In July 2026 ESMA fined Moody’s Germany EUR 2,145,000 for misreporting under MiFID II[1]. It wasn’t fraud. It was data errors in a reporting process, and they went on until the regulator found them. That kind of quiet, systematic failure is what keeps compliance officers up at night, and it’s the kind of risk that grows when AI-assisted workflows sit between a firm’s data and its regulatory submissions.
The EU AI Act’s obligations for high-risk AI systems are coming into application alongside that sort of enforcement. If your firm uses AI to inform, draft, route or flag decisions in client-facing or compliance processes, you need to know which of those rules reach you and which don’t.
What the EU AI Act requires for high-risk AI in financial services
The EU AI Act lists certain financial uses of AI as high-risk, most directly assessing the creditworthiness of individuals and pricing life and health insurance[2]. High-risk status brings concrete duties: human oversight, a documented risk management system, data governance, and logging of outputs good enough to audit after the event.
Many advice-firm uses, such as AI helping with suitability drafting or AML screening, won’t fall squarely into those listed categories. That doesn’t make them a black box you can ignore. The FCA, SM&CR and your own audit trail ask the same questions: what did the system do, why, and who reviewed its output before it affected a regulated decision. The opacity of many AI systems is exactly what regulators are pushing back on, because it makes that explanation impossible[3].
Neither regime is asking you to keep AI out of these processes. Both are asking you to govern it.
Financial services has the highest AI deployment and the most exposure
Financial services adopted AI faster than most sectors. One engineering blog’s tracking puts production deployment of AI agents in financial services at 21 per cent, the highest of any industry, mainly from early work on document processing and compliance automation[4]. That’s commercially sensible. AI can cut document handling time a long way: OpenAI’s case study on NTT Data describes one process going from 30 minutes to almost instant[5].
The same adoption brings regulatory exposure. Whatever went wrong at Moody’s, the principle it illustrates is simple: what an automated system produces is still your firm’s output. Regulators don’t accept “the system did it”. They look for a named person who’s accountable, and under SM&CR that’s a named senior manager.
The question is not whether AI makes your decisions faster. It is whether you can explain those decisions to a regulator, and who signs their name to that explanation.
The ECB has flagged real discrimination risk in customer-facing AI that hasn’t been properly validated[6]. BaFin has identified AI-driven financial data processes as a source of systemic cyber risk[7]. The direction is clear: these bodies are watching the gap between what firms say their AI does and what it does.
The glass box approach to AI governance
The glass box approach, as a16z describes it, means every model decision can be seen, tested and changed by a member of staff before it produces a regulated output[3]. It’s a process design requirement before it’s a technology one.
In practice it comes down to three things.
Map every AI-assisted process that touches a regulated output. It doesn’t have to be a formal project, but it has to be honest. Walk through how your firm handles suitability letters, onboarding, AML checks and regulatory reporting, and at each stage note where an AI system flags, sorts, drafts or recommends. That map is the starting point for any AI Act or FCA conversation.
Define and write down the human review step for each one. The AI flags a transaction as possibly suspicious. Who sees the flag? What do they decide? What gets logged? “It goes into a queue and someone looks at it eventually” isn’t governance. Governance is a named person, a defined decision and a record, and under SM&CR that person carries the accountability.
Check your vendor agreements. If a third-party AI tool sits in a high-risk process, the vendor’s AI Act position becomes your problem too. Due diligence now means asking whether the tool is documented to high-risk standards, what audit logs it provides, and what indemnity covers its failures. Anthropic’s USD 1.5 billion copyright settlement[8] is a reminder that AI vendors carry legal risk that can pass to customers if the contract isn’t structured carefully.
Four steps for an IFA or wealth firm
Most IFA and wealth management firms sit somewhere between “we’ve used AI for a year and never thought about this” and “compliance reviews AI output every week”. Most are in the middle: tools in use, some awareness of the rules, not much formal governance.
1. Sort your AI uses by risk. AI in creditworthiness or insurance pricing is high-risk under the Act. AI in suitability, AML or client-facing advice processes may sit outside the listed categories but still carries FCA and SM&CR expectations, so treat it as high-risk for governance purposes. AI for internal scheduling or marketing drafts isn’t. Put your governance effort into the first two groups.
2. Check your logging. Can you reconstruct what your AI system recommended or flagged for a given client, and when? If not, that’s the first gap to close. Without logs there’s nothing to audit.
3. Name the accountable person. Each high-risk AI process needs a named senior manager under SM&CR who’s accountable for how it’s governed. That’s how a regulator holds a firm to account when something goes wrong.
4. Ask your vendors now, not after a review. Ask whether their tools are documented as high-risk AI systems under the EU AI Act and what evidence they can give you. If they can’t answer, treat that as a risk in its own right.
Moody’s paid EUR 2.1 million for data errors in one reporting process[1]. For a smaller firm the equivalent would be smaller in absolute terms and could be fatal in relative ones. The first of the four steps, the risk sort, takes an afternoon with whoever owns compliance, and everything else builds on it.
This article is for informational purposes only and does not constitute regulated financial advice or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.
Sources
[1] ESMA, ‘Moody’s Germany fined EUR 2,145,000 for misreporting’, European Securities and Markets Authority, July 2026. Available at: https://www.esma.europa.eu/press-news/esma-news/moodys-germany-fined-eur-2145000-misreporting-esma
[2] European Parliament and Council, ‘Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)’, Official Journal of the European Union, 12 July 2024. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX
[3] a16z, ‘The Glass Box Approach to Enterprise AI’, Andreessen Horowitz, 31 July 2026. [Industry commentary on observable, auditable AI design in regulated environments.]
[4] van Riel, Z. (2026) ‘Why 78% of AI Agent Pilots Never Reach Production’, AI Engineer Blog. Available at: https://zenvanriel.com/ai-engineer-blog/ai-agent-scaling-gap-pilot-production-2026/
[5] OpenAI, ‘NTT Data’, OpenAI, 2026. Available at: https://openai.com/index/ntt-data
[6] European Central Bank (2024) ‘Report on AI in customer-facing financial services’, European Central Bank. [Cited for customer discrimination risk finding.]
[7] BaFin (2026) ‘Industry report on AI-driven financial data intermediation and systemic cyber risk’. [Cited for systemic cyber risk finding attributed to AI-driven financial data intermediation.]
[8] Digital Applied, ‘Anthropic’s $1.5B Settlement: What Fair Use Now Costs’, Digital Applied, 25 July 2026. Available at: https://www.digitalapplied.com/blog/anthropic-1-5b-copyright-settlement-approved-content-ip