Banks deploying high-risk AI agents, such as those assessing the creditworthiness of individuals, must assign human oversight to people with the necessary competence, training and authority under Article 26 of the EU AI Act. In practice that means named, trained staff who can decline or stop the agent, a bank that backs them, and records showing who decided what.
What does Article 26 require of a bank?
Article 26 sets out the obligations of deployers, the organisations that use high-risk AI systems under their own authority. In substance, a deployer must:
- use the system in line with the provider's instructions for use;
- assign human oversight to natural persons who have the necessary competence, training and authority, and give them the support they need;
- make sure input data under its control is relevant and sufficiently representative for the intended purpose;
- monitor the system's operation, inform the provider of risks, and suspend use when a serious risk appears;
- report serious incidents;
- keep the logs the system generates under its control for an appropriate period;
- inform workers' representatives and affected workers before putting a high-risk system into use at work;
- inform people that they are subject to a decision made with a high-risk system, where the Act requires it.
For banks, the Act ties some of these duties, such as monitoring, to the internal governance arrangements banking law already requires, so the evidence often sits in existing frameworks. The basic term is defined in what a deployer is under the EU AI Act, and the split of duties in who is the provider and who is the deployer of an AI agent.
Which banking agents are high-risk?
The Act lists creditworthiness assessment and credit scoring of natural persons as high-risk, with systems used to detect financial fraud excluded from that listing. A bank agent that assesses a personal loan, sets a credit card limit, or scores an overdraft request is high-risk for that purpose. An agent reconciling nostro accounts or drafting internal reports is not. Some bank uses in recruitment and staff management are also treated as high-risk.
Many banks run one agent across several capabilities. A customer servicing agent might read account history at depth 1, draft replies at depth 2, and assemble a credit limit increase request that a person decides. The credit part is high-risk; the rest may not be. Article 26 applies to the high-risk capability, and the competence requirement attaches to the people overseeing that capability.
What does "competence, training and authority" mean in a bank?
Competence is the ability to do the oversight task well, shown on real cases. For a credit agent, that means a reviewer who can read the agent's assessment, see which facts drove it and how strong each fact is, from sealed ledger data to declared income on an application, and recognise the cases where the agent tends to go wrong. Competence is specific to the agent and the capability, not general AI awareness.
Training is how competence is built and kept current. A bank's agents change: their sources, limits and certified depth can all move, and an agent's certificate lapses after 90 days and is renewed against real cases. Staff training must track those changes. A reviewer trained on an earlier version of the agent is not trained on this one.
Authority is the power to act on judgement. A reviewer who can decline a held credit decision but must justify every decline to a sales manager does not have authority in the Act's sense. Authority also means the power to escalate and, for some staff, to suspend the agent.
Support is what the bank gives them: time per case, access to the record, clear escalation paths and protection from pressure.
How does a bank meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Oversight assigned to named people | Each high-risk capability has named overseers and a named owner | Assignment register by capability |
| Necessary competence | Overseers assessed on the bank's own cases before approval rights are granted | Assessment results dated before first approval |
| Necessary training, kept current | Retraining when the agent's sources, limits or depth change | Training records linked to agent change records |
| Necessary authority | Credit policy lets overseers decline or override within mandate without extra sign-off | Policy text; overrides in the record |
| Support | Queue limits, access to the agent's record, escalation paths | Queue metrics; escalation logs |
| Monitoring and suspension | Risk staff trained to read the record in aggregate and suspend use | Monitoring reports; suspension events |
| Logs kept | Append-only record retained under the bank's control | Retention settings; reconstruction tests |
A practice some banks adopt is to make approval rights depend on a current certificate, depth by depth: a reviewer may approve depth 2 drafts with one credential and depth 4 actions only with another, and loses those rights automatically on expiry. The general idea of proof is set out in what evidence of competence is.
What will a supervisor ask?
Banking supervisors, including ECB banking supervision for significant banks, and national market surveillance authorities may both look at this. Expect: list your high-risk agent capabilities and who oversees each. How did you establish their competence, and when? What happens to their approval rights when their credential expires? Show approvals by people whose training predates the agent's last change. How do overseers escalate, and when did anyone last suspend an agent? Who informed the works council, and when?
What does Article 26 not cover?
It does not apply to agents outside the high-risk categories, though the same practice is sensible. It does not set credit policy. It does not specify training content, hours or credentials. It does not move provider duties to the bank, or bank duties to the provider. And it does not replace model risk management, which supervisors apply to credit models in most banking markets. Comparable treatments for other sectors are in Article 26 duties in e-commerce and in healthcare.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
For banks, seats in Pryme Intelligence Academy come with paid Pryme Intelligence plans and include certificates for the people on them, and an admin view shows progress, results, certificates and expiry dates. That gives the bank a live register of who holds which credential, which is the evidence Article 26 assignment needs. Our guide to AI literacy and certification for people who work with agents covers the levels.
Questions people ask
Can a bank rely on the provider's training for its staff?
The bank can use it, but the duty to assign competent people is the bank's. It must judge whether the training fits its own agents, cases and risk appetite.
Does every branch employee need Article 26 training?
Only those who oversee a high-risk capability need the competence Article 26 describes. Everyone dealing with AI needs a baseline of literacy under Article 4.
How quickly should approval rights lapse after a credential expires?
On the day it expires. Tying rights to expiry automatically avoids a gap between what the register says and what the system allows.