The countdown is over. Since August 2,
the obligation of transparency and most of the rules for high-risk AI systems have come into force.
While corporate boardrooms were still recently debating when and in what form the regulation of artificial intelligence would arrive, Evropská unie has already resolved this issue. Regulation 2024/1689, known as the AI Act, created the world's first comprehensive legal framework for artificial intelligence. However, it is not a law that affects companies with a single blow. Rather, it is a process that proceeds in waves. And we have just come through one of them.
The AI Act entered into force as early as August 2024. General rules and the first bans will then apply from February 2, 2025; rules for AI models for general purposes from August 2, 2025. However, right now we are in the most tangible phase of the whole process, as from August 2 the obligation of transparency and most of the rules for high-risk AI systems have come into force. The regulation is thus finally moving from theory to everyday practice.
There is now only one major time milestone left on the horizon: the year 2027, when the last phase arrives for selected high-risk systems embedded in products that are already subject to other European regulation. Thus, Brussels has not only determined what should be regulated, but also the pace at which companies must adapt to it. And this pace is now picking up. What does this mean in practice?
Risk as a determining factor
The core building block of the AI Act is the risk management principle. 'Low-risk' artificial intelligence remains available to companies without significant restrictions. But as soon as a system affects people's health, safety, or fundamental rights, it gets labeled as 'high-risk.' And with it comes a package of obligations: documentation, oversight, testing, information disclosure on functioning, and in extreme cases, even cessation of use.
For many businesses, the key question is not whether they use AI, but which specific use case falls into the given category. Companies deploying general-purpose models face different obligations than those integrating AI directly into their products and services and must assess whether they have entered the high-risk zone.
The AI Act does not concern only large technology companies. It affects publishers working with AI-generated content, banks relying on automated decision-making, and any company using artificial intelligence for recruitment, client care, or daily operations.
Banks: credit scoring as a high-risk system
The banking sector is among the industries most specifically impacted by the AI Act. The European Banking Authority (EBA) points out that AI is increasingly used in banking and payment services across the EU—especially for creditworthiness assessment, fraud detection, and customer support.
It is precisely the creditworthiness assessment and credit scoring of individuals that the AI Act classifies as high-risk systems, as they directly affect people's access to money and basic financial services. For banks, this means stricter data quality control, logging, human oversight, accuracy, robustness, and cybersecurity in all processes where AI is involved in sensitive decision-making.
The EBA has already linked these requirements with the specifics of the banking and payment sector. Thus, for financial institutions, the AI Act has long ceased to be a theoretical exercise and has become a concrete sectoral compliance obligation.
The article was published on the website ieuro.cz
Author:
Filip Drnec, Executive Director at Portos, advokátní kancelář s.r.o.
