EU AI Act deadlines after Regulation (EU) 2026/1744 — what changes for financial institutions

The EU AI Act deadlines moved on 27 July 2026, and for a regulated payment or e-money firm the two dates that actually matter are not the ones in the headlines. Regulation (EU) 2026/1744 — the “Digital Omnibus on AI” — pushed the high-risk regime out by well over a year, but it also added two obligations that start on 2 December 2026. Underneath the timetable sits a governance question most compliance teams have not answered: for a licensed financial institution, the AI Act’s market surveillance authority is your own prudential supervisor, not a new AI regulator. This is the timeline, the supervision split, and the integration reliefs the AI Act already gives firms subject to Union financial services law.

1. What Regulation (EU) 2026/1744 is

Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amends three instruments: Regulation (EU) 2024/1689 (the AI Act), Regulation (EU) 2018/1139 (civil aviation) and Regulation (EU) 2023/1230 (machinery). It was published in the Official Journal on 24 July 2026 and, under its Article 4, entered into force on the third day following publication — 27 July 2026, a date that recurs through the amended text as the reference point for new delegated-act powers and transitional windows.

The recitals give concrete reasons: standards for high-risk systems arrived late, national governance and conformity-assessment frameworks were not in place, and the compliance burden was heavier than assumed.

2. The new timetable

The deadline changes sit in the amendment to Article 113 of the AI Act, which is the article that staggers application. Two points of that article were replaced and one was added.

For a payment institution, e-money institution or crypto-asset service provider, that distinction sets the 2026 workplan. If your only AI exposure is Annex III, you have until 2 December 2027 to be conformity-ready. If you generate synthetic content in a customer-facing channel, you have work due in four months.

3. Which of your models is actually high-risk

Annex III point 5(b) is the entry that catches financial services directly: AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with an express exception for systems used to detect financial fraud. Point 5(c) adds risk assessment and pricing for life and health insurance. Nothing else in Annex III is written for a payments firm, although point 4 (employment) will catch a hiring or performance-management tool.

Two filters then run. Article 6(3) says an Annex III system is not high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making — subject to four qualifying conditions: a narrow procedural task, improving the result of a previously completed human activity, detecting decision-making patterns or deviations without replacing or influencing the prior human assessment absent proper human review, or performing a preparatory task. The override is the sentence practitioners keep missing: a system that performs profiling of natural persons is always high-risk, whichever condition would otherwise apply.

The second filter is procedural. Under Article 6(4), a provider concluding that its Annex III system is not high-risk must document that assessment before the system is placed on the market or put into service, is subject to the registration obligation in Article 49(2), and must produce the documentation on request. “Not high-risk” is an evidenced file, not a view.

Facts: a Luxembourg-authorised e-money institution scores consumer applicants for a small instalment-credit feature and auto-declines the bottom decile, with a human reviewing only borderline cases.

What the rule says: this is Annex III point 5(b). The auto-decline means the system materially influences the outcome, so Article 6(3) is unavailable — and in any event the model profiles natural persons, which triggers the always-high-risk override.

What the practitioner does: treats it as high-risk with a 2 December 2027 date, and spends the runway on the Article 11 technical documentation and Article 10 data-governance evidence. Deferring is the wrong read: the model is already live, and a significant change to its design after the application date brings it into scope under Article 111(2) anyway.

4. Who supervises a licensed firm — the Article 74(6) carve-out

This is the part of the omnibus with the longest tail for regulated firms, and it is easy to read past. Regulation (EU) 2026/1744 replaced Article 75(1) of the AI Act to give the AI Office exclusive competence over two categories: AI systems built on general-purpose AI models where the model and the system come from the same provider or the same undertaking, and AI systems that constitute or are integrated into a very large online platform or search engine designated under Regulation (EU) 2022/2065.

That exclusive competence has four carve-outs, and the third is ours: systems provided by law enforcement authorities, border management authorities and financial institutions, in so far as they fall under Article 74(6). Article 74(6), unamended, provides that for high-risk AI systems placed on the market, put into service or used by financial institutions regulated by Union financial services law, the market surveillance authority is the national authority responsible for the financial supervision of those institutions, in so far as the system is in direct connection with the provision of those financial services. Article 74(7) lets a member state designate a different authority where coordination is ensured.

So the AI Office’s new enforcement machinery — information requests, inspections, binding commitments and fines under the inserted Articles 75a to 75d, with periodic penalty payments capped at 5% of average daily worldwide turnover — is not the channel a supervised financial institution should plan for. The channel is the one it already has.

