--- title: "What the EU AI Act actually asks of a finance model" url: "https://obserbi.com/blog/eu-ai-act-finance-models" description: "Most controlling models are not high-risk under the EU AI Act — but the documentation, logging and human-oversight habits it expects are worth adopting anyway." --- # What the EU AI Act actually asks of a finance model August 12, 2026·3 min read·ObserBI Most AI used in financial controlling is not high-risk under the EU AI Act — and finance teams keep assuming the opposite. The regulation classifies by _use case_, not by how important the department feels, and internal forecasting, variance analysis and cash projection generally fall outside Annex III. What does apply is a set of expectations about documentation, logging and human oversight that a serious finance function should want in place regardless. _This is an engineering summary, not legal advice. Verify the current text and timeline with counsel before making decisions — the implementation schedule has been the subject of amendment proposals since the regulation entered into force._ ## What the Act classifies as high-risk in a finance context Annex III lists the uses that trigger the heavy obligations. Two are close to finance: - **Creditworthiness assessment of natural persons** — scoring individuals for credit, with a carve-out for detecting financial fraud. - **Risk assessment and pricing in life and health insurance** for natural persons. Neither describes a controlling agent that forecasts your own company’s cash position. The subject of the assessment is what matters: your own P&L is not a natural person. The trap sits elsewhere. Annex III also covers **employment** uses — recruitment, task allocation, monitoring and evaluation of workers. A “CFO agent” that scores employee productivity, ranks people for a restructuring or allocates work based on utilisation has walked into a high-risk category through a side door, even though the team building it thought they were doing controlling. ## The obligations that apply to everyone Two things apply regardless of risk tier and are easy to overlook. **AI literacy.** Organisations deploying AI systems are expected to ensure that the people operating them have a sufficient level of understanding — enough to interpret output and recognise when it is wrong. For a finance team this is not a training-video problem; it means the controller using the forecast should be able to say what the model was given and where it tends to fail. **Transparency about machine-generated content.** Where output is generated or manipulated by AI and could be mistaken for human-authored material, it should be identifiable as such. A board memo assembled by a model belongs in that category. ## Why build to the high-risk standard anyway The high-risk requirements read like a description of a well-run analytical system: risk management across the lifecycle, data governance covering the training and input data, technical documentation, automatic logging of events, instructions for the deployer, meaningful human oversight, and appropriate accuracy, robustness and cybersecurity. Strip the legal framing and every one of those is something a CFO should already demand before trusting a number in a board pack. If the model revises a forecast, you want to know which input moved. If it flags a customer, you want the evidence. If it is wrong, you want to find out from your own logs rather than from the auditor. There is also a practical argument: classification can change. A system that starts as internal forecasting acquires a supplier-scoring feature, then a customer-scoring feature, and one of those eventually touches a natural person. Retrofitting logging and documentation into a system that was never designed to produce them is far more expensive than having built it that way. ## A minimum bar for a controlling model If you are evaluating or building one, the checklist is short: - **Input lineage.** Every number traceable to a source system, table and timestamp. - **Decision logs.** Not just the output, but the inputs and the version of the model that produced it — retained long enough to survive an audit cycle. - **Explained revisions.** When a forecast changes, the system names the driver. - **Named human oversight.** A person who owns each class of recommendation and can override it, with the override recorded. - **Deployment locality.** Knowing which jurisdiction the inference happened in, because the moment personal data enters the picture, that question stops being academic. The teams that will handle the next regulatory turn comfortably are the ones already generating this evidence as a by-product of running the system — not the ones planning a compliance project for the quarter before an audit. - EU AI Act - governance - controlling - audit ## Keep reading - [The autonomous CFO is not a dashboard](https://obserbi.com/blog/autonomous-cfo-is-not-a-dashboard) - [Why financial data should never leave the building](https://obserbi.com/blog/local-llm-controlling-sovereign-finance)