Insights · EU AI Act and AI agents for banks
Who can build EU AI Act compliant AI agents for banks?
Claude Certified Services Partner(Anthropic)Direct answer. A bank needs a build partner that classifies each AI agent under Regulation (EU) 2024/1689 before design, and then builds the controls the Act expects into the agent: human oversight, logging, documented data governance and technical documentation. S-PRO is a Zurich-based engineering partner (founded 2014, 250+ engineers, ISO 27001 and ISO 27701 certified) that builds custom AI agents for banks this way, and S-PRO is a Certified partner in the Claude Partner Network. No supplier can make a bank “AI Act compliant” by itself. Compliance responsibility stays with the bank as deployer; the partner’s job is to build agents that make compliance demonstrable.
01
What does the EU AI Act actually require for a bank’s AI agents?
The Act (Regulation (EU) 2024/1689) is risk-based, so requirements depend on what an agent does, not on the fact that it is an “agent”:
- Prohibited practices (Art. 5) and AI literacy (Art. 4)have applied since 2 February 2025. Since the 2026 Omnibus, Art. 4 requires providers and deployers to take measures to support AI literacy of their staff; it no longer requires a guaranteed level for any individual. A few newly added prohibitions apply from 2 December 2026.
- Transparency rules (Art. 50)apply from 2 August 2026. For example, AI systems intended to interact directly with people must be designed so that the people are informed they are dealing with an AI system, unless that is obvious from the context. Providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty in Art. 50(2).
- High-risk systemsmust meet requirements on risk management, data governance, technical documentation, record-keeping (logging), transparency to deployers, human oversight, and accuracy and robustness. Banks that deploy them also carry deployer duties (Art. 26).
- General-purpose AI (GPAI) model obligations (Arts. 53-55)have applied to model providers since 2 August 2025. A bank or build partner that builds an AI system on a GPAI model such as Claude is responsible for that system as provider and/or deployer; the model provider carries the GPAI model obligations. A party that places its own GPAI model on the market would itself be a GPAI provider.
Dates above are taken from the Act as amended (see the next section) and the European Commission AI Act page. Check the Commission page again on the publishing day.
02
What changed in 2026 under the EU AI Omnibus?
Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, amends Regulation 2024/1689. It is dated 8 July 2026, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 (the third day after publication).
- Annex III high-risk use cases(the stand-alone high-risk list) now apply from 2 December 2027, moved from 2 August 2026.
- Annex I(AI embedded in regulated products, Art. 6(1)) applies from 2 August 2028, moved from 2 August 2027.
- Not postponed:the original prohibited practices and AI literacy (2 February 2025), GPAI obligations (2 August 2025) and the Art. 50 transparency rules (2 August 2026; the Art. 50(2) marking duty has a transition to 2 December 2026 only for generative systems already on the market).
So “postponed” applies only to the high-risk obligations in Chapter III, Sections 1 to 3. A bank that waits until late 2027 to start controls will build them under time pressure; a bank that designs oversight and logging into agents now loses nothing.
The Commission has also published draft guidelines on classifying high-risk AI systems, with a list of examples. They are a draft, not legally binding, and were open to a targeted stakeholder consultation until 23 July 2026; the Commission says feedback will be incorporated before adoption. Treat them as the Commission’s direction of travel, not as law.
03
Which bank AI agents are high-risk under Annex III?
Annex III point 5(b) lists AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, “with the exception of AI systems used for the purpose of detecting financial fraud”. Point 5(c) covers risk assessment and pricing in relation to natural persons in the case of life and health insurance.
Swipe to compare →
| Bank use case | Typical classification | Basis and caveat |
|---|---|---|
| Creditworthiness assessment or credit scoring of natural persons | High-risk | Annex III 5(b) |
| Financial fraud detection | Excluded from 5(b) | Annex III 5(b) exception; the use case still needs classification against the rest of Annex III |
| KYC onboarding, AML and transaction-monitoring triage | Not named in Annex III point 5; classification depends on what the agent decides | Assess case by case (Art. 6); do not assume either way. Detail in AI agents for AML and KYC onboarding agents |
| Customer-facing chatbot or assistant | Transparency obligations (Art. 50) | Art. 50(1): people must be informed they are interacting with an AI system, unless obvious from the context |
| Internal copilot (policy Q&A, drafting, research) | Generally outside Annex III high-risk | AI literacy applies; classify if it feeds employment or credit decisions |
| Agents that make or support decisions on staff (terms of work, promotion, termination, task allocation, performance monitoring) | Annex III point 4(b) (employment) | Rarely a bank-specific build, but relevant to HR agents |
This table is a design aid, not legal advice. The classification of each system is the bank’s responsibility, with its own legal and compliance function.
