Payment firms are deployers of high-risk AI systems under the EU AI Act only where an agent does something the Act lists, chiefly assessing an individual's creditworthiness. Most payment execution and fraud agents fall outside. Where Article 26 applies, the firm must give oversight to people with competence, training and authority, and should hold everyone else to that practice.
What does Article 26 require?
In substance, a deployer of a high-risk system must use it according to the provider's instructions; assign human oversight to natural persons with the necessary competence, training and authority, and support them; ensure input data under its control is relevant and sufficiently representative; monitor operation, inform the provider of risks and suspend use if a serious risk appears; report serious incidents; keep logs under its control for an appropriate period; inform workers' representatives before using the system at work; and inform people subject to its decisions where required.
The role itself is defined in what a deployer is under the EU AI Act.
Where do payment firms meet the high-risk list?
Most payments work is outside it. Executing transfers, reconciling accounts, screening for fraud and handling disputes are not high-risk uses. The Act's listing for credit scoring expressly does not extend to systems used to detect financial fraud.
Payment firms cross the line in three common ways:
- Credit features. An overdraft on an e-money account, a buy-now-pay-later product, or a merchant cash advance to a sole trader involves assessing an individual's creditworthiness.
- Merchant onboarding of individuals. Where onboarding a sole trader includes a credit assessment for settlement terms or reserves, that part may be in scope.
- Workforce. Recruitment and performance management agents for the firm's own staff fall within the high-risk workforce uses.
Payment firms working with online retailers should also know where the retailer's duties end and theirs begin, a question explored in Article 26 duties in e-commerce.
What competence does a payment firm need where Article 26 applies?
Credit reviewers for overdraft or instalment products need to read the agent's assessment and the facts behind it, separating sealed transaction history on the firm's own ledger from declared income and external documents. They must be able to decline or approve against the agent within mandate and to give specific reasons.
Risk analysts need to monitor outcomes by segment and suspend automatic approvals when they drift.
Hiring and people managers overseeing workforce agents need the skills set out for HR: spotting proxy criteria, reading provenance of candidate claims, and overriding rankings.
Every one of them must understand that the agent's certificate lapses after 90 days and that a run that clears no depth drops it to depth 1 the same day. In a payments business running at volume, that means manual review capacity must exist before the day it is needed.
Why apply the same discipline to agents that are not high-risk?
Because the costs of a payment mistake do not wait for a legal category. A payment agent that releases funds at depth 4 to a payee whose details changed by email does more immediate harm than many high-risk systems. On a governed platform, an external claim cannot authorise a payment, payee changes are held for a named person, and reversing a settled payment on the platform's own rail is withheld for every agent at every depth. The people deciding held payments need the same competence, training and authority Article 26 describes, even though the article does not bind them.
This also answers a question payments staff ask often: who answers for an agent's mistake? The answer, covered in whether payments operations staff are accountable for an AI agent's mistakes, depends on what they were trained to check and what the record shows they saw.
How does a payment firm meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify high-risk uses | Inventory of agent capabilities with high-risk ones marked and reasoned | Inventory with owner sign-off |
| Oversight assigned to named people | Named credit reviewers and owners for credit capabilities | Assignment register |
| Necessary competence | Assessment on the firm's own cases before approval rights | Assessment records |
| Necessary authority | Reviewers may override within mandate without extra sign-off | Mandates; override records |
| Training kept current | Briefing at each agent recertification or change | Briefing records linked to agent changes |
| Monitor and suspend | Analysts suspend automatic approvals on drift | Suspension events |
| Same practice for held payments | Payment approvers trained and credentialed like credit reviewers | Approvals matched to credentials |
The idea of proof behind the table is set out in what evidence of competence is.
What will a supervisor ask?
Payment supervisors and market surveillance authorities may ask: which of your agents are high-risk, and how did you decide? For credit features, who decides held applications and how were they assessed? How do you treat fraud screening agents, and why are they outside the high-risk listing? For payment approvals, who can release a held payment, and what training did they have? Show a payee change and where the instruction came from. Supervisors applying DORA will add questions on staff training for ICT incidents involving agents.
What does Article 26 not cover?
It does not apply to most payment agents. It does not set payment rules, authentication requirements or fraud liability; PSD2, the Instant Payments Regulation and scheme rules do. It does not prescribe training content. It does not relieve the firm of DORA's ICT risk duties. Comparable duties in banking are covered in Article 26 duties in banking.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
A payment firm can make approval rights depend on a current certificate, depth by depth. Pryme Intelligence Academy's Certified Pryme Operator credential suits that practice: it is valid for 12 months, renewed through an update module and a short quiz, and a lapsed or revoked certificate shows as such on its VerifyDoc.ai page. Our guide to AI literacy and certification for people who work with agents explains the levels.
Questions people ask
Is a fraud screening agent high-risk under the Act?
The credit scoring listing does not extend to systems used to detect financial fraud, so a fraud screening agent is generally not high-risk on that basis. Other duties, such as data protection, still apply.
Does an overdraft on an e-money account count?
If the agent assesses whether an individual can repay, it is a creditworthiness assessment and falls within the high-risk listing for that purpose.
Should payment approvers hold the same credential as credit reviewers?
Not necessarily the same, but an equivalent one matched to their work. What matters is that each approver's competence is assessed on the actions they approve, and that the credential expires.