5. The reliefs financial institutions already hold

The AI Act was drafted to sit on top of financial-services governance rather than beside it, and the omnibus left those provisions alone. For a provider or deployer subject to internal-governance requirements under Union financial services law:

• Article 17(4) — the quality management system obligation is deemed fulfilled by complying with internal governance rules under financial services law, except for Article 17(1) points (g), (h) and (i).
• Article 18(3) and Article 19(2) — technical documentation and automatically generated logs are maintained inside the documentation kept under financial services law (Article 19(1) sets a six-month floor; financial-services retention is usually longer).
• Article 26(5) and 26(6) — for deployers, the monitoring obligation is deemed fulfilled by the internal governance rules, and the deployer’s logs likewise sit in the financial-services documentation.
• Article 9(10) — the risk management system may be part of, or combined with, risk-management procedures established under other Union law.
• Article 72 — for Annex III point 5 systems, post-market monitoring can be integrated into plans already existing under that legislation where protection is equivalent. Commission guidance and a template are due by 2 September 2027.

None of these is automatic: each is conditional on the existing framework actually covering the ground. The deliverable is a mapping document — AI Act requirement, the internal-governance instrument that satisfies it, and the gap. Build it once and the 2027 file is mostly assembled.

6. The two December 2026 dates

First, Article 111(4), newly added: providers of AI systems — including general-purpose AI systems — generating synthetic audio, image, video or text content that were placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026. Article 50(2) requires outputs to be marked in a machine-readable format and detectable as artificially generated or manipulated, exempting systems performing an assistive function for standard editing or not substantially altering the deployer’s input data or its semantics.

Second, the new prohibitions. Article 5(1) gains points (ba) and (bb), prohibiting the placing on the market, putting into service or use of AI systems that generate or manipulate realistic intimate material of an identifiable person without consent, or child sexual abuse material. New Article 5(1a) limits the provider-side prohibition to systems intended for that purpose, or where it is a reasonably foreseeable and reproducible outcome absent adequate safeguards; for deployers it bites only where the system is used for that purpose.

Facts: a payment institution deployed an in-app assistant in 2025 that drafts customer-facing messages, plus a marketing tool that generates campaign imagery. Both wrap third-party general-purpose models.

What the rule says: Article 50(2) is a provider obligation, so the marking duty sits with the model providers, and Article 111(4) gives them until 2 December 2026 for anything placed on the market before 2 August 2026. The deploying firm’s exposure is Article 50(1) — natural persons must be informed they are interacting with an AI system unless that is obvious — plus the deployer disclosure duties in Article 50(4).

What the practitioner does: raises a contractual question, not a build item. Vendor management asks each model provider to confirm Article 50(2) marking status and the date, records it in the third-party file, and separately confirms the in-app assistant carries an unambiguous “you are talking to an AI” indicator.

7. What else moved, and the firms that are not high-risk at all

Three changes lighten the load without moving dates. Article 4 on AI literacy was rewritten: providers and deployers must take measures to support the development of AI literacy of staff and of others operating systems on their behalf, and the article says expressly that this does not require guaranteeing any specific level for any individual. New Article 4a creates a legal basis for processing special categories of personal data for bias detection and correction — extended to deployers of high-risk systems and to providers and deployers of other systems and models — subject to six cumulative conditions, and Article 4a(2) states that it creates no obligation to do bias detection at all. And new Article 2(13) allows requirements in Articles 9 to 15 and 17 to 25 to be limited where Annex I Section A legislation already gives equivalent or higher protection, with delegated acts due by 2 August 2027.

Facts: a Spanish branch of an EU e-money institution uses machine learning only in transaction monitoring and sanctions-alert triage. No credit scoring, no synthetic content, no hiring tools.

What the rule says: transaction monitoring for financial-crime detection is not an Annex III use case, and the point 5(b) creditworthiness entry expressly excludes systems used to detect financial fraud. No high-risk classification, so Chapter III never applies and 2 December 2027 is irrelevant.

What the practitioner does: documents the negative conclusion as rigorously as a positive one — an inventory row per model, the Annex III entries considered, why each is not met — because the Article 4 literacy duty applies regardless of risk class, and a supervisor asking “what AI do you run?” wants the register, not reasoning invented on the spot.

8. FAQ

9. What to do, today

• Compliance officer: build or refresh the AI inventory — one row per model, the Annex III entry considered, the Article 6(3) analysis, the resulting class, negatives included. Article 6(4) makes the “not high-risk” conclusion a documented deliverable.
• Vendor management: ask every general-purpose model provider in the stack to confirm Article 50(2) marking status and date against the 2 December 2026 deadline; file it where the DORA Article 30 contractual clauses already sit.
• Second line: write the mapping document — AI Act requirement, the internal-governance instrument that already satisfies it under Articles 9(10), 17(4), 18(3), 19(2), 26(5), 26(6) and 72, and the gap. That is the 2027 file.
• Supervisory relations: confirm which authority your member state designated under Article 74(6) or (7), and add AI Act market surveillance to the existing contact matrix rather than opening a new one. The amended Article 4 literacy duty applies whether or not you run a high-risk system — calibrate it to role and record what was delivered.

Related: DORA register of information · DORA Article 30 ICT contracts · Sanctions screening at instant-payment speed