AI in fintech and financial services

Where does AI in fintech pay off most, and which rules come into play?

In AI in fintech, document processing and flagging tend to deliver the fastest wins: AI is good at pulling data out of documents, while in most processes the judgement belongs with a person. Credit scoring of individuals and risk assessment or pricing for life and health insurance are high-risk under the AI Act, with rules from 2 December 2027 (as of September 2026). Financial institutions have AI Readiness Assessment to prioritise, Vendor Review to choose, AI Due Diligence to assess and Fractional AI Lead to embed it.

Does the judgement in AI in fintech stay with a person?

In AI in fintech, the judgement belongs with a person in most processes, who confirms or corrects the system's proposals. Every confirmation and correction produces an audit trail and a measurable quality loop.

Is the AI Act's delay a reason to wait on requirements for AI in fintech?

No. A credit model bought or built now will likely still be in use once the high-risk rules take effect on 2 December 2027, so those requirements belong in AI in fintech's design and selection now. Vendor Review records the choice of vendor or build partner in a way procurement, compliance and audit can work with.

How does an AI service from an external vendor relate to DORA in AI in fintech?

Where DORA applies, an AI service a financial institution buys in AI in fintech counts in practice among the third-party ICT services DORA requires in the information register, including sub-outsourcing. DORA has applied since 17 January 2025 and targets the financial institution; the precise classification is something to have checked by the compliance or legal function. Exit path, dependency and incident arrangements belong in the selection of an external AI service.

Source: article by Dave Willemstein; primary source: Regulation (EU) 2024/1689 (AI Act), EUR-Lex; Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal L of 24.7.2026, EUR-Lex; Regulation (EU) 2022/2554 (DORA), EUR-Lex; FCA, PS21/3 (Building operational resilience); Bank of England/PRA, SS1/21 (as of 6 October 2026). Updated: October 2026.

AI applications in fintech

In fintech and the broader financial sector, AI applications fall roughly into four types:

• Document processing: pulling data from identity documents, company extracts, annual accounts, payslips or policies. This is the classic territory of onboarding, KYC and underwriting.
• Flagging: transaction monitoring, fraud detection and surfacing unusual patterns for an analyst.
• Assessment and pricing: credit scoring, risk selection and premium pricing. Here AI touches customers’ interests directly.
• Customer contact and knowledge: answering standard questions, preparing for advice calls, and searching internal policy and procedure.

The first two types tend to deliver the fastest wins. The third can carry a lot of value but falls partly under the AI Act’s heaviest regime. The fourth looks harmless, but a chatbot that misinforms customers is not a small problem in a regulated sector.

Which application to tackle first depends on where the work sits and how much risk you can carry. One example of how that trade-off plays out in practice is the case on a use-case portfolio for an investment firm.

AI automation in financial services

The key distinction for automation in financial services is between extraction and judgement. Extraction means pulling facts out of a document: what’s the name, the amount, the date, the ultimate beneficial owner. Judgement means weighing what those facts mean: does this represent a risk, does this customer fit our policy?

AI is good at extraction and can take a lot of search work off people’s hands. In most processes, judgement belongs with a person, who confirms or corrects the system’s proposals. That’s not just cautious, it’s also practical: every confirmation and correction produces an audit trail and a measurable quality loop.

1. Document inIdentity document, extract, annual accounts or policy.
2. ExtractionAI pulls out the data, with a confidence score per field.
3. ThresholdAbove the threshold, a proposal; below it, the case goes to the analyst unfiltered.
4. JudgementThe analyst confirms, corrects and decides.
5. LoggingEvery confirmation and correction enters the audit trail and feeds the quality measurement.

This exact pattern is central to the case on KYC document analysis at a financial services firm. The hard part there wasn’t the model, but designing a workflow analysts could trust, and overrule.

One note of caution on the current interest in agents that take steps on their own: in a financial process you want to know exactly what happens when such an agent is involved, and what it can and can’t do well.

AI governance and compliance

AI governance in financial services isn’t a new structure next to existing risk management. In their joint report from April 2024, the Dutch regulators DNB and AFM already stated that financial institutions are expected to use AI responsibly, and that existing regulation applies in full once AI is involved; the same expectation holds for UK institutions under the FCA and PRA. Data quality, data protection, explainability and the risk of discrimination and exclusion are called out explicitly.

On top of that come three regimes worth knowing (as of September 2026):

• The AI Act. AI used to assess an individual’s creditworthiness or establish a credit score is high-risk, with an explicit carve-out for systems that detect financial fraud. The same applies to AI for risk assessment and pricing in life and health insurance (AI Act, Annex III). Under the Digital Omnibus, the high-risk rules for these applications now apply from 2 December 2027 rather than August 2026 (European Commission). The transparency rules, for example that a chatbot must disclose that the customer is talking to AI, have applied since 2 August 2026 (European Commission). The Act’s reach isn’t limited to the EU: under Article 2, it also applies to UK institutions that place an AI system on the EU market, or whose AI system’s output is used in the EU, regardless of where the institution itself is established. The UK has no AI Act of its own; it regulates AI through existing sector regulators instead, as set out in the government’s pro-innovation approach.
• DORA. The Digital Operational Resilience Act has applied since 17 January 2025 and covers ICT risk management, incident reporting, digital resilience testing and the oversight of ICT providers for EU financial entities, which must keep a register of every ICT service bought from third parties, including sub-outsourcing. DORA itself is an EU regulation: a UK firm falls under it where it runs EU-regulated entities or provides ICT services to EU financial entities, but a UK-only firm instead sits under the FCA’s operational resilience rules (PS21/3) and the PRA’s SS1/21, which cover similar ground: mapping important business services and staying within impact tolerances. Either way, an AI service from an external vendor is an operational-resilience question: exit path, dependency and incident arrangements belong in your selection.
• Supervision. For UK institutions, the FCA and PRA continue to apply as normal. For an EU financial institution, which regulator leads on AI Act supervision is still settling: the Netherlands, for instance, was still finalising its implementing legislation for the AI Act in mid-2026, with its market regulator AFM pushing for a clearer split of duties with the central bank DNB on high-risk applications such as credit scoring and insurance pricing.

A delay in the AI Act’s rules is no reason to wait. A credit model you buy or build now will likely still be in use once the requirements take effect in December 2027, so build them into your design and selection now. How to build a broader AI policy around that, and keep governance proportionate with heavy requirements only where the risk justifies them, is covered on the AI policy overview page. This isn’t legal advice: have the classification of a specific application reviewed by your compliance or legal function.

AI consultancy for financial institutions

What I do for banks, insurers, fintechs and investors is the same as in other sectors, but with the bar raised for explainability and traceability:

• Prioritise: which applications pay off and fit your risk appetite? A logical starting point is a baseline with the AI Readiness Assessment.
• Choose: select a vendor or build partner against criteria for explainability, audit trail, data rights and exit path. A Vendor Review records that choice in a way procurement, compliance and audit can work with afterwards.
• Assess: for investors and corporate development teams who want to vet an AI proposition or vendor, there’s AI Due Diligence, always under NDA.
• Embed: if you don’t have a full-time head of AI, a Fractional AI Lead can own the AI agenda and coordinate with risk, compliance and audit.

I don’t build or sell software myself, and I don’t take commissions or hold partner status with vendors. I guide implementations from your side of the table. That matters most in a sector where you’ll later need to explain why you chose a particular party.

Other sectors have their own rulebook, from healthcare’s medical-device legislation to retail and customer-data rules in marketing. Want to talk through a specific question? Book a strategy call.