The AI Compliance Staircase NEW
Which obligation applies at which AI maturity stage? The roadmap model for executives, with self-check.
See the AI Compliance StaircaseWhich AI obligations already apply to Austrian financial institutions?
Since 2 February 2025, the first binding EU AI Act requirements have applied, including the prohibition of certain AI practices and the obligation to take measures supporting AI literacy among people who deploy or operate AI systems.
What many underestimate: the regulatory requirements do not arrive one by one. DORA, NIS2, GDPR and the EU AI Act overlap with different deadlines, authorities and sanction regimes. One AI-related compliance breach can involve the FMA, the data protection authority and the works council at the same time.
For medium-sized regional banks and insurers in Austria, this creates a particular challenge: they often operate the same core systems as large institutions, but with significantly leaner internal compliance resources.
Beyond this financial-sector focus, AI governance also becomes a management and oversight topic for stock corporations outside the financial sector: management board, supervisory board, internal controls and reporting need one coherent framework.
Current timeline status
The Digital Omnibus on AI was published as Regulation (EU) 2026/1744 in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The postponement is therefore binding law: requirements for high-risk AI systems under Annex III apply from 2 December 2027, those under Annex I from 2 August 2028. The transparency obligations under Art. 50 were not postponed and have applied since 2 August 2026.
Which topic areas do boards need to address now?
Eleven topic areas, from the AI Compliance Staircase through shadow AI and FRIA to the Cyber Resilience Act and the ArbVG.
AI agents in software development NEW
Using coding, testing and review agents under control: legal framework, control points and eight control areas for banks and insurers.
See AI agents in developmentShadow AI
AI components in purchased software or freely used tools are often not inventoried as AI systems. Nevertheless, duties under the EU AI Act, GDPR and internal governance rules may arise.
More on shadow AIEU AI Act
The EU AI Act has been in force since 1 August 2024. Prohibitions and AI literacy have applied since February 2025, the transparency obligations since 2 August 2026. Annex III high-risk duties follow on 2 December 2027.
More on the EU AI ActManagement board liability
Under Section 84 AktG and Section 39 BWG, AI governance becomes an organisational duty. Not knowing which AI systems are used is not a viable control concept.
More on management board liabilityAG governance
Management and supervisory boards need an auditable framework for AI inventory, controls, risk management, reporting and decisions of governing bodies.
AI governance for stock corporationsVendor AI
Market-leading platforms for core banking, AML, underwriting and HR may contain AI components. Institutions using those systems have their own deployer obligations.
More on vendor AIFRIA
The Fundamental Rights Impact Assessment under Art. 27 EU AI Act is especially relevant for creditworthiness assessment and life/health insurance risk assessment.
Understand FRIAGPAI
ChatGPT, Copilot, Claude and other general-purpose AI services require usage rules, privacy review, inventory and provider due diligence.
More on GPAICyber Resilience Act
CRA practical navigator for banks and insurers: product roles, reporting, suppliers, conformity and support. With practical cases and printable worksheets.
Open the CRA practical navigatorArbVG §§ 96/96a
AI systems with employee data, HR or control functions may require works council involvement and works agreements in Austria.
Assess the ArbVG interfaceWhat does the path to EU AI Act compliance look like?
The path to EU AI Act compliance is not a single project, but a structured process across several phases: inventory, risk classification, role allocation, gap analysis, governance and ongoing monitoring. International standards such as ISO/IEC 42001:2023 provide a framework, but they do not replace the individual assessment of specific AI systems, business processes and responsibilities in your institution.
CSRD / ESRS relevance for AI bias
AI bias is not only a technical or EU AI Act topic. If AI systems create discrimination risks in HR, lending, underwriting or customer access, these risks may also become relevant for CSRD / ESRS reporting: as a social impact, governance topic, risk-management question or auditable evidence. This presupposes that the institution is subject to reporting at all: Directive (EU) 2026/470 has limited the CSRD scope to EU companies with more than 1,000 employees and more than EUR 450 million net turnover; national transposition, transition years and group-level assessment must also be checked. The impact or risk must also be material – not every bias incident leads to an ESRS disclosure.
ISO/IEC 42001
The international standard for AI management systems provides structure, but does not cover all EU AI Act-specific duties.
Understand ISO/IEC 42001AI inventory
Without a complete inventory, risk classification, FRIA and governance remain incomplete.
More on the AI inventoryAudit readiness
Auditable AI governance means being able to provide inventory, roles, FRIA, logs, reporting paths and evidence at any time.
Build audit readinessProject support
We support Austrian financial institutions from initial inventory to auditable governance structures.
View project supportGlossary
Core terms from the EU AI Act, ISO/IEC 42001 and AI governance, with links to the relevant topic pages.
Open glossary
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).