What must our finance department do under the EU AI Act since August 2026?
Since 2 August 2026 most of the EU AI Act applies, and it reaches every finance department in which one employee uses a chat tool with company figures. The duties are manageable: know what is in use, train the users, document the use, check the labelling. This page names deadlines, duties and five steps; it is not legal advice.
What applies since when?
Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in stages. Four dates matter for the finance department, and two of them have already passed. The table lists them with the duty each one brings. The Digital Omnibus, adopted by the Council on 30 June 2026, postponed the high-risk duties; the other deadlines stand.
| Date | What applies | What it means for the finance department |
|---|---|---|
| 2 February 2025 | Art. 4 AI literacy; Art. 5 prohibited practices | Anyone deploying AI systems must ensure the users have sufficient AI literacy. This has applied for over a year and a half. |
| 2 August 2025 | Duties for providers of general-purpose AI models | Concerns the model makers, not the finance department as a user |
| 2 August 2026 | Most remaining provisions apply: Art. 50 transparency, supervision, fines | Breaches can now be sanctioned; labelling duties for AI-generated content that leaves the company |
| 2 December 2026 | End of the transition period for Art. 50(2) for systems already placed on the market | Machine-readable marking by the provider; for the finance department a point to check with the tool vendor |
| 2 December 2027 | High-risk systems under Annex III (postponed from 2 August 2026) | Relevant only if the finance department operates a high-risk system, for instance credit scoring of natural persons |
| 2 August 2028 | High-risk systems in products under Annex I | Normally without relevance for finance |
So two dates are behind you. The AI literacy duty has applied since February 2025, the sanctions since August 2026. A company that starts its inventory today is catching up on an existing duty. That is a reason to make the plan this week. The five steps below are enough for companies with revenue of 4 to 100 million euros.
What role does the finance department have under the regulation?
The regulation distinguishes providers, who develop an AI system or place it on the market under their own name, from deployers, who use it under their own authority. A finance department that uses a chat tool, invoice recognition or a forecasting tool is a deployer. The deployer's duties depend on the risk class of the system.
| Tool in the finance department | Risk class in the normal case | Deployer's duty |
|---|---|---|
| Chat assistant for texts, analyses, formulas | Not high-risk; transparency duty if outputs leave the company | AI literacy of the users (Art. 4); labelling under Art. 50 where applicable; data protection under GDPR |
| Invoice recognition, account coding proposal, reconciliation | Not high-risk | AI literacy of the users; procedural documentation under GoBD, independent of the regulation |
| Forecasting and planning tool | Not high-risk | AI literacy of the users; the assumptions stay traceable with a person |
| Creditworthiness assessment of natural persons (credit scoring) | High-risk under Annex III No. 5 (b) | Deployer duties under Art. 26 from 2 December 2027: follow the provider's instructions, human oversight, keep logs, inform the persons affected |
For most mid-sized finance departments this leaves three duties: AI literacy, transparency, data protection. The high-risk rules apply only once you hand decisions about individual people to a system. Assessing corporate customers usually does not fall under them; scoring private customers should be assessed by a specialist lawyer.
What must the finance department do in concrete terms?
Four duties that any finance department can meet without a lawyer in the building. The first is the precondition for the other three: a department that does not know which tools are in use can neither train nor label nor document. In most companies the list is longer than management assumes.
Inventory: every AI tool in official and unofficial use, with user, purpose, type of data and vendor. The unofficial tool is the decisive one, because that is where company figures end up in public chat windows. The list is at the same time the basis for the data protection officer and for the procedural documentation under GoBD.
AI literacy under Art. 4: the users must understand what the tool can do, what it cannot do and which data may go in. A training session with participants, date and content, documented and repeated when new tools arrive. The regulation prescribes no format; it requires that you can produce the evidence when someone asks.
Transparency under Art. 50: where AI-generated texts, images or chat answers leave the company, this must be recognisable. Whether an investor report prepared with a tool falls under this is a question this page does not answer; a specialist lawyer settles it for your case. Internal analyses are usually not affected.
Data protection and documentation: the GDPR applies alongside the regulation, with a data processing agreement, hosting in the EU and training use excluded. And every automated figure stays traceable, because GoBD and the auditor demand it, with or without the AI Act. Both are set out under Where does your data stay?.
