What Sector Guidance and Standards Apply to Finance and Infrastructure AI?

What is fixed, and what is guidance?

Fixed law is the consolidated Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, together with the sector legislation that applies to the system, such as financial services, insurance, energy, transport and public administration law. Guidance is the material that interprets that law: Commission guidelines on scope and classification, AI Office guidance on general-purpose AI and enforcement, Board opinions on consistent application, and sector regulator guidance on how the Act interacts with sector duties. Guidance should be cited with its issuing body, date and status, and draft guidance should be labelled as draft. A team that treats guidance as law will overstate its position where guidance is later changed, and a team that ignores guidance will miss the interpretation an authority is likely to apply. The record should therefore keep the legal text and the guidance side by side, with the provision, the guidance paragraph and the date each was checked, so a later change to either can be traced to the decisions that relied on it.

How do harmonised standards work for high-risk systems?

Harmonised standards, developed by European standardisation organisations under a Commission standardisation request, can give a presumption of conformity with the corresponding Chapter III requirements where the standard has been cited in the Official Journal and is applied within its scope and subject to the conditions in Article 40. Until a standard is cited, it is pipeline material: a draft, a published standard awaiting citation, or a standardisation request should be labelled EXPECTED with its stage and date, and should not be described as a compliance route already available. A team should record the standard, the body, the subject, the stage and the date checked, and should test the design against the draft requirements while keeping the Act's requirements as the fixed baseline. Where a standard is cited, the conformity file should cite the citation, the version and the scope, and should show how each requirement is met by the standard or by other means. No counts of published or cited standards are given in this guide, since such counts change and must be verified in the Official Journal at the time of reliance.

For the broader regulatory framework, see finance, insurance and critical infrastructure.

What sector standards and regulator guidance matter?

Sector standards and regulator guidance matter because they set the technical and operational expectations that the AI Act's requirements are applied within. In finance, that includes supervisory guidance on outsourcing, operational resilience, model risk and governance from the European supervisory authorities and national regulators. In insurance, it includes supervisory guidance on pricing, underwriting and governance. In energy, water and transport, it includes sector safety, resilience and cybersecurity standards and regulator guidance on operational technology. In the public sector, it includes administrative guidance on decision-making, transparency and digital services. Each item should be labelled by its source, whether it is binding, guidance or a voluntary standard, its date and its scope, and the team should record which items were relied on for which decision. A sector standard that is voluntary in one Member State can be effectively mandatory in another through regulation or procurement, and the national position should be checked rather than assumed.

How should codes of practice be used?

Codes of practice, particularly for general-purpose AI models, are voluntary instruments that can help a provider demonstrate compliance with Chapter V obligations, and adherence to an applicable code can be taken into account in enforcement, but a code is not the law and does not replace the obligations in the Regulation. A provider should track the code's status, cite the version relied on, and update its position when a final code replaces a draft. Sector codes and industry codes should be treated the same way: useful as implementation material, citable as evidence of good practice, but not a substitute for the legal requirements or for sector regulation. A team should not describe code adherence as a safe harbour, and should not rely on a code that has been superseded without checking the current version. The code, the guidance and the legal text should be kept together in the file, with the status of each labelled, so a reviewer can see what was law, what was guidance and what was voluntary practice at the time of the decision.

How should expected change be tracked?

Expected change should be tracked as a watch list, separate from the fixed-law baseline, with each item labelled EXPECTED, named by source, described by stage and dated. The watch list should include further simplification proposals beyond Regulation (EU) 2026/1744, harmonised standards in development, Commission guidance in preparation, sector standards under revision and national implementation measures not yet adopted. Each item should carry a review trigger: a publication, a citation, an adoption or a system change that would make the item relevant. When an expected item becomes fixed, the record should be updated with the enacted text, the date and the systems reassessed, preserving the earlier position rather than overwriting it. When an expected item is abandoned or amended, the watch list should record that outcome and the decisions that were based on the earlier expectation. A watch list without dates, sources or triggers cannot support a planning decision, and expected material should never be filed in the fixed-law section of the record.

Continue with what AI Act changes are expected and what is already fixed.

What does this guide not decide?

This guide does not state which standards, guidance or codes apply to any specific system, does not give readiness ratings or counts for standards or notified bodies, and does not predict what any future guidance, standard or proposal will say. Those matters must be checked in the primary source concerned, on the date of reliance, with the citation, version and scope recorded. The guide also does not cover the designation of notified bodies, which is addressed in the conformity assessment cluster, and it does not describe any Member State's sector guidance in detail. Where a standard, guidance or code is relied on for a conformity, release or contract decision, confirm its current status in the Official Journal or the issuing body's publication, with a competent authority or legal adviser, before relying on it.

Frequently asked questions

Continue through this AI Act cluster

• finance, insurance and critical infrastructure
• what AI Act changes are expected and what is already fixed
• codes, standards, sandboxes and innovation support
• conformity assessment and CE marking
• critical infrastructure safety components
• EU AI Act overview