The EU AI Act and its reach into Basel

Read the PDF edition (3 pages)

The European Union adopted Regulation (EU) 2024/1689, generally known as the AI Act, in June 2024. The regulation entered into force on 1 August 2024 and applies in stages. Its prohibitions of certain practices, such as social scoring by public authorities and manipulative techniques, applied from February 2025, while the rules on general-purpose AI models applied from August 2025.¹ Most of the obligations for high-risk systems were originally scheduled to apply from August 2026, with a further transition until August 2027 for systems embedded in regulated products. In November 2025, the European Commission proposed in a so-called digital omnibus to postpone parts of the high-risk regime, linking their application to the availability of harmonised standards.²

The AI Act classifies certain uses in financial services as high-risk. Annex III lists AI systems intended to evaluate the creditworthiness of natural persons or to establish their credit score, with an exception for systems used to detect financial fraud. It also lists systems used for risk assessment and pricing in relation to natural persons in life and health insurance.³ Providers of such systems must establish a risk management system, ensure the quality of training data, keep technical documentation and logs, provide transparency to deployers, allow human oversight and achieve appropriate levels of accuracy, robustness and cyber security. Deployers, such as the banks and insurers that use the systems, must use them in accordance with their instructions, monitor them and, in certain cases, carry out an assessment of their impact on fundamental rights.⁴

The regulation reaches beyond the borders of the Union. It applies to providers that place AI systems on the market or put them into service in the Union, wherever they are established, and to providers and deployers in third countries where the output of the system is used in the Union.⁵ A Basel bank that uses an AI-based credit scoring model for clients resident in Germany or France, an insurer that prices life policies for frontier workers in Alsace or a software firm in the canton that sells a compliance tool to banks in the Union must therefore examine whether it falls within the scope of the regulation. For the trinational economy that Part H described, where clients, employees and services cross the border every day, this extraterritorial reach is a practical matter for many firms.⁶

The rules on general-purpose AI models concern the providers of large models more than the financial institutions that use them. Providers must prepare technical documentation, give information to downstream providers, adopt a policy to comply with copyright law and publish a summary of the content used for training. Models with systemic risk, defined in part by the computing power used for training, are subject to additional obligations on evaluation, incident reporting and cyber security.⁷ For Swiss users, these rules have an indirect benefit, because they oblige the providers to supply information that banks and insurers need for their own risk management under FINMA's expectations.

Notes

1. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act), OJ L, 12 July 2024; Art. 113 on entry into force and application. To be verified. ↩
2. European Commission, proposal for a digital omnibus on AI of 19 November 2025 amending the timetable of the AI Act. Status of the legislative procedure and final dates to be verified. ↩
3. Annex III, point 5(b) and (c), Regulation (EU) 2024/1689. To be verified. ↩
4. Arts. 9 to 15 (requirements for high-risk systems), Art. 26 (obligations of deployers) and Art. 27 (fundamental rights impact assessment) of Regulation (EU) 2024/1689. To be verified. ↩
5. Art. 2(1)(a) and (c) of Regulation (EU) 2024/1689. To be verified. ↩
6. On the trinational economy and cross-border services in the Basel region, see Part H, Chapter II. To be verified. ↩
7. Arts. 51 to 55 of Regulation (EU) 2024/1689; the General-Purpose AI Code of Practice published by the European Commission in July 2025. Status to be verified. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.