A fintech that runs AI agents in the EU usually has a short list of duties under the EU AI Act, plus one long one if it lends to individuals. Every agent needs trained staff and clear AI disclosure to customers. An agent that assesses a person's creditworthiness is high-risk, which adds oversight, logs, monitoring and an impact assessment.
What does the Act require, in plain words?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases; prohibitions applied from 2 February 2025. It sorts AI by risk. If you need the background, read what the EU AI Act is first.
For a fintech the duties fall into four bands:
- Everyone: Article 4 requires staff who work with AI systems to have sufficient AI literacy.
- Customer-facing agents: Article 50 requires that people know when they are interacting with an AI system.
- High-risk uses: Annex III lists credit scoring and creditworthiness assessment of natural persons, and life and health insurance risk assessment and pricing. Deployers must follow Article 26 and, for credit scoring, carry out a fundamental rights impact assessment under Article 27.
- Prohibited practices: manipulation that bypasses a person's judgement, or exploiting vulnerabilities such as financial hardship. A growth team designing an onboarding or upsell agent needs to know where this line sits.
Who counts as a provider, and why does it matter for a fintech?
Fintechs build. That is the trap. A bank buying a credit agent is usually a deployer. A fintech that assembles its own credit agent from a model provider's model and its own prompts and tools is likely the provider of that system, with the full set of provider duties: risk management (Article 9), data governance (Article 10), logs (Article 12), information for deployers (Article 13), oversight by design (Article 14), and accuracy and cybersecurity (Article 15).
Our explainer on what a provider is under the EU AI Act covers the test. The short version for a fintech: if you put the system into service under your own name, or substantially modify someone else's, assume provider duties until counsel tells you otherwise. A model provider's general-purpose obligations do not cover the system you built on top of their model.
What does it mean when the system is an agent that acts?
Agents do more than score. They pull data through open banking connections, write to customers, change limits and initiate payments. The Act's high-risk list is about the purpose, so an agent that does five things may be high-risk for one of them. We look at the wider issue in the EU AI Act and agents that act.
For a small team, the practical move is to split capabilities. Put creditworthiness assessment in its own narrowly scoped agent or capability, keep it at depth 2 so a person decides, and govern that piece to the high-risk standard. Leave the support agent, the document chaser and the payment scheduler outside that perimeter. Proportion comes from narrowing what is high-risk, not from doing less on it.
How can a small team meet the duties?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Know your role and risk class | One-page register: each agent, each capability, provider or deployer, risk class | Register with owner and review date |
| AI literacy | Short role-based training: builders, overseers, support staff | Completion records by role |
| Transparency | AI disclosure at the start of every agent conversation | Screenshot or transcript evidence per channel |
| Risk management and data governance (if provider) | Documented risks and sources for the credit capability | Risk file and source list, versioned |
| Logs | Append-only record of every action and verdict | Retained logs that reconstruct a case |
| Human oversight | Credit recommendations held for a named, trained person | Approval records with reviewer identity |
| Accuracy | Replay against your own past applications before launch and after each change | Test results with pass floors |
| Impact assessment (credit scoring deployers) | Fundamental rights impact assessment before first use | Signed assessment |
Three habits keep this proportionate. Reuse one template for every agent's register entry. Generate evidence from the system's own records rather than writing it by hand. And review the register when you ship a new capability, not on a calendar nobody keeps.
Being small does not change the classification. Our guide for SMEs deploying agents notes where the Act eases the burden, mainly in support and in how documentation may be provided, not in what a high-risk system must do.
What will a supervisor or partner bank ask?
Fintechs often meet the Act first through due diligence from a partner bank or investor, before any supervisor:
- Which of your agents are high-risk, and are you the provider?
- Show us the technical documentation and logs for the credit agent.
- Who oversees credit recommendations, and what does an override look like?
- How do customers know they are talking to an AI system?
- What happens when the model provider changes its model?
- What did your last pre-release test show?
What does the Act not cover?
The Act does not license you to lend, pay or hold funds; that remains with payment, e-money and credit authorisation. It does not replace GDPR, which governs the data your agents read and, under Article 22, solely automated decisions. It does not cover ICT resilience, which DORA addresses for in-scope financial entities. And it does not settle consumer credit rules on explanations and affordability. Banks working with you will apply their own expectations too; see the EU AI Act for banks deploying agents. For permitted bank activities more widely, see our guide to AI agents in banking.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme lets a fintech split an agent's capabilities and set depth for each, so the credit capability can be held for a person while support and document work run on their own. Attest certifies each agent against your own cases and the verdict record serves as the log a supervisor or partner bank asks for. Certificates lapse after 90 days, which keeps re-testing on schedule.
Questions people ask
Is a fintech that uses a model provider's model a provider under the Act?
Often yes, for the system it builds on that model. The model provider has its own general-purpose model duties, but the credit or service system you assemble and launch is yours.
Do buy-now-pay-later checks count as credit scoring?
If the agent evaluates whether an individual can repay, it is creditworthiness assessment and falls within the high-risk listing, whatever the product is called.
Can a fintech meet the high-risk duties without a compliance team?
It needs at least one accountable owner and a working register. Most evidence can be produced by the platform itself, but someone must read it and sign it.