The EU AI Act Turns AI Governance Into A Business Priority

Welcome to the Connector Podcast, an ongoing conversation connecting fintechs, banks, and regulators worldwide. Join CEO and founder Koen Vanderhoydonk as you learn more about the latest available trends and solutions in the markets. Welcome to another Connector Podcast, and today it's going to be Sean interviewing Mark Andrit from DXC, and they will talk about AI in Europe. Enjoy.

Mark, please, please tell me a bit about, you know, first of all, about what you do and what you do at DXC in particular.

Sure, Sean. Thanks a lot. So I'm a principal advisor for modernization and transformation, and I'm helping our clients to get rid of legacy systems, supported, of course, nowadays also by artificial intelligence. A bit about DXC. DXC is one of the largest independent service integrators, and we're helping customers around the world on all topics IT. And of course, also since the last couple of years with a strong focus on really hands-on AI solutions, accelerating growth for our customers, and also to make them more resilient in today's world of artificial intelligence. Okay.

And Drit, could you introduce yourself as well? That would be great.

Yeah, sure. So I'm Drit Mukherjee. I am a I'm a managing partner within the Financial Services Industries Group. I'm based out of London, 5 years in DXC, and prior to that, I have worked across multiple banks internally, as well as with consulting firms for close to 25 more years. And I think Mark introduced DXC, and from our perspective, we are within the Financial Services Industries Group, which is one of the dominant industry segments within DXC, and we work very closely with many of the big global banks as well as insurance companies and financial services institutions.

Okay. I mean, you're kind of perfectly positioned to talk on this topic in a lot of ways, right? But I mean, Drayidh, in your own words, can you kind of explain the EU AI Act to us and its kind of key requirements?

Yeah, as the name indicates, the EU AI Act is a regulation in the European Union, and it entered into force last year, about a year back in August 2024, and its main aim is to govern AI through establishing a comprehensive framework that ensures deployment of AI in a safe, transparent, and ethical manner across EU. So what it does is it lays down some common harmonized rules on AI and its deployment across all EU countries. And the aim of the rules is to foster trustworthy and fair AI in Europe. I think it is important to understand that the purpose of the AI Act is to protect the fundamental rights, to enhance security while promoting innovation in a risk-mitigated manner across AI systems that are deployed in, in the EU. It is across industries, so not just applicable to financial institutions or the financial services sector. It sets out some risk-based rules for developers and deployers of AI, and it categorizes risk of AI systems based on the extent to which they infringe upon health, safety, livelihood, and fundamental rights. In essence, as I said, it's a set of rules which aims to protect the residents of EU from deployment of AI.

Being an EU regulation, I find that they rarely go live on the original date. Mark, maybe you could tell us a bit about, I know there was an August 2026 deadline for the act and it got pushed back a bit. Where does, where does this kind of act stand now? When does it look like being implemented and what, what has kind of changed in terms of the, the urgency for financial institutions?

So the short answer is yes, the delay, that is real, but for the companies, this is not meaning that it's a holiday. Let me explain why that's the case. So the August 2026 date, that was always one milestone in a phased regulation. It was not the whole regulation. So 2 earlier waves already hit, which is on one hand, the ban on unacceptable AI practices in February 2025, and then the rules for large general purpose AI models in August 2025. So both of these are already in force. But what changed now in May is that the most complex obligations, so the high-risk AI rules that directly affect, for example, credit scoring, lending decisions, and also insurance underwriting inside of banks, those have been pushed out from August 2025. to December 2027. And the reason given officially is that the harmonized technical standards and implementation guidance that firms need to actually comply with weren't ready. So this is quite an honest admission from the EU coming. But there's one important nuance. The August 2026 deadline still happens. So the transparency obligations, these are untouched. And that means from August 2nd, every bank's customer-facing AI tool must tell users that they are actually talking to an AI. So that affects chatbots, virtual assistants, and automated credit explanations. So there is a real compliance action happening this summer already. And for the high-risk system, the December 2027 deadline I mentioned before, that is fixed. The institutions that use this extra time to build their governance infrastructure properly will be in a far stronger position than those who treat this December 2027 deadline as a start date. So we have seen that pattern actually before with other regulatory programs. So firms that begin late face not just a compliance gap, but they also have then a talent and process gap exactly at the wrong moment.

