Regulation
What does the EU AI Act require?
The obligations for high-risk systems, and why they reach subsidiaries outside Europe.
What it requires
The EU AI Act is Regulation (EU) 2024/1689.
From 2 December 2027 the obligations for high-risk systems apply, credit scoring among them: event logging, human oversight and explanation.
From when
Regulation (EU) 2026/1744, published in July 2026, sets 2 December 2027 as the date from which the high-risk obligations apply to the systems of Annex III.
Outside Europe
A European group’s policies extend them to its subsidiaries outside Europe.
A subsidiary answers to the supervisor of its country, and its parent to the home supervisor and, from 2 December 2027, to the AI Act.
Which industries it bears on
The banking and insurance pages cite it, for groups with a European parent and their subsidiaries.
What a signed record can show
- TodayEvery act is recorded and signed when it happens: who acted, under whose authorization, and when.
- 2027 service · 2028 productWith the verifiable evidence package, as a service in 2027 and as a product in 2028, one signed record will be able to serve both supervisors, instead of two evidence systems, and each will verify it on its own machine.
- From 2028Rebuilding what the system saw at a given moment and explaining it to the people affected.
Dates are projections of the current development plan, not commitments.
This page summarises public rules and is not legal advice.