🏦 AI rules: Banks, insurers, leasing
Credit scoring and life and health insurance pricing are high-risk; the financial sector also has DORA and strict supervisors.
Typical AI uses and their risk level
High risk from 2 Dec 2027; fundamental rights impact assessment; GDPR Art. 22 (CJEU SCHUFA).
High risk; FRIA required.
Explicitly not high-risk under the AI Act — but GDPR and DORA apply.
Must say it is AI; must be accessible (EAA).
Minimal risk; register the provider in the DORA ICT register.
What to do
- Inventory models used in credit and underwriting decisions.
- Prepare FRIA and DPIA templates; build explanation capability for customers.
- Add AI cloud services to the DORA register of information with exit plans.
- Align model risk management with AI Act requirements (data, logs, oversight).
Common pitfalls
- Assuming a vendor’s CE marking covers your use — the deployer duties remain yours.
- Using alternative data (social media, phone data) in scoring — high risk of discrimination and GDPR problems.
Examples
The leasing company is the deployer: human review of rejections, logs, informing customers, FRIA — from Dec 2027; explanation rights under GDPR already now.
Rules that apply
Applies to anyone who develops AI (provider), uses AI in their business (deployer), imports or distributes it in the EU — also to companies outside the EU if the output is used in the EU. Private, non-professional use is excluded.
In forceGDPRFor most companies GDPR matters more than the AI Act: it decides whether you may put customer or employee data into an AI tool at all. In Slovenia it is supplemented by ZVOP-2 and supervised by the Information Commissioner.
In forceDORAAI services from cloud providers are ICT third-party services: they belong in the register of information, need contract clauses and an exit strategy.
In forceEuropean Accessibility ActIf a chatbot or voice assistant is the way customers reach your service, it must also be accessible (e.g. usable with a screen reader, with a text alternative to voice). AI can help — automatic image descriptions, captions — but results must be checked.
In forceConsumer Protection Act (ZVPot-1)What your chatbot promises binds you. AI-personalised prices must be disclosed in online sales, and AI-generated fake reviews are a banned practice.
General information, not legal advice — consult a lawyer for borderline cases. Regulations reviewed on 29 Sep 2026.