← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for fintech teams

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Why fintech lands in the high-risk category

Annex III of the EU AI Act lists the uses that make an AI system high-risk. Point 5 covers access to essential private and public services, and includes:

• AI systems used to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for systems used to detect financial fraud;
• AI systems used for risk assessment and pricing of natural persons in life and health insurance.

If an LLM or agent in your product takes part in a lending decision, for example by summarising bank statements, extracting income, scoring an applicant or drafting a decline reason, it is worth asking early whether that system falls under point 5(b). The answer depends on the system's role, not on the fact that it is "just an assistant".

The logging duties that follow

For high-risk systems, the Act splits record-keeping across roles:

• Art. 12 (providers): the system must be designed to automatically record events over its lifetime, so that its functioning can be traced, risks identified and post-market monitoring carried out.
• Art. 19 (providers): keep the automatically generated logs under your control for a period appropriate to the intended purpose, at least six months.
• Art. 26(6) (deployers): keep the logs under your control for at least six months, unless other law says otherwise. For deployers that are financial institutions, Art. 26 lets log-keeping be done as part of the documentation already required by EU financial services law.

A fintech is often both roles: provider of the scoring component it built, deployer of a model it bought. See log retention under Art. 26 and 19 and Art. 12 logging.

On timing: the Digital Omnibus agreement moved Annex III high-risk obligations to December 2027 (details and caveats). Logs cannot be backfilled, though. Runs you do not record today will not exist when a regulator or a customer asks about them.

What "evidence" means in a credit dispute

Financial services already live with complaints, ombudsman cases and supervisory reviews. When an applicant contests an AI-assisted decision, the question is rarely "do you have logs?" It is "can you show the logs were not rewritten after the complaint arrived?"

A log in your own database, even in WORM storage, is your word. What convinces an outsider is:

1. a hash chain over the run's events, so removing or editing a step is detectable;
2. an independent, timestamped signature from a party with no stake in the outcome, verifiable with a public key.

How Vetro Attest fits

Vetro Attest accepts the trace you already produce, an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 49 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations above;
• an ed25519 countersignature by this service over the ledger digest, event count and timestamp. Anyone, your auditor or the applicant's lawyer included, can verify it with our published public key.

A practical pattern: countersign each run that produces or supports a credit decision, soon after it happens, and store the trace plus attestation in your retention storage alongside the decision record.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the decision was fair or the data correct. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 49 USD.
• Compare approaches: vs. WORM storage, vs. signing your own logs.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.