The AI Act: what really changes for finance and treasury departments

The EU Artificial Intelligence Act — Regulation (EU) 2024/1689 — entered into force on 1 August 2024 and applies in stages. Its timetable was amended in 2026 by the so-called "digital omnibus" (Regulation (EU) 2026/1744), published in the Official Journal on 24 July 2026 and in force since 27 July, which notably postponed the obligations applying to high-risk systems.

For a finance department, the gist fits in one sentence: most AI uses in treasury are not high-risk, but the company remains subject to a few general obligations, and some uses close to the finance function — recruitment, consumer credit — are classified as high-risk.

The timetable, after the omnibus

Provider or deployer: the question that sets your obligations

The text distinguishes whoever develops an AI system and places it on the market — the provider — from whoever uses it in the course of their business — the deployer. A finance department using an off-the-shelf assistant, a forecasting tool or the AI module of its treasury software is a deployer.

The heavy obligations — technical documentation, conformity assessment, CE marking, risk management — fall on the provider. The deployer has more limited obligations, which only become substantial if the system is high-risk.

Classifying the finance function's uses

What already applies to every user company

AI literacy

Since 2 February 2025, Article 4 has required providers and deployers to take measures so that the people using AI systems have sufficient command of them. The omnibus reworded this requirement more flexibly — it is now about supporting the development of that literacy — but the principle remains: a team using AI must know what it does well, what it does badly and how to check its output.

For a finance department this translates simply: a short training session, a usage charter, and a record of both.

Prohibited practices

They rarely concern the finance function: manipulation, social scoring, emotion recognition in the workplace… The last one deserves attention, though: a tool claiming to measure staff stress or emotion, including in a shared service centre, is banned at work, except for medical or safety reasons.

Transparency

Since 2 August 2026, systems that interact with people must be designed so that those people know they are dealing with AI, unless it is obvious. This obligation falls on the provider: if you buy an assistant that answers suppliers about the status of their payments, check that the vendor has built it in; if you develop it yourself, it falls on you.

The deployer has an obligation of its own: disclosing deepfakes it disseminates, and AI-generated text it publishes to inform the public, unless a person has reviewed it and takes editorial responsibility. An AI-written market note published as is on the company's website would fall into this case.

What will apply to high risk from December 2027

If the company uses a high-risk system — typically a candidate-screening tool, including to recruit for the finance team — its deployer obligations will be to:

• use the system in line with the provider's instructions;
• assign human oversight to competent, trained people with the necessary authority;
• ensure the input data it controls is relevant;
• monitor the system's operation and report serious incidents to the provider and the authorities;
• keep automatically generated logs for at least six months;
• inform employees and their representatives before such a system is put into service in the workplace.

Penalties

Fines can reach 35 million euros or 7% of worldwide turnover for prohibited practices, and 15 million euros or 3% for most other breaches. For SMEs, the lower of the two amounts is the ceiling.

A five-step action plan

1. 1
   Inventory

   List the AI tools used in the finance function, including modules built into existing software and assistants used individually. It is often a surprise: there are more uses than expected.

2. 2
   Classify

   For each tool, determine whether you are provider or deployer, and which risk category the use falls into. The vast majority will be minimal risk; isolate the high-risk and transparency cases.

3. 3
   Frame

   Write a short usage charter: authorised tools, data that may go into them, checks to apply to output, accountable person. It ties in with the treasury policy and its delegations.

4. 4
   Train

   Run a session for the people using these tools, and keep a record of it. It is the most direct answer to the AI literacy obligation.

5. 5
   Contract

   In vendor contracts, check data reuse, hosting location and the provider's compliance commitment. For a high-risk tool, ask for the documentation the text requires it to supply.

What the AI Act does not settle

The text regulates AI systems; it says nothing about the quality of your hedging decisions. A fully compliant company can still decide on the basis of a rate invented by an assistant. Protection still comes from governance: sourced numbers, written controls and recorded decisions. The GDPR, for its part, continues to apply to any personal data processed by these tools.

Sources

• Regulation (EU) 2024/1689 on artificial intelligence: Article 4 (AI literacy), Article 5 (prohibited practices), Article 25 (deployer becoming provider), Article 26 (deployer obligations), Article 50 (transparency), Article 99 (penalties), Article 113 (application dates), Annex III (high risk).
• Regulation (EU) 2026/1744, the "Digital Omnibus on AI", adopted on 8 July 2026, published in the OJEU on 24 July 2026, in force since 27 July 2026: delay of high-risk obligations, new wording of Article 4, grace period in Article 111(4).