Financial services under the AI Act

Read the PDF edition (4 pages)

Two categories in Annex III concern the financial sector directly. Artificial intelligence systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score are high-risk, with the exception of systems used to detect financial fraud. So are systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance.¹ Other financial applications, such as transaction monitoring, sanctions screening, portfolio management and robo-advice, are not listed as high-risk as such, but they may be subject to the transparency obligations of Art. 50 and, if they use general-purpose models, indirectly to the obligations of the model providers. For financial institutions supervised under Union law, the AI Act assigns market surveillance of high-risk systems in principle to the national financial supervisory authorities and integrates certain obligations into the existing internal governance requirements of banking law.²

The extraterritorial reach and its relevance for Lugano

The AI Act applies to providers placing artificial intelligence systems on the market or putting them into service in the Union, irrespective of where they are established, and to providers and deployers established in a third country where the output produced by the system is used in the Union (Art. 2(1)(a) and (c)).³ Three constellations are relevant for Lugano.

First, a Ticino software company that sells an artificial intelligence system to banks or insurers in Italy is a provider placing the system on the Union market. If the system is high-risk, for example a credit scoring tool for an Italian consumer lender, the company must meet the full requirements for high-risk systems and appoint an authorized representative in the Union (Art. 22). Second, a Lugano bank that uses a credit scoring system to decide on loans to clients resident in Italy may be a deployer in a third country whose system's output is used in the Union, a constellation whose precise scope is debated in the literature. Third, a Lugano asset manager that uses a chatbot to communicate with Italian clients may be subject to the transparency obligation of Art. 50, which requires that persons be informed that they are interacting with an artificial intelligence system. In each case the analysis overlaps with the question whether the Swiss institution provides services in Italy at all, which Chapter E.IV examines under the Italian rules on cross-border financial services.⁴

Italy's national law on artificial intelligence

Italy became the first member state of the Union to adopt a general national law on artificial intelligence. Law No. 132 of 23 September 2025, "Disposizioni e deleghe al Governo in materia di intelligenza artificiale", was published in the Gazzetta Ufficiale No. 223 of 25 September 2025 and entered into force on 10 October 2025.⁵ The law complements the AI Act without duplicating it. It sets out general principles for the development and use of artificial intelligence and contains sector-specific provisions on health, employment, public administration and justice. It designates the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) as national authorities for artificial intelligence, without prejudice to the powers of the Bank of Italy, CONSOB and IVASS in the financial sector. For the intellectual professions, the law permits the use of artificial intelligence only as an instrument supporting the professional's activity, with the intellectual work remaining predominant, and requires the professional to inform the client about the systems used. It also introduced a new criminal offence of unlawful dissemination of content generated or altered by artificial intelligence (Art. 612-quater of the Italian Criminal Code).⁶

For Lugano the Italian law matters in two ways. Italian lawyers, accountants and tax advisers who work with Lugano banks and fiduciaries on behalf of Italian clients are bound by its rules on the professions. And Swiss providers of artificial intelligence systems used in Italy must take account of the Italian criminal and civil provisions in addition to the AI Act.

Feature Switzerland European Union Legal basis Existing laws; CoE Convention AI Act, Reg. 2024/1689 (signed 2025) Approach Sectoral, technology-neutral Horizontal, risk-based Finance FINMA Guidance 08/2024 Annex III: credit scoring, life and health insurance Data FADP (2023) GDPR (2018) protection Penalties Mainly criminal fines on Up to EUR 35m or 7 % of individuals turnover

Common misconception. It is often assumed that because Switzerland has not adopted the AI Act, Swiss financial institutions need not concern themselves with it. The AI Act applies to providers that place systems on the Union market and to providers and deployers in third countries whose systems' output is used in the Union. A Lugano software company selling to Italian banks, and possibly a Lugano bank using automated credit scoring for Italian residents, can fall within its scope. Swiss law, for its part, already regulates artificial intelligence through data protection, financial market supervision and sectoral rules.

Notes

1. AI Act (above), Annex III, point 5(b) and (c); recital 58, consulted in the EUR-Lex HTML version, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689 ("AI systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk AI systems", with an exception for systems provided for by Union law for detecting fraud in financial services; systems "intended to be used for risk assessment and pricing in relation to natural persons for health and life insurance"). ↩
2. AI Act (above), Art. 74(6) (market surveillance by the authority responsible for the financial supervision of institutions regulated by Union financial services law) and recital 158; Art. 17(4) (quality management system deemed fulfilled by compliance with internal governance rules) and Art. 26(5), second subparagraph, and 26(6), second subparagraph (monitoring and logs of deployers that are financial institutions); https://artificialintelligenceact.eu/article/74/, /article/17/, /article/26/ and /recital/158/. ↩
3. AI Act (above), Art. 2(1)(a) and (c), https://artificialintelligenceact.eu/article/2/; Art. 22(1) (written mandate of an authorised representative by providers established in third countries), https://artificialintelligenceact.eu/article/22/; Art. 50. ↩
4. See Chapter E.IV on Art. 28 and 29-ter of the Italian Consolidated Law on Finance (TUF). ↩
5. Legge 23 settembre 2025, n. 132, "Disposizioni e deleghe al Governo in materia di intelligenza artificiale", Gazzetta Ufficiale, Serie Generale n. 223 of 25 September 2025, https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg (in force 10 October 2025). ↩
6. Law No. 132/2025 (above), Art. 13 paras. 1–2 (use of artificial intelligence by intellectual professions limited to "attività strumentali e di supporto", with information to the client "con linguaggio chiaro, semplice ed esaustivo") and Art. 20 (AgID and ACN as national authorities; the market surveillance roles of the Banca d'Italia, CONSOB and IVASS under Regulation (EU) 2024/1689 preserved), text in Gazzetta Ufficiale, Serie Generale n. 223 of 25 September 2025, https://www.gazzettaufficiale.it/eli/gu/2025/09/25/223/sg/pdf; Art. 612-quater c.p., "Illecita diffusione di contenuti generati o alterati con sistemi di intelligenza artificiale", introduced by Art. 26 para. 1 lit. c) of the law: Brocardi.it, https://www.brocardi.it/codice-penale/libro-secondo/titolo-xii/capo-iii/sezione-iii/ art612quater.html. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.