What happens if you do nothing?
Art. 99 has three tiers: up to 35 million euros or 7 % of worldwide annual turnover for prohibited practices, up to 15 million euros or 3 % for breaches of the other duties, including transparency, and up to 7.5 million euros or 1 % for incorrect information given to authorities. For small and medium-sized enterprises the lower amount applies.
The larger risk for a mid-sized finance department comes before any fine: company figures in a public chat tool, without a contract, without control over where they end up. That is a data protection breach and a confidentiality problem towards bank, investors and customers, long before a supervisory authority asks. The inventory ends that.
Supervision in Germany is still in the legislative process. The government bill of February 2026 names the Federal Office for Information Security (BSI) as market surveillance authority; the parliamentary procedure was not completed as of the date of this page. Whether and when authorities will audit mid-sized companies is open. The duties apply regardless.
How does the finance department get started?
Five steps that fit into 2 to 3 days and are part of the inventory in AI automation in finance. They apply whether or not you want to automate anything afterwards. The order is the order of dependency: no rule without the list, no training without the rule.
- Create the tool list: every tool with user, purpose, type of data, vendor and contract. Without the list there is no training, no labelling and no evidence.
- Set the rule: no company data in public chat tools; one company platform with a data processing agreement, EU hosting and training use excluded. The rule applies from the day it is written.
- Run and document the Art. 4 training: participants, date, content, repeated for new tools. Two hours with the company's real tools are worth more than a day of basics.
- Check the labelling: which AI-generated content leaves the company, and how is it labelled? Ask the tool vendor whether the machine-readable marking under Art. 50(2) will be in place by 2 December 2026.
- Set reminders: 2 December 2026 for the labelling, 2 December 2027 in case a high-risk system is added, and every new tool as the occasion to extend the list.
Not legal advice
This page is not legal advice. It summarises what a finance lead needs to know to ask the right questions and take the first steps. Whether a system is high-risk and which content must be labelled is for a specialist lawyer. The legal status is the date above; changes to the regulation or the German act will be added.
Frequent questions about the AI Act in the finance department
Does the regulation apply if only one employee uses a chat tool?
Yes. Art. 4 requires AI literacy for all persons who use AI systems on behalf of the company, regardless of whether management knows about the use. The single employee with a private chat account is therefore the most frequent case the inventory uncovers, and the first one the rule ends.
Is our invoice recognition a high-risk system?
Usually not. For finance, Annex III mainly lists the creditworthiness assessment of natural persons and risk assessment in life and health insurance. Invoice recognition, account coding, reconciliation and forecasting do not fall under it, because they take no decision about individual people. The final classification of your specific tool is for a specialist lawyer.
What must the Art. 4 training contain?
The regulation prescribes no curriculum. Four contents make sense: how the tool works and where it makes mistakes, which data may go in and which may not, how outputs are checked before they enter a posting or a report, and who in the company decides in case of doubt. Documented with participants and date.
Who supervises this in Germany?
As of the date of this page this is not finally settled. The government bill of February 2026 names the Federal Office for Information Security as the central market surveillance authority. Until the act is passed, the data protection officer remains the first contact in the company, because the GDPR applies in any case.
- Regulation (EU) 2024/1689 (AI Act): Art. 3 (definitions of provider and deployer), Art. 4 (AI literacy), Art. 5 (prohibited practices), Art. 26 (obligations of deployers of high-risk systems), Art. 50 (transparency obligations), Art. 99 (penalties), Art. 113 (entry into application), Annex III No. 5.
- Digital Omnibus on the AI Act: adopted by the Council of the EU on 30 June 2026; postponement of the high-risk duties under Annex III to 2 December 2027 and under Annex I to 2 August 2028; transition period for Art. 50(2) until 2 December 2026.
- German government bill on the implementation of the AI Act, February 2026: Federal Office for Information Security as market surveillance authority; parliamentary procedure not completed as of the date of this page.
- Guide AI in finance: what really works and what does not, section on the AI Act.
Do you know which AI tools are running in your finance department?
30-minute initial call, no obligation. You tell me which tools you know of, I tell you how the inventory runs in 2 to 3 days and what comes after. Reply within 24 hours.
Request an initial call