Talking about high risk, I mean, maybe you could tell me a bit about, you know, what does high risk look like under the Act and what kind of everyday systems inside a bank are suddenly going to fall into scope.

Yeah, sure. I think before talking about the high risk, it makes sense to give a little bit of sense on how the EU AI Act delineates between the riskiness of different AI systems. So the Act defines 4 levels of risks for AI systems: unacceptable, high, limited, and minimal. So the unacceptable risks cover all AI systems which provide a clear threat to safety, livelihoods, and rights of people. And under the AI Act, these are banned. These are AI tools which are harmful for individuals. They manipulate, deceive, exploit the fundamental rights of citizens, etc. Now, coming to the high risk, these are AI use cases which can pose a significant risk of harm to health and safety or an adverse impact on the fundamental rights. So these high-risk use cases actually cover various industries, not just financial services. So within FS, I think the key example use cases would be credit scoring and decisions around lending. In essence, AI models which are used to evaluate the creditworthiness of customers or which establish a credit score falls under this category. Any other tool which assesses risk and that risk assessment leads to a pricing decision, that falls under the high-risk category. And then insurance underwriting and pricing, which requires risk profiling and pricing of the premium. So as per the EU AI Act, this is also high risk and needs to be fully explainable to regulators. Besides that, there are other processes like recruitment and HR, which cuts across industries. So if you're screening candidates using AI, that is high risk. Biometric identification, which covers systems that identify individuals through biometrics. These are also high risk. There is a very important exception, which I must highlight before I complete the answer to this question. AI systems that are used for the sole purpose of detecting financial fraud and crimes linked with anti-money laundering are generally exempt from the strict high-risk classification. So I think that sort of should answer the question, what is high risk? These are the types of AI systems which will be deemed as high risk as per the UAE Act within financial services.

Okay. Okay. So it sounds like, to be brief, basically money laundering, anything that's detecting fraud is exempt in a way, but then anything that is, I guess, making a decision or impacting a decision seems to be falling into high risk. Is that a fair assessment?

Yeah, exactly. I think so. Money laundering and financial fraud that is to do with prevention of a crime. So that is exempt. But then there are processes which directly impact the livelihood and the fundamental right of a citizen. For example, if you're applying for a loan, or if you are applying for insurance, and then the financial institution is using AI to score you, and that, that will then fall under the high-risk category.

It's interesting how it's very much about the intent as much as the application, right? A question for yourself, Mark, I think this is going to be an extremely complicated process for, you know, even a national bank. I mean, what about banks who are operating across, you know, several EU countries and several different jurisdictions? I mean, how confusing does this get? Is there going to be one EU rulebook or is there going to be interpretation on a national level?

Yeah, that's a really good question, Sean, especially for, as you mentioned, the banks operating across borders or even across continents at the end. But the legal short answer is it is actually only one rulebook. So the AI Act is a regulation, which means it applies identically in all the 27 member states. So there's no national transposition and no local variants. But practical answer is actually more complex. So the law, that might be uniform, but the enforcement is national. So each member state designates its own market surveillance authority, an MSA. In the financial services, this is typically the national financial financial supervisor. That means BaFin in Germany, the CSSF in Luxembourg, or the AFM or DNB in the Netherlands. And then those MSAs, they sit alongside the prudential supervisors that banks already nowadays report to. So they actually have 2 supervisory lines in each country they operate in. So that increases the complexity, as you just mentioned, Sean. And now if a bank has actually customized third-party AI models for the local market, it might even be a so-called provider provider in the eyes of the regulator and not just a deployer of AI. And this even significantly increases the compliance burden in every jurisdiction where that modified system runs in. So that's another factor of complexity. Then you add UK on the top, which is outside of the AI Act entirely. It's a principle-based system and it's not a binding AI law yet. It's more flexible, but less specific. And on the other end of the spectrum is then the United States, they have no federal AI law for financial services with states then rushing to fill that void. So California, Colorado, Texas, for example, are among the most active and they create exactly this kind of patchwork that the Trump administration has been trying to replace with a single federal framework. So no success so far there as well. So to sum up, the 3 regions have 3 fundamental different models and the EU is actually the most defined and the most demanding, which is exactly why building a global AI governance framework around it is actually the thing that makes most practical sense.

Okay.

Okay.

But I mean, that's, it's probably going to be a few, a few years and a few iterations before everybody else decides to follow that path. How can banks practically deal with this in the next year or two?

Yeah. So as I mentioned, some of these regulations are still in flux, like in the United States. And the same is with the UK part, which is not yet in law, which means as a recommendation, go for the EU one. It might be the toughest one, but it might be the one that then needs just slight adoption and tuning to work then specifically for other regions, or then also for the in-country specific add-ons on top of it.

It does make a ton of sense. If you're going to build around regulation, right, build around the toughest one. What else can you do? Drishya, just a question for you. I mean, do you think there's a version of this where getting the AI governance right becomes a competitive advantage rather than a cost?

Yeah, yeah, absolutely. So I think there is a fear in the industry that regulation kills innovation, but I think regulation may slow down AI innovation in the short run, but it should be seen by the industry As an opportunity for safe and fair deployment that will drive risk-mitigated future benefits. I draw the analogy of it is like discipline in a school. It's painful when you're a boy, but it prepares you for a more profitable future. So it's exactly like that. And so organizations which are investing a lot to comply with the requirements of the UAE law EU AI Act, they benefit from various factors like increased transparency, increased accountability, and fairness within their processes and within their systems. They are better equipped to handling data protection, and they are more resilient. They reduce the risks associated with AI, which of course will lead to less number of incidents that can lead to fines and reputational damage. Incidentally, I may want to point out that failing to comply with the EU AI Act can result in significant fines of up to 7% of a company's global annual turnover or up to €35 million, whichever is higher. This is, of course, the most serious category of breach, but it can lead to very significant financial loss or financial and reputational damage as well. So I think overall, financial services companies should look at embracing these principles and seeing this more as a competitive advantage that enhances their reputation and contributes to their responsible development of AI technologies for a profitable future.

Gentlemen, this has been very good. I mean, is there anything else before I let you go? Is there anything else that either of you would like to share about the EU AI Act or any other thoughts you might have on it that we didn't get a chance to cover?

Just to add what Rit at the end also mentioned. See the EU AI Act as the regulation rather as an opportunity than just to do the bare minimum, because embracing it and really trying to also internally work on the governance, work on the toolings, and really put yourself in a position where you're ready to address this also puts you on the long term in the competitive advantage.

Yeah, and I think one final thought from me, particularly for banks and financial institutions, which are typically our clients, I think it is very important to come up with the right governance framework and operating model for deployment of AI in a safe and ethical manner. By the way, the UAE Act is not the only piece of regulation that needs to be complied with. There are other regulations like DORA, in the EU, the model risk management requirements, which incidentally are more stringent in the US than in Europe, and various other local and regional regulations which need to be complied with. So the right risk governance framework, the compliance model, and having the right controls and operating model are all very, very important for safe and compliant deployment of AI across the enterprise.

At the end of the day, it's just another regulation of many that everyone has to, has to comply by in a very important industry, right? If it wasn't so important, they wouldn't regulate it so hard.

Yeah.

But gents, thank you very much for, for joining me today.

Thank you, Sean, Mark, and Dritt from DXC. It was an amazing insight today, and I hope everyone enjoyed. So please stay tuned on this channel for more fintech news. Thanks for listening to another episode of the Connector Podcast. To connect and keep up to date with all the latest, head over to www.jointheconnector.com or hit subscribe via your podcast streaming platform.