Sector
AI literacy training for banks, lenders and insurers.
Credit decisions, fraud checks, complaint handling and customer assistants now ship with AI inside regulated workflows. Under Article 4 you take measures so the staff who use them understand what they do, and credit scoring of individuals sits in the high-risk tier.
Where AI is already in the work
- Creditworthiness and affordability scoring in lending platforms
- Fraud and anti-money-laundering alerts that rank cases for review
- Customer service chatbots and call summarisation
- Document extraction for onboarding and know-your-customer checks
- Drafting customer communications and reports with a general-purpose chatbot
What the AI Act asks of you
Article 4 applies to every organisation whose staff use an AI system at work, and it has applied since 2 February 2025. Supervision and enforcement by national authorities started on 2 August 2026. The duty is to take measures that support the development of AI literacy among your staff and the people using AI on your behalf, calibrated to the tools in use, the people using them and the context. The Commission's Q&A is explicit that no certificate is required and that organisations can keep an internal record of training and guidance.
Annex III point 5 lists AI used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, with an exception for systems used to detect financial fraud. AI used for risk assessment and pricing of natural persons in life and health insurance is listed too. The Digital Omnibus moved the application date for most Annex III obligations to 2 December 2027. Article 4 already applies.
Under Article 111(2), a high-risk system that was already in service before that date is only brought in once its design changes significantly.
In Ireland, the Regulation of Artificial Intelligence Act 2026 makes existing sectoral regulators the market surveillance authorities, coordinated by the AI Office of Ireland. For a regulated financial firm or credit union, that means the regulator you already answer to. Enforcement is proportionate and case by case, and the practical question is what your organisation did and whether you can show it.
Which workshop fits
Smaller firms usually run the half day for all staff and add the full day where lending or complaints teams configure or rely on scoring features. Larger firms with oversight leads tend to take the two day so the policy reaches sign-off.
If you are a credit union, see AI Act training for credit unions.
This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.
Questions from this sector.
Is our lending platform's credit scoring high-risk AI?
If it uses AI to evaluate the creditworthiness of natural persons or establish a credit score, Annex III point 5(b) of the AI Act lists that as high-risk. Systems used to detect financial fraud are excepted. The tool inventory in our workshops maps which of your tools falls where.
Does Article 4 apply if only our customer service team uses a chatbot?
Yes. Using an AI system under your authority in the course of a professional activity makes your organisation a deployer, and the Commission's Q&A confirms that staff using a general-purpose chatbot should be informed about its specific risks, hallucination being the example it gives.
Who enforces the AI Act for a financial firm in Ireland?
The Regulation of Artificial Intelligence Act 2026 gives the role to existing sectoral regulators, coordinated by the AI Office of Ireland, so the answer is the regulator you already deal with. Supervision and enforcement rules have applied since 2 August 2026.
Related insights.
Scope
Does the EU AI Act apply to us if staff only use ChatGPT?
Yes. The European Commission's Q&A says a company whose employees use ChatGPT for tasks like writing or translating must comply with Article 4, and should inform staff about specific risks such as hallucination.
Records
What record should we keep to show we met Article 4?
Keep an internal record of the training and guidance you provided: what was covered, who attended, when, and why that depth suited those roles. The Commission says no certificate is required and that organisations can keep an internal record instead.