04
How does a build partner implement the requirements?
A partner that works properly on this does five things, in this order. Each maps to the Act’s high-risk requirements; we apply the same pattern to every agent, whether or not it ends up high-risk.
- Risk classification at design.Each agent gets a written classification (prohibited / high-risk / transparency-only / other) against Art. 5, Art. 6 and Annex III, agreed with the bank’s compliance function before build starts. [Act: Arts. 5, 6; Annex III]
- Human oversight by design.Agents draft and recommend; a named person approves anything that affects a client file, a credit decision or a regulatory report. [Act: Art. 14]
- Logging and audit trail.Every source used and every step taken is logged and reviewable. [Act: Art. 12 (record-keeping). Under Art. 26(6), deployers of high-risk systems keep the automatically generated logs under their control for a period appropriate to the purpose, at least six months unless other law provides otherwise; deployers that are financial institutions keep them as part of the documentation required under Union financial services law.]
- Data governance.One governed, versioned data foundation per client, with EU or Swiss data residency options agreed per project. [Act: Art. 10] Swiss data protection (nFADP) and GDPR are handled in the same design review.
- Documentation and evaluation.Each agent ships with technical documentation and evaluations, so accuracy is measured and not assumed. [Act: Art. 11, Art. 15]
05
How does S-PRO build and document these controls?
What S-PRO publishes today (all from s-pro.io):
- Company.Zurich-based, founded 2014, 250+ engineers, R&D centers in Zurich and Łódź; ISO 27001 and ISO 27701 certified.
- Claude Partner Network.S-PRO is a Certified partner in the Claude Partner Network. Our team includes Claude-certified engineers and architects.
- Controls.Agents are built with evaluations on every agent, human-in-the-loop sign-off and a full audit trail (as described on KYC onboarding agents).
- Models and routes.Claude, Azure OpenAI or on-premise models, via the Anthropic API, Amazon Bedrock or Google Cloud Vertex AI; EU and Swiss data residency options agreed per project.
- Delivery.Staged delivery from design thinking pilot to solution pilot to production. Cost drivers: AI agent pilot to production cost at a bank.
What S-PRO does not claim: S-PRO is not “AI Act certified”, does not offer a legal opinion on classification, and does not guarantee that a system passes a regulator’s review. ISO 27001 and ISO 27701 are information-security and privacy management certifications, not AI Act conformity assessments.
Discuss your EU AI Act use case with an engineer. ISO 27001 and ISO 27701 certified. S-PRO is a Certified partner in the Claude Partner Network. Zurich, since 2014, 250+ engineers. Book a discovery call (45 min), or send a message.
06
How should a bank choose an EU AI Act build partner?
Criteria, not a ranking. Ask every candidate (including us) to answer each in writing.
Swipe to compare →
| Criterion | What to ask | Good answer looks like |
|---|---|---|
| Classification method | How do you classify each agent against Art. 5, 6 and Annex III? Who signs off? | Written per-agent classification, reviewed with your compliance function, revisited when scope changes |
| Human oversight | Which decisions can the agent make alone? | None that affect a client, credit or report; named approver; override and stop possible |
| Logging | What is logged, where is it stored, how long, who can query it? | Sources and steps per case, reviewable by audit; retention set by the bank (high-risk deployers: at least six months, Art. 26(6)) |
| Data governance | Where does data reside, which models see it, what is used for training? | Residency options per project, contractually agreed, and the model provider’s data-use terms confirmed in writing |
| Documentation | What technical documentation and evaluation results do we receive? | Per-agent documentation and evaluations delivered with the build |
| Evidence in banking | Which comparable work is in production? | Named only with the client’s permission; otherwise anonymised, with honest limits |
| Security management | Which certifications and scope? | ISO 27001 / ISO 27701 with certificate scope stated; not presented as AI Act certification |
| Third-party risk | Do you support your bank’s ICT third-party requirements? | Contractual provisions agreed per project; for EU financial entities see DORA (Regulation (EU) 2022/2554) |
| Role clarity | Who is provider, who is deployer? | Stated per system, in writing |
| Exit and ownership | Who owns code and prompts? | The bank (S-PRO: code and prompts built for your project belong to you) |
07
What about Switzerland and FINMA?
