Data, AI & privacy.
AI and data use at financial institutions face increasing supervision. Since 2 August 2026 the AI Act’s transparency obligations apply; the high-risk obligations were moved by the Digital Omnibus (Regulation (EU) 2026/1744) to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). In parallel, the AFM focuses on AI governance and the Dutch Data Protection Authority on the right to explanation for automated decisions under the GDPR.
Status · last updated 7 October 2026.
What we do for you.
Three ways we help you with data, AI and privacy.
Processing register, legal bases, DPIAs, processor agreements and data-breach procedure for financial institutions.
Which AI applications fall under the AI Act, which obligations apply and how to embed them in your governance.
Support with questions from the Dutch DPA, DNB or AFM on data and AI, and with handling a data breach.
Frequently asked questions.
What does the AFM expect regarding AI governance?
From the AFM AI study of 323 institutions: 53% use AI, but 89% have no policy for AI agents and 54% no AI ethics code. Governance and policy are the biggest gaps.
What is the right to explanation for automated decisions?
The Dutch DPA published draft guidance: for (partly) automated decisions, data subjects must receive a meaningful explanation. This affects algorithmic credit and acceptance decisions.
What does this mean for financial institutions?
Document your AI models and decision-making, establish AI policy and an ethics code, and ensure explainability and human review of automated decisions.
Which AI Act obligations have applied since 2 August 2026?
Since 2 August 2026 the transparency obligations of Article 50 AI Act apply: chatbots must identify themselves as AI, AI-generated or AI-manipulated content must carry machine-readable marking, and anyone deploying emotion recognition or biometric categorisation must inform the people involved. Breaches carry fines of up to €15 million or 3% of global annual turnover. The broader governance and penalty framework is also operational as of that date.
Has the AI Act been postponed?
Partially. The Digital Omnibus on AI — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026 — postpones the high-risk obligations: for stand-alone Annex III systems from 2 August 2026 to 2 December 2027, and for product-embedded Annex I systems to 2 August 2028. The reason is the delay of the harmonised standards that must underpin the compliance route. The prohibited practices (February 2025), the GPAI rules (August 2025) and the transparency obligations (2 August 2026) apply in full.
Is credit scoring or AI onboarding a high-risk application?
Creditworthiness assessment of natural persons, and risk assessment and pricing in life and health insurance, are listed in Annex III and therefore qualify as high-risk. The associated obligations — risk management, data quality, logging, human oversight, conformity assessment — apply from 2 December 2027 under the Digital Omnibus, but require an implementation programme that should start now.
How does the GDPR relate to the AI Act?
The AI Act does not replace the GDPR; both apply in parallel. Automated decision-making remains governed by Article 22 GDPR, including the right to explanation as interpreted by the Dutch Data Protection Authority, and AI applications processing personal data will usually require a DPIA. A system can be AI Act-compliant and still unlawful under the GDPR — the two tests are independent.
Who supervises the AI Act for financial institutions?
Market surveillance is allocated per Member State through national implementing legislation; for the financial sector DNB and the AFM are positioned as the sectoral supervisors, in line with their existing mandates. At EU level the AI Office supervises general-purpose AI models. The AFM has already published supervisory expectations on AI governance within its conduct mandate.
What should an AI inventory contain?
A workable AI register records, per system: purpose and operation, the institution’s role (provider or deployer), the AI Act risk classification, the (personal) data processed, the degree of human oversight and the vendors involved. That inventory is the starting point of every gap analysis and determines which set of obligations applies per system.
What is AI literacy and does that obligation already apply?
Yes. Article 4 AI Act has required since 2 February 2025 that staff working with AI systems have an appropriate level of AI literacy — proportionate to their role, the context and the systems involved. For financial institutions this means demonstrable training of the first line, compliance and the board.
How should a payment institution or fintech prepare towards 2027?
Four steps: inventory all AI applications and classify them; comply now with the transparency obligations that have applied since 2 August 2026; build a roadmap towards 2 December 2027 for high-risk applications covering risk management, data quality and human oversight; and put vendor clauses and DPIA/FRIA processes in place. Waiting for the final standards means running out of time in 2027.
What is the status of the Dutch AI Act implementation act?
The public consultation on the Dutch act implementing the AI Act ran from 20 April to 1 June 2026 (30 responses). As at 7 October 2026 the bill had not yet been submitted to the House of Representatives. Until then the obligations of the AI Act apply directly; the allocation of supervision between the AP, AFM and DNB will be laid down in the implementing act.
Which guidelines apply to the transparency obligations?
On 20 July 2026 the European Commission published guidelines on the transparency obligations for providers and deployers of AI systems (Article 50) and started enforcement on 2 August 2026. On 17 September 2026 the EDPB adopted draft guidelines on the power to impose fines under the GDPR; comments are possible until 13 November 2026.