Building your own AI model? Bank governance covers most of the AI Act quality system, but not three parts

If your bank builds its own high-risk AI, your existing governance rules cover most of the AI Act's quality system duty. Three parts still need their own work.

A bank that develops its own credit-scoring model and uses it is a provider, not just a deployer. Credit scoring and creditworthiness checks are high-risk under Annex III point 5(b). Providers of high-risk AI must run a quality management system under Article 17. For Annex III systems, this applies from 2 December 2027, under the Digital Omnibus (Regulation (EU) 2026/1744).

Article 17(4) gives financial institutions a shortcut. If you already follow internal-governance rules under EU financial services law, most of the quality system counts as done. You must still take harmonised standards under Article 40 into account.

The shortcut has three gaps. It does not cover point (g), the risk management system under Article 9. It does not cover point (h), post-market monitoring under Article 72. And it does not cover point (i), serious incident reporting under Article 73.

The Act still eases two of these gaps. Article 9(10) lets you combine AI risk management with risk processes you already run under other EU law. Article 72(4) lets financial institutions fold post-market monitoring for Annex III point 5 systems into existing systems, if the level of protection stays equivalent. Incident reporting under Article 73 has its own route and deadlines. Check how it fits your current incident processes.

The paperwork can stay in one place. Under Article 18(3), technical documentation is kept with the records you already hold under financial services law. Article 19(2) says the same for automatically generated logs.

Best practice: map the three gaps now. Give each one an owner inside your existing model-risk and incident teams. Do not build a second, parallel governance system.

Sources: Regulation (EU) 2024/1689, Articles 9(10), 17(4), 18(3), 19(2), 72(4) and 73; Digital Omnibus Regulation (EU) 2026/1744.