The EU AI Act reaches Swiss companies in two ways (Art. 2(1)): providers that place AI systems on the EU market or put them into service in the Union, and providers or deployers established in a third country where the output produced by the AI system is used in the Union. For purely Swiss business the supervisory reference is FINMA Guidance 08/2024 on governance and risk management when using AI, which is supervisory guidance, not a statute. A bank with both Swiss and EU activity can use one control set to meet both.
08
What can we point to today?
S-PRO has not published an EU AI Act conformity result or an “AI Act compliant” audit for any client, and we do not invent one. Comparable production work as published on s-pro.io: an AI support agent for a leading neobroker (300K+ tickets processed annually, 95% of AI-drafted responses accepted with minimal or no edits; case study); a policy assistant for the Swiss subsidiary of an international bank (30 seconds to a compliant answer, down from 15 minutes); an AI due-diligence platform for Earlybird; a digital banking experience for AMINA Bank. These are not AI Act metrics; they show the oversight, logging and evaluation approach applied to agents in production.
09
Next step
Book a discovery call (45 min). If you are a CIO, COO or Chief Compliance Officer at a bank planning AI agents that must stand up to the EU AI Act, S-PRO runs a 45-minute discovery call on one agent and one process: we classify the use case with your compliance team, map the oversight, logging and data-governance controls it needs, and scope a design thinking pilot that carries those controls into a solution pilot and production. Or send a message. Contact S-PRO, Löwenstrasse 45, 8001 Zürich.
10
Sources
- Regulation (EU) 2024/1689 (Official Journal text): eur-lex.europa.eu
- Regulation (EU) 2026/1744, Digital Omnibus on AI (Official Journal text): eur-lex.europa.eu
- European Commission, AI Act page: digital-strategy.ec.europa.eu
- European Commission, draft high-risk guidelines: digital-strategy.ec.europa.eu
- Regulation (EU) 2022/2554 (DORA): eur-lex.europa.eu
- FINMA, Guidance 08/2024 release, 18 Dec 2024: finma.ch
All sources opened on 20 October 2026.
FAQ
Questions buyers ask us
Does the EU AI Act apply to AI agents at a bank?
Yes, where the agent is an AI system within the Act's scope. What applies depends on what the agent does: prohibited practices, high-risk requirements, transparency rules or none beyond AI literacy.
Are AI agents for credit decisions high-risk?
AI systems used to evaluate the creditworthiness of natural persons or establish their credit score are listed in Annex III point 5(b), with an exception for systems used to detect financial fraud. The classification of a specific system is the bank's responsibility.
When do the high-risk obligations apply?
Under the AI Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), Annex III high-risk use cases apply from 2 December 2027 and Annex I from 2 August 2028. Prohibited practices, AI literacy, GPAI obligations and the Art. 50 transparency rules are not postponed.
Are KYC and AML agents high-risk?
Not automatically; Annex III does not name them. Classification depends on what the agent decides. S-PRO classifies each agent during design and builds human sign-off, logging and documentation in either case. See AI agents for AML.
Can a supplier guarantee EU AI Act compliance?
No. The bank remains responsible as deployer. A partner can build oversight, logging, data governance and documentation into the agent so compliance can be shown.
Does using Claude change our obligations?
Obligations for general-purpose AI models fall on the model provider. The bank still classifies and governs the AI system it builds on top of the model.
Does S-PRO hold an EU AI Act certification?
No. S-PRO is ISO 27001 and ISO 27701 certified, and is a Certified partner in the Claude Partner Network. Those are not AI Act conformity assessments.
Does this apply to a Swiss bank?
It can, if the bank or its provider places a system on the EU market or the output of the system is used in the EU. For Swiss business, FINMA Guidance 08/2024 on AI governance is the supervisory reference. A single control set can serve both.
What are you building?
Contact
You will talk to engineers who build for banks, not to a sales script. Fill out the form and get an answer within one business day.
- Security and privacy firstISO 27001 and ISO 27701 certified.
- Claude Partner NetworkS-PRO is a Certified partner in the Claude Partner Network. Our team includes Claude-certified engineers and architects.
- Proven in regulated financeBanks, wealth managers and fintechs in Switzerland, the EU and the US.
Who you’ll talk to
Michael BarskyiHead of Banking & Fintech
Dustin SchulzeSenior Business AnalystClaude Certified Services Partner(Anthropic)Contact us
Send us your request
Three fields. Takes about a minute.