← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for banks

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

A bank runs dozens of AI use cases, and the Act treats them differently:

• Credit decisions for individuals (loan origination, overdraft limits, card limits) are high-risk under Annex III point 5(b). See also credit scoring.
• Fraud detection is expressly carved out of 5(b). Transaction monitoring for AML is not listed in Annex III either.
• Customer chatbots are usually not high-risk, but Article 50 requires telling customers they are talking to an AI unless it is obvious. That applies from 2 August 2026.
• HR uses inside the bank, such as screening applicants, fall under point 4 like anywhere else.

The logging duties that follow

• Art. 12 (providers): automatic recording of events for high-risk systems, including those the bank builds in house.
• Art. 19 (providers): keep logs for at least six months. A bank that is itself the provider can keep them as part of the documentation required by financial services law.
• Art. 26 (deployers): competent human oversight (Art. 26(2)) and logs kept for at least six months (Art. 26(6)). For financial institutions, the monitoring duty is met by complying with internal governance rules (Art. 26(5)), and log-keeping can be part of the existing financial-services documentation (Art. 26(6)). Deployers of 5(b) systems also carry out a fundamental rights impact assessment.

Supervision follows the same logic: for financial institutions, the market surveillance authority is the financial supervisor (Art. 74(6)). Expect AI questions inside normal supervisory reviews. See retention under Art. 26.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

The bank's question is not whether logs exist, since it has plenty, but whether a specific AI-assisted credit decision can be shown to a supervisor or ombudsman in a form that proves it was not edited.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.call","data":{"name":"get_account_data","input":{"customer":"cus_19a7","months":6}}}
{"seq":2,"type":"tool.result","data":{"name":"limit_model_v7","output":{"current":500,"proposed":1500,"reasons":["salary_inflow","no_overdraft_90d"]}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.call","action":"warn","hits":[{"rule":"limit-over-1000-needs-officer"}]}}
{"seq":4,"type":"tool.call","data":{"name":"set_limit","input":{"customer":"cus_19a7","limit":1500,"approved_by":"cro_desk_22"}}}

The policy threshold and the approval are in the same chain as the model output.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign each run that sets or changes a credit exposure, and file the attestation with the credit record under your existing retention schedule.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the credit decision was sound. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. WORM storage, vs. Datadog LLM Observability.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.