Who this is for: heads of AI, risk and compliance at financial firms operating in the US, UK or EU. Skip it if your AI use is limited to drafting internal documents with no customer impact.
In short: The AI-specific rules keep slipping. The record-keeping, supervision and resilience rules that already apply do not. Most of what binds a bank's AI in 2027 is old law, newly read to cover agents.
Key points
- EU AI Act high-risk obligations for Annex III systems, including credit scoring, apply from 2 December 2027.
- Colorado's rewritten AI Act takes effect on 1 January 2027, requiring notification, adverse-outcome disclosure and human review.
- EU transparency duties for chatbots and synthetic content have applied since 2 August 2026.
- Bank examiners now routinely raise AI governance, including shutdown mechanisms with named human owners.
- Build a reconstructable record of what an AI system saw, produced, who checked it and what was done.
How we chose
We kept dates that change what a financial firm must do or show, in the order they arrive, and left out consultations with no deadline attached. Every date is from a regulator, a court record or a law firm's reading of the text.
The list
| # | When | What happens | Who it affects | What to do now |
|---|---|---|---|---|
| 1 | End of October 2026 | ECB-supervised banks submit plans for handling AI-enabled cyber threats | Eurozone significant banks | Map where AI changes your incident and resilience testing under DORA |
| 2 | From November 2026 | Ruling on cross-motions for summary judgment in New York Times v. OpenAI | Anyone training or fine-tuning on third-party content | Inventory the provenance of every corpus your models touch |
| 3 | 2 December 2026 | Two new EU prohibitions apply (systems built to generate intimate imagery or child sexual abuse material). Grace period for machine-readable marking on older generative systems ends around the same date | Any firm offering generative AI in the EU | Confirm your marking of synthetic content is in place |
| 4 | December 2026 (expected) | FINRA's 2027 oversight report, if it follows last year's early-December timing | US broker-dealers | Re-read the 2026 report's line on agents that act, and check you can reconstruct their activity |
| 5 | 1 January 2027 | Colorado's rewritten AI Act takes effect: user notification, disclosure of adverse outcomes, and meaningful human review | Firms making consequential decisions about Colorado residents | Identify which automated decisions reach Colorado consumers |
| 6 | Q1 2027 | The FCA reports on the second cohort of its AI Live Testing programme, which includes Barclays, Lloyds, UBS and Experian | UK firms | Read it for the supervisor's view of credit, payments and AML agents |
| 7 | Not yet dated | US banking agencies' request for information on generative and agentic AI, promised when they carved both out of April's model-risk guidance | US banks | Prepare your answer now: how you validate retrieval, guardrails and agent actions |
| 8 | Not yet dated | The first court challenge to a state AI law by the federal task force created in December 2025. The Justice Department joined a challenge to Colorado's AI Act in April 2026; none had yet been filed in the task force's name | Firms planning around state AI laws | Avoid building compliance around any single state regime until this settles |
| 9 | 2 December 2027 | EU AI Act high-risk obligations for Annex III systems apply, including credit scoring and recruitment | Lenders and employers using AI in the EU | Start conformity work in 2026; it takes longer than a year |
| 10 | 2 August 2028 | High-risk obligations for AI built into regulated products apply | Product makers, rarely financial firms | Note it; little action for most financial firms |
What already applies, and is easy to forget
- EU transparency duties for chatbots and synthetic content have applied since 2 August 2026. The delay that grabbed headlines covered high-risk systems, not these.
- US examinations. Bank examiners now raise AI governance routinely, including shutdown mechanisms with named human owners, vendor oversight, and whether AI tools reach data they should not.
- Liability for outputs. A tribunal has held a company liable for what its chatbot told a customer, and US courts had recorded 1,240 instances of AI-hallucinated citations in filings by late July 2026.
Left out, and why
- SEC predictive-analytics rule. Withdrawn in June 2025.
- ISO/IEC 42001 certification. Voluntary, and accredited certifiers are still few.
The one thing to build regardless
Every date above points to the same artefact: a record you can reconstruct, showing what an AI system saw, what it produced, who checked it, and what was done. Build that once and most of this calendar becomes paperwork rather than a project.
Common questions
When do EU AI Act high-risk rules apply to credit scoring?
High-risk obligations for Annex III systems, including credit scoring and recruitment, apply from 2 December 2027. Conformity work should start in 2026 because it takes longer than a year.
When does the Colorado AI Act take effect?
Colorado's rewritten AI Act takes effect on 1 January 2027, with user notification, disclosure of adverse outcomes, and meaningful human review for consequential decisions about Colorado residents.
Do EU AI transparency rules for chatbots already apply?
Yes. EU transparency duties for chatbots and synthetic content have applied since 2 August 2026; the delay that grabbed headlines covered high-risk systems, not these.
What should financial firms build to prepare for AI regulation?
A record you can reconstruct, showing what an AI system saw, what it produced, who checked it, and what was done. Build that once and most of the regulatory calendar becomes paperwork rather than a project.
Dates checked 17 Oct 2026.