How Does the AI Act Apply to Finance, Insurance and Infrastructure?

Why does function matter more than sector?

A bank, an insurer, an energy operator and a public authority can each use AI for many functions, from customer service and document handling to credit decisions, pricing, grid management and benefits assessment, and each function must be tested separately. A customer service chatbot is assessed differently from a credit scoring model, a grid control system is assessed differently from a billing forecast, and a benefits information tool is assessed differently from a system that decides eligibility. The AI Act classifies by intended purpose and listed function, so the record for each system should describe the function, the decision it influences, the people affected and the data used, and should test that function against Article 5, Article 6 and the Annexes. A sector label in a product name or a procurement category does not answer the classification question, and a compliance file organised only by sector will hide the functions that carry the highest duties.

Which Annex III uses matter here?

Annex III point 5 lists, in outline, systems intended to evaluate creditworthiness or establish credit scores, systems for risk assessment and pricing in life and health insurance, systems to evaluate eligibility for essential public assistance benefits and services, systems to allocate essential services including electricity, gas, heating, water and emergency services, and systems to classify emergency calls and dispatch emergency services. Annex III point 2 lists systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating and electricity. Points 6, 7 and 8 list law enforcement, migration, asylum and border control, and administration of justice and democratic processes uses. A system that performs any of those functions is a candidate for high-risk classification, subject to the Article 6 conditions and the profiling limit, and the classification record should cite the point, the function and the evidence for each function performed.

For the broader regulatory framework, see finance, insurance and critical infrastructure.

Which product route matters for infrastructure?

Infrastructure AI can follow two routes that must be tested separately. The Annex III route covers systems used as safety components in the management and operation of critical infrastructure, as listed in point 2, with the Annex III application date of 2 December 2027. The Annex I route covers AI systems that are safety components of products, or are themselves products, covered by the Union harmonisation legislation listed in Annex I, where third-party conformity assessment is required, with the Annex I application date of 2 August 2028. A control system embedded in a regulated product, such as machinery or a vehicle component, follows the Annex I route, while a standalone operational system managing a network follows the Annex III route, and a system can raise both questions where it is both embedded and operational. The route determines the conformity procedure, the registration treatment and the deadline, so the route record should be made before a deadline is assigned or a conformity plan is built.

What is special about sensitive and public sector uses?

Law enforcement, migration, asylum and border control systems in Annex III points 1, 6 and 7 are subject to restricted registration in a secure non-public section of the EU database, with only specified information and limited access, and to specialist supervision involving data protection authorities. Public sector deployers must register their use of Annex III systems, must carry out fundamental-rights impact assessments where Article 27 requires them, and must take steps to comply with the high-risk requirements for systems intended to be used by public authorities by 2 August 2030 under Article 111(2), even where the general transition would otherwise apply. Those special treatments reflect the sensitivity of the uses and the power imbalance between the state and the individual, and they require the deployer to plan for restricted handling, specialist oversight and public accountability from the start. A public sector file that treats a sensitive system like an ordinary commercial deployment will miss the registration, assessment and supervision duties that define it.

What sector law sits alongside the AI Act here?

Financial services law, insurance law, energy and water regulation, transport safety law, public administration law, data protection law and fundamental rights law all sit alongside the AI Act in these sectors, and each imposes duties the AI Act does not replace. A credit scoring system must satisfy financial regulation, consumer credit rules and data protection law as well as the AI Act; an insurance pricing system must satisfy insurance regulation and non-discrimination law; an energy control system must satisfy sector safety and resilience regulation; and a benefits system must satisfy administrative law, including the duty to give reasons and the right to challenge a decision. This cluster gives no dates for sector law, and any sector date must be verified in the sector instrument itself. A combined legal map, naming each regime, provision, owner and evidence, is the practical tool, and it should be built with the sector, legal and data protection owners together, rather than by the AI Act team alone.

Continue with credit scoring and creditworthiness.

What does this guide not decide?

This guide does not decide whether any finance, insurance, infrastructure or public sector system is high-risk, prohibited or subject to a specific duty, and it does not determine what a specific bank, insurer, operator or authority must do. Those questions turn on the system's function, its route, its deployment context and the exact legal wording, applied with sector law and qualified advice to the facts. The guide also does not assess financial soundness, insurance fairness, infrastructure safety or administrative lawfulness, which are sector questions for the competent authorities concerned. Where a system affects access to credit, insurance, essential services, liberty or justice, confirm the classification, registration, assessment and sector position with a competent authority or legal adviser before the system is used.

Frequently asked questions

Continue through this AI Act cluster

• finance, insurance and critical infrastructure
• credit scoring and creditworthiness
• critical infrastructure safety components
• public sector benefits and essential services
• healthcare and biometrics
• high-risk AI systems