[{"data":1,"prerenderedAt":1059},["ShallowReactive",2],{"uc-reg-dora":3},{"regulation":4,"includeUnpublished":11,"indexable":12,"useCases":13},{"id":5,"label":6,"issuer":7,"region":8,"url":9,"description":10},"dora","DORA","European Union","europe","https://eur-lex.europa.eu/eli/reg/2022/2554/oj","Digital Operational Resilience Act for financial entities: ICT risk, incident reporting and third party risk, including AI providers.",false,true,[14,53,71,89,116,149,167,182,203,227,243,255,270,285,303,320,339,357,376,395,408,422,443,456,469,489,503,518,529,548,567,581,598,613,627,641,658,671,683,695,710,729,741,753,765,780,798,811,823,837,849,864,874,886,898,914,925,938,951,963,979,990,1003,1019,1032,1045],{"slug":15,"title":16,"shortTitle":17,"definition":18,"status":19,"industries":20,"functions":23,"patterns":26,"audience":31,"autonomy":32,"adoptionStage":33,"segment":34,"evidenceCount":35,"publicEvidenceCount":36,"organizations":37,"bestGrade":40,"headline":41,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":52},"account-and-card-servicing-agent","AI agent for account and card servicing","Account and card servicing","An AI agent that resolves routine account and card requests end to end, such as balances, statements, card blocks and replacements, PIN resets and limit changes, across app, web, messaging and phone, and hands anything sensitive or unusual to a human with the full context.","published",[21,22],"banking","payments",[24,25],"customer-service","operations",[27,28,29,30],"conversational-agent","voice-agent","agentic-workflow","rag-knowledge-assistant","customer-facing","supervised-agent","mainstream","front-office",4,2,[38,39],"Commonwealth Bank of Australia","DBS Bank","B",{"kpi":42,"label":43,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":47,"qualifier":48,"claimant":49,"organization":39,"vendorReported":11},"containment-rate","Containment rate","percent",0,"reported",90,"approximately","organization","2026-09-27","limited","Article 50(1): people must be informed that they are interacting with an AI system, unless that is obvious from the context. Servicing existing accounts and cards is not an Annex III use. It would become high risk under Annex III point 5(b) if the agent itself evaluated the creditworthiness of a natural person, for example to decide a credit limit increