--- title: "EU AI Act Financial Services Compliance Guide for Germany (updated 2026)" description: "Which AI systems are high-risk in financial services, what August 2026 deadlines mean for German banks, and a practical compliance checklist." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/ai-act/financial-services/" language: "en" --- ![EU AI Act compliance requirements for financial services firms in Germany](https://compound.law/assets/images/ai-act/ai_act_4.webp) ai-act # EU AI Act Financial Services Compliance Guide for Germany (updated 2026) 1 May 2026 High-risk AI in financial services under the EU AI Act Credit scoring, insurance underwriting, and fraud detection AI used in German financial services face strict EU AI Act obligations. New systems must be compliant by August 2026; legacy systems by February 2027. BaFin oversight applies in parallel. - Credit scoring and insurance underwriting AI are explicitly high-risk under Annex III. - New high-risk systems must be compliant by August 2026; legacy systems by February 2027. - Fraud detection triggering account blocks faces elevated transparency obligations. - AI Act obligations stack on top of BaFin and MiFID II — not as an alternative. **Credit scoring, insurance underwriting, and fraud detection AI at German financial institutions face strict EU AI Act obligations.** Systems that assess the creditworthiness of natural persons are explicitly listed as high-risk in Annex III — they require a risk management system, data governance documentation, bias testing, technical documentation, human oversight mechanisms, and a conformity assessment before deployment. From **2 August 2026**, newly deployed high-risk AI systems must be fully compliant; legacy systems in operation before that date have until **2 February 2027**. For the foundational framework, see our [EU AI Act compliance overview](https://compound.law/en-DE/ai-act/). German financial institutions face a layered compliance environment: AI Act requirements stack on top of BaFin supervisory requirements, MiFID II, and — where personal data is involved — DSGVO. These frameworks apply simultaneously, not as alternatives. *Last updated: May 2026* ## High-Risk AI Systems in Financial Services — What Qualifies? The EU AI Act uses a risk-tiered approach. Not all AI in financial services is high-risk, but several core use cases are explicitly classified in Annex III of the regulation. ### Credit Scoring and Risk Assessment Tools Any AI system that evaluates the creditworthiness of natural persons is **high-risk** under Annex III of the EU AI Act. This covers: - **Credit scoring models** — including bank lending, consumer credit platforms, and leasing companies - **Insurance underwriting AI** — systems that determine premium levels or eligibility for natural persons - **Claims assessment tools** — automated evaluation of insurance claims affecting individual outcomes This classification applies regardless of whether the AI system makes final decisions autonomously or supports a human decision-maker. A scoring model that produces a credit recommendation for a loan officer is still high-risk. High-risk systems face substantial obligations: a continuous risk management system active throughout the lifecycle; data governance documentation covering training data quality, completeness, and representativeness; systematic bias testing before and after deployment; transparency mechanisms informing affected persons of AI use; human oversight mechanisms enabling meaningful intervention; ongoing accuracy monitoring; and complete technical documentation prepared before the system enters service. German institutions using scoring AI from third-party providers — acquired, licensed, or accessed via API — remain responsible as deployers. Provider compliance is necessary but does not discharge deployer obligations. Review contracts carefully to ensure access to required technical documentation. ### Fraud Detection and Transaction Monitoring Fraud detection AI does not automatically fall into the high-risk category. The key question is what happens when the system flags a transaction: - **Flags for human review**: Lower obligations apply. The system supports human decision-making without directly blocking access. - **Blocks account access or denies essential financial services**: Elevated obligations apply, and the system may qualify as high-risk under Annex III. This distinction matters operationally. A fraud monitoring system that freezes accounts in real time without human intermediation occupies a different compliance tier than one that creates a work queue for fraud analysts. German banks and payment service providers using automated account suspension need to map this carefully. Where AI-driven fraud decisions affect access to essential services, affected persons must have transparency rights and rights to contest decisions. Our [data processing agreement guide](https://compound.law/en-DE/compliance/data-processing-agreement/) covers the interplay with DSGVO rights in AI-driven decision contexts. ### Algorithmic Trading (Where Applicable) Algorithmic trading and robo-advisory operate under MiFID II. The AI Act does not override MiFID II — it adds a layer of AI-specific requirements. AI-specific risks that MiFID II does not directly address include: - **Model drift** — when market conditions shift, a model trained on historical data can systematically misfire without anyone noticing - **Training data bias** — historical inequalities in financial data propagate into model outputs - **Algorithmic bias** — systematic disadvantage to certain customer groups in product recommendations or access decisions For investment firms, an AI Act transparency requirement and a MiFID II suitability disclosure may point to the same AI-driven recommendation but address different aspects of it. A combined gap analysis is more effective than treating the two frameworks separately. Our [AI trading algorithms compliance guide](https://compound.law/en-DE/compliance/ai-trading-algorithms/) covers the MiFID II and AI Act intersection in detail. ## August 2026 Deadline — What Financial Firms Need Now The EU AI Act entered into force in August 2024 with a phased implementation schedule. For financial services, the key dates are: | Deadline | Scope | | ----------------- | ----------------------------------------------------------------------------------------- | | **February 2025** | Prohibited AI practices (Art. 5) — apply immediately with no exceptions | | **August 2026** | Full high-risk AI obligations for newly deployed systems | | **February 2027** | Transition period ends — legacy systems in operation before August 2026 must be compliant | For most financial institutions, **August 2026** is the action date: new credit scoring models, fraud detection systems, and robo-advisory platforms deployed from that date must already satisfy the full high-risk obligations at the point of deployment. Systems already in production before August 2026 have until February 2027. “Already in production” has limits. Significant modifications to existing systems may reset the clock and remove the legacy exception. Any institution planning a model upgrade or platform migration in 2026 should assess whether that change qualifies as a significant modification. ### GPAI Model Obligations for Financial Services Financial services firms increasingly use general-purpose AI models for document analysis, contract review, customer communication drafting, and internal knowledge management. GPAI models used for these support functions are typically not themselves high-risk — but if a GPAI model is integrated into a pipeline that produces inputs for a high-risk decision (credit scoring, risk assessment), that integration may bring the whole system into high-risk territory. The EU AI Act places primary obligations for GPAI models on the model provider. Deployers benefit from providers who offer transparent documentation of training data, usage policies, and compliance roadmaps. When evaluating infrastructure, check what each vendor provides for regulatory documentation. Our [Claude Enterprise guide](https://compound.law/en-DE/tools/claude-enterprise/) covers what enterprise AI contracts should include for regulated-sector compliance. ### Technical Documentation Requirements High-risk AI systems require complete technical documentation **before** being placed into service. Documentation cannot be a post-deployment exercise. Required elements include: 1. General description of the AI system and its intended purpose 2. Description of the development process and design choices made 3. Information on training, validation, and testing data 4. Assessment of known and foreseeable risks 5. Performance metrics and accuracy benchmarks 6. Human oversight measures and instructions for use 7. Information on cybersecurity measures Documentation must be maintained and updated throughout the system lifecycle. BaFin may request it as part of supervisory reviews, and Bundesanstalt für Finanzdienstleistungsaufsicht guidance increasingly references AI Act obligations in its supervisory expectations. Having documentation-first deployment processes avoids last-minute scrambles when regulatory inquiries arrive. ## AI Act and DSGVO Overlap — Special Considerations for German Banks German financial institutions processing personal data in AI systems must satisfy both the EU AI Act and DSGVO simultaneously. These two frameworks intersect significantly in financial AI contexts. **Automated decision-making rights (DSGVO Article 22)**: DSGVO restricts solely automated decisions with significant effects on natural persons. Credit scoring AI that informs human decisions may partially fall outside Article 22’s scope — but AI Act high-risk obligations still apply regardless of whether there is formally a human in the loop. **Data minimization and AI training**: DSGVO data minimization principles constrain what personal data can be used for training AI models. Financial institutions training scoring models on customer transaction data need a clear legal basis and a documented purpose limitation analysis before that data enters any training pipeline. **Right of explanation and transparency**: Where AI-driven decisions affect customers, DSGVO explanation rights and AI Act transparency requirements create parallel but complementary obligations. Institutions should develop a unified customer-facing response process that satisfies both frameworks simultaneously rather than maintaining two separate workflows. **Data Processing Agreements with AI vendors**: If AI systems from external vendors process personal customer data, a Data Processing Agreement (DPA) under DSGVO Article 28 is mandatory. The DPA must specifically address the AI processing activities, not rely on generic data processing terms. Our [data processing agreement guide](https://compound.law/en-DE/compliance/data-processing-agreement/) covers what a DPA for an AI system provider must contain under both DSGVO and AI Act requirements. The European Banking Authority (EBA) and European Securities and Markets Authority (ESMA) have both issued guidance touching on AI use in financial services. German institutions should monitor BaFin publications alongside EBA and ESMA guidance, and coordinate compliance programmes with their Data Protection Officer and legal counsel. ## Practical Compliance Checklist for Financial Services Use this as a starting framework. Specific situations require individual legal counsel. **Step 1 — AI Inventory** - [ ] Map all AI systems in use across the institution - [ ] Document purpose, data inputs, and output types for each system - [ ] Classify each system by EU AI Act risk category **Step 2 — Identify High-Risk Systems** - [ ] Mark all credit scoring and risk assessment AI as high-risk - [ ] Mark all insurance underwriting AI as high-risk - [ ] Assess fraud detection: does the AI block account access or deny essential services? - [ ] Review GPAI model integrations that feed high-risk decision pipelines **Step 3 — Implement High-Risk Requirements** - [ ] Establish a continuous risk management system - [ ] Create data governance documentation for training data - [ ] Implement bias testing protocols before and after deployment - [ ] Define human oversight mechanisms enabling meaningful intervention - [ ] Prepare complete technical documentation before deployment - [ ] Prepare EU declaration of conformity **Step 4 — BaFin and Regulatory Alignment** - [ ] Map AI Act requirements against existing BaFin obligations - [ ] Align MiFID II obligations with AI Act requirements for trading and advisory AI - [ ] Coordinate with Data Protection Officer on DSGVO overlap - [ ] Define internal ownership and escalation paths for AI compliance **Step 5 — Vendor and Third-Party AI** - [ ] Audit scoring models and AI systems from third-party providers - [ ] Confirm providers fulfill high-risk AI system provider obligations - [ ] Secure contractual access to required technical documentation - [ ] Ensure DPAs are in place for all systems processing personal data ## How Compound Law Helps - AI system inventory and risk classification for financial institutions - Credit and insurance scoring compliance programs - BaFin and AI Act obligation mapping - Trading AI regulatory alignment (MiFID II + AI Act) - Bias testing and technical documentation frameworks - DSGVO and AI Act intersection analysis - Third-party AI vendor contract review ## Frequently Asked Questions ### Does the EU AI Act apply to all AI used in banking? Not uniformly. Credit scoring and insurance underwriting AI are explicitly high-risk under Annex III with the strictest obligations. Fraud detection, trading, and customer service AI fall into different tiers depending on function and the consequences of system outputs. ### Is credit scoring always high-risk under the AI Act? Yes, if it evaluates the creditworthiness of natural persons. Annex III lists credit scoring explicitly as high-risk regardless of whether the system makes final decisions or supports a human decision-maker. Banks, leasing companies, and consumer credit platforms are all covered. ### What is the August 2026 deadline for financial firms? From 2 August 2026, newly deployed high-risk AI systems must satisfy full EU AI Act obligations at the point of deployment. Legacy systems in production before August 2026 have until 2 February 2027 — but significant modifications to legacy systems may remove this exception. ### Does MiFID II compliance satisfy AI Act requirements? No. MiFID II governs market conduct and investment advisory obligations. The AI Act addresses AI-specific risks — model drift, training data bias, transparency, and human oversight. Both apply simultaneously; compliance with one does not satisfy the other. ### Is fraud detection AI high-risk under the AI Act? Not automatically. The key question is the consequence of a positive flag. Flagging for human review: lower obligations. Blocking account access or denying essential financial services: elevated obligations, potentially high-risk classification. ### Who is responsible when using a third-party scoring model? As deployer, your institution remains accountable regardless of where the model comes from. Verify that the provider meets high-risk AI system provider obligations and contractually secure access to the required technical documentation. Third-party use does not transfer compliance responsibility. ## Related Industry Guides [![EU AI Act timeline Germany for 2 August 2026 2 December 2027 and 2 August 2028](https://compound.law/assets/images/ai-act/ai_act_1.webp)](https://compound.law/en-DE/ai-act/august-2026-deadline/) [ai-act](https://compound.law/en-DE/ai-act/august-2026-deadline/) ### [EU AI Act Timeline Germany: 2 August 2026, 2027 and 2028](https://compound.law/en-DE/ai-act/august-2026-deadline/) [EU AI Act 2 August 2026 is not the only date. German businesses need the split timeline for transparency, stand-alone high-risk AI, and product AI.](https://compound.law/en-DE/ai-act/august-2026-deadline/) [![AI telecoms regulation Germany: EU AI Act, GDPR and TKG 2021 compliance guide](https://compound.law/assets/images/ai-act/ai_act_2.webp)](https://compound.law/en-DE/ai-act/telecommunications/) [ai-act](https://compound.law/en-DE/ai-act/telecommunications/) ### [AI Regulation for Telecoms in Germany: EU AI Act, GDPR & TKG 2021](https://compound.law/en-DE/ai-act/telecommunications/) [German telecom operators face AI obligations under the EU AI Act, GDPR, and TKG 2021. What applies, what's high-risk, and when you must comply.](https://compound.law/en-DE/ai-act/telecommunications/) [![EU AI Act recruitment AI compliance Germany — high-risk Annex III](https://compound.law/assets/images/ai-act/ai_act_2.webp)](https://compound.law/en-DE/ai-act/recruitment/) [ai-act](https://compound.law/en-DE/ai-act/recruitment/) ### [EU AI Act and Recruitment AI in Germany: Compliance Guide](https://compound.law/en-DE/ai-act/recruitment/) [AI recruitment tools in Germany are high-risk under EU AI Act Annex III. What employers need to comply before the August 2026 deadline.](https://compound.law/en-DE/ai-act/recruitment/) ## Frequently asked questions Not uniformly. The AI Act uses a risk-tiered framework. Credit scoring and insurance underwriting AI are explicitly high-risk under Annex III and face the strictest obligations. Other financial AI systems may fall under limited or minimal risk tiers with lighter requirements. Yes, if it evaluates the creditworthiness of natural persons. Annex III of the EU AI Act lists credit scoring explicitly as a high-risk use case regardless of whether the system makes final decisions or supports a human decision-maker. From 2 August 2026, all newly deployed high-risk AI systems must meet full EU AI Act obligations: risk management, data governance, bias testing, technical documentation, human oversight mechanisms, and a conformity assessment before deployment. No. MiFID II covers market conduct and investment advice obligations. The AI Act covers AI-specific risks — model drift, training data bias, transparency, and human oversight. Both frameworks apply simultaneously; compliance with one does not satisfy the other. Not automatically. If the system flags transactions for human review, obligations are lower. If it blocks account access or denies essential financial services, elevated obligations apply and the system may qualify as high-risk. Using a third-party model does not transfer compliance responsibility. As a deployer, your institution remains accountable for proper use. Verify that the provider meets high-risk AI system obligations as a provider and secure contractual access to required documentation. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "EU AI Act Financial Services Compliance Guide for Germany (updated 2026)", "description": "Which AI systems are high-risk in financial services, what August 2026 deadlines mean for German banks, and a practical compliance checklist.", "image": "https://compound.law/assets/images/ai-act/ai_act_4.webp", "datePublished": "2026-05-01T00:00:00.000Z", "dateModified": "2026-05-01T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/ai-act/financial-services/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Act by Industry", "item": "https://compound.law/en-DE/ai-act/" }, { "@type": "ListItem", "position": 3, "name": "EU AI Act Financial Services Compliance Guide for Germany (updated 2026)", "item": "https://compound.law/en-DE/ai-act/financial-services/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does the EU AI Act apply to all AI used in banking?", "acceptedAnswer": { "@type": "Answer", "text": "Not uniformly. The AI Act uses a risk-tiered framework. Credit scoring and insurance underwriting AI are explicitly high-risk under Annex III and face the strictest obligations. Other financial AI systems may fall under limited or minimal risk tiers with lighter requirements." } }, { "@type": "Question", "name": "Is credit scoring always high-risk under the AI Act?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if it evaluates the creditworthiness of natural persons. Annex III of the EU AI Act lists credit scoring explicitly as a high-risk use case regardless of whether the system makes final decisions or supports a human decision-maker." } }, { "@type": "Question", "name": "What is the August 2026 deadline for financial firms?", "acceptedAnswer": { "@type": "Answer", "text": "From 2 August 2026, all newly deployed high-risk AI systems must meet full EU AI Act obligations: risk management, data governance, bias testing, technical documentation, human oversight mechanisms, and a conformity assessment before deployment." } }, { "@type": "Question", "name": "Does MiFID II compliance satisfy AI Act requirements?", "acceptedAnswer": { "@type": "Answer", "text": "No. MiFID II covers market conduct and investment advice obligations. The AI Act covers AI-specific risks — model drift, training data bias, transparency, and human oversight. Both frameworks apply simultaneously; compliance with one does not satisfy the other." } }, { "@type": "Question", "name": "Is fraud detection AI high-risk under the AI Act?", "acceptedAnswer": { "@type": "Answer", "text": "Not automatically. If the system flags transactions for human review, obligations are lower. If it blocks account access or denies essential financial services, elevated obligations apply and the system may qualify as high-risk." } }, { "@type": "Question", "name": "Who is responsible when using a third-party scoring model?", "acceptedAnswer": { "@type": "Answer", "text": "Using a third-party model does not transfer compliance responsibility. As a deployer, your institution remains accountable for proper use. Verify that the provider meets high-risk AI system obligations as a provider and secure contractual access to required documentation." } } ] } ] ```