Map the decisions the agent can influence and the changes it can make to accounts, payments or customer records. Classification, authority and customer rights need separate checks; a working integration does not answer all three.
Why Fintech AI Governance Is Different
Assess credit assessment, fraud detection, customer support and payment actions separately. Industry membership alone does not determine high-risk status, and privacy or financial-sector duties can apply even when a particular AI Act use case does not.
The Fintech AI Governance Checklist
For each control, record the workflow it covers, the owner and the evidence used to test it. Apply the checklist to real operating permissions and customer outcomes, not just to model accuracy.
1. Risk Classification and Scope Definition
Annex III point 5(b) covers evaluation of natural persons' creditworthiness or credit scoring and explicitly excludes systems used to detect financial fraud from that use case. Evaluate Article 6, including its exceptions and profiling rule, against the intended purpose. Human participation alone neither establishes nor removes high-risk status; ordinary customer service is not high-risk simply because the provider is a fintech.
2. Authorization and Policy Controls
Check the actor's authority before account changes, payments or outbound messages. Keep policy versions and test denied, expired and excessive permissions; model-generated instructions cannot create authority the actor does not have.
3. Bias and Fairness Controls
Choose outcome checks suited to the intended use and lawful access to data. Examine error patterns, proxy variables and affected groups, document limitations and investigate differences before declaring the process fair.
4. Audit Evidence and Logging
Define a stable event identifier and connect the proposed action, permission result, execution outcome and any human review. Record failed and cancelled actions as well as successful ones; restrict access to sensitive supporting material.
5. Human Oversight Architecture
Define when a person must review an action, what they may inspect and whether they can stop or override it. Test unavailable-reviewer and incomplete-evidence cases instead of relying on a nominal approval button.
6. Customer Rights
Provide a reachable route for customers to ask about or challenge an outcome. Determine the applicable information, review and correction duties, and ensure the support team can trace the decision without exposing another customer's data.
GDPR Article 22 concerns decisions based solely on automated processing that produce legal or similarly significant effects. Its exceptions and safeguards require a separate assessment; legitimate interest alone is not an Article 22(2) exception. Where Article 22(3) applies, safeguards include human intervention, expressing a view and contesting the decision. A nominal human approval does not resolve a workflow that is effectively automated.
Common Fintech-Specific Gaps
Look for duplicated payment attempts, inconsistent account permissions and a review queue that can be bypassed. Check whether a correction reaches every downstream record and whether staff can reconstruct decisions made under an older policy version.
FAQ
Does adding a person automatically remove high-risk status? No: classification follows the intended purpose and Article 6 conditions. Review whether the person has meaningful authority and evidence, then assess automated-decision rights separately.
Review updated 1 October 2026: the AI Omnibus entered into force on 27 July 2026. The high-risk requirements in Chapter III Sections 1-3 apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems, subject to the Act's transitional provisions. Other obligations have separate application dates.
EU AI Act: consolidated text, 27 July 2026 | European Commission: AI Omnibus entry into force | GDPR: Regulation (EU) 2016/679