In finance, you already carry the heavy lifting: the numbers have to be right, and every decision must hold up to scrutiny from an executive, a customer, a regulator, and sometimes a court.
Now, a model sits inside half of those calls. The EU AI Act, the world's first broad rulebook for AI, has landed on top of that responsibility.
The Act covers the organizations that use AI, not just those that build it. If a model you run scores an applicant's creditworthiness, prices a life policy, or sets a borrower's credit limit, the law calls you the "deployer." The obligation is yours. Get it wrong, and the fines run to €15 million or 3% of a company's global annual turnover.
Beyond the legal jargon, the Act requires three core elements for any AI-influenced decision:
- A human who can overrule it.
- A reason you can explain in plain words.
- A record of what ran and when.
It's what you'd demand of any control you had to stand behind.
(Note: The high-risk deadline may slide to late 2027, but the requirements don't change; build them in now.)
Navigating High-Risk Use Cases
The Act categorizes risk based on impact, not just the model's sophistication. Here is how your daily financial use cases map to the Act's framework:
| AI use case in finance | How the Act treats it | Your core obligations |
| Scoring someone's creditworthiness or approving credit | High-risk | Explainability, human oversight, and sound input data |
| Risk assessment and pricing for life/health insurance | High-risk | Explainability, human oversight, and sound input data |
| Fraud detection | Deliberately excluded from high-risk | Lighter obligations, but still your data to stand behind |
| Anti-money-laundering monitoring | Governed by anti-money laundering laws | Follow existing anti-money laundering regulations |
| Forecasting cash flow | Lower risk | Good practice, not mandated |
The model's sophistication isn't what drives risk; it's the decision's impact on a person. A wrong creditworthiness call can shut someone out of a home or a business, which is exactly why it's named, and why fraud detection, which protects the institution rather than judging the customer, is excluded.
Where the decision does land on a person, the law wants the one thing any good analyst already wants: to know why the model said what it said.
In practice, that comes down to a few things you should be able to do:
- Understand why the model produced a given credit score.
- Ensure a human can overrule it when it's clearly wrong.
- Trace the steps behind the answer, so you'd catch a misread income or a missed exception.
- Show a record of who checked it, and when.
Get those right, and the same decision holds up whether it runs once or ten thousand times. Miss them, and a score nobody can explain, with no record of who checked it, is the one that won't pass an audit.
Your gap analysis
Look at your own footprint. Here's a checklist to audit your own tools and see where the gaps are:
- Audit your footprint: List the AI tools your team uses (including unofficial ones) and flag any that shape a decision that could be challenged later, like a credit application or a control you’ll have to defend.
- Audit the loop: For flagged tools, ensure a human is genuinely in the loop and that you can explain and reproduce the decision after the fact.
- Lock the data: Stop feeding sensitive customer or financial data into tools you can't fully account for.
Do this, and the next time a decision gets challenged, you'll have the answer ready.
This isn't the complete compliance checklist. It's the practical core, the things that matter most, in plain terms. For the full set of obligations, the Act itself is the source of truth.
You already own the fix.
You don't need to become a compliance department. A human check, a clear reason, and a solid record are exactly what you'd want the first time a decision gets questioned. The real fix is to stop holding the process in your head and let the work document itself.
That's where a visual workflow comes in. Instead of a decision locked inside a spreadsheet macro or a vendor black box, every step is laid out where you can see it: the raw data source, the model's logic, and the human sign-off. The audit trail isn't a separate document; the workflow is the record.
This Knime credit-scoring pipeline maps the entire "human, reason, record" audit trail at a glance, from raw data source to automated scoring and annotated human review.
Start with the decisions you'd have to defend. Make those the first ones you can show your work on.