
- Annex III No. 4: AI systems for recruiting, selection, task allocation, performance monitoring and work-related decisions.
On 19 May 2026 the European Commission published draft guidelines on the classification of high-risk AI systems under Art. 6; the consultation was extended until 23 July 2026; the Commission plans to adopt the final version by the end of 2026, and on its dedicated page the text was still listed as a draft on 20 October 2026. The draft covers, among other things, documenting exemptions under Art. 6(3) and the creditworthiness and employment use cases – a useful benchmark for an institution's own classification, but not yet binding.
On 21 November 2025 the EBA mapped the AI Act requirements for creditworthiness assessment and scoring against existing banking and payments law (CRD, CRR, DORA, consumer credit rules) and found no significant contradictions; the deadlines cited there predate the Digital Omnibus. On 6 August 2025 EIOPA issued an opinion setting out risk-based, proportionate expectations for AI governance and risk management under insurance supervisory law. On 31 July 2026 the EBA, EIOPA and ESMA jointly addressed ICT risks from frontier AI models, stressing governance, third-party management and DORA oversight. All three documents are supervisory guidance, not new directly applicable legal acts.
What must deployers of high-risk AI do, and when is a FRIA required?
Deployers of high-risk AI systems must implement technical and organisational measures, assign human oversight, control input data, retain logs, inform affected persons and cooperate with authorities. For creditworthiness assessment and life and health insurance risk assessment, a Fundamental Rights Impact Assessment (FRIA) is additionally required before use. HR AI mainly triggers information duties towards employee representatives and affected employees; a FRIA obligation may still need to be checked in special constellations.
CSRD / ESRS: When does AI bias become a reporting topic?
Where AI-supported decisions create discrimination risks, human-rights impacts or governance risks, CSRD and ESRS can become relevant in addition to the EU AI Act, which regulates AI systems directly. HR AI, creditworthiness assessment and life/health underwriting are particularly affected. In those cases, documenting technical conformity alone is not enough; institutions also need traceable information on policies, due diligence, measures, risks, metrics and auditability. This presupposes that the institution is subject to reporting at all: Directive (EU) 2026/470 has limited the CSRD scope to EU companies with more than 1,000 employees and more than EUR 450 million net turnover; national transposition, transition years and group-level assessment must also be checked. The impact or risk must also be material – not every bias incident leads to an ESRS disclosure.
What sanctions does the EU AI Act provide for?
The EU AI Act provides for tiered sanctions: breaches of prohibitions can lead to fines of up to EUR 35 million or 7 percent of global annual turnover, breaches of many deployer and high-risk requirements up to EUR 15 million or 3 percent, and incorrect information up to EUR 7.5 million or 1 percent. Company-law, banking, insurance and data-protection consequences may also apply.
Fourfold reporting cascade: Which reports can one AI incident trigger?
A serious AI incident in an Austrian financial institution can trigger several independent reporting obligations. The triggers and timelines must be assessed separately.
| Legal basis | What is reported? | Timeline | Recipient |
|---|---|---|---|
| EU AI Act Art. 73 | Serious incident involving high-risk AI. The reporting duty rests with the provider; deployers have the information and cooperation duties under Art. 26, in particular informing the provider and the authority. | no later than 15 days; 10 days in case of death; 2 days for certain particularly severe constellations | competent market surveillance authority after national implementation |
| GDPR Art. 33 | Personal data breach with risk to data subjects | 72 hours | Austrian Data Protection Authority |
| DORA / Delegated Regulation (EU) 2025/301 | Major ICT-related incident | initial notification as soon as possible, no later than 4 hours from classification as major and 24 hours from detection (where classification occurs only after more than 24 hours: 4 hours from classification); intermediate report within 72 hours from submission of the initial notification; final report within one month from submission of the latest intermediate report | FMA |
| NISG 2026 | Significant cybersecurity incident, where the institution is in scope and no special regime applies | early warning, notification and final report under the NISG 2026 system | cybersecurity authority or competent CSIRT reporting route |
For reporting under Art. 73, the European Commission put draft guidance and a reporting template out for consultation on 26 September 2025; on the linked Commission page it was still listed as a draft on 20 October 2026. For GPAI models with systemic risk, a separate reporting template under Art. 55 has been available since 4 November 2025. Both already serve as a useful structure for internal templates, even though the Art. 73 duty for Annex III systems only applies from 2 December 2027.
DORA is the central special regime for ICT risk management and major ICT incidents in financial entities. NISG 2026 (Federal Law Gazette I No. 94/2025) has been in force since 1 October 2026. Entities already in scope must register with the cybersecurity authority by 31 December 2026 (three months from entry into force, § 29 NISG 2026); entities that fall within scope later must register as soon as possible and within three months of meeting the conditions. It may be relevant in parallel for certain cybersecurity and reporting constellations. The specific distinction should be assessed for each institution and incident type.
What should be prepared for AI incidents?
A dedicated AI incident category, an assessment logic per regime, clear responsibilities and reporting templates.
- incident-response plan with a specific AI incident category
- separate assessment logic for AI Act, GDPR, DORA and NISG 2026
- clear owners for FMA, data protection authority and cybersecurity reporting
- templates for initial notification, intermediate report, final report and internal escalation
The EU AI Act does not exist in isolation. DORA requires ICT risk management and third-party governance. GDPR regulates automated individual decisions and data protection impact assessments. Austrian labour constitution law may require a works agreement for HR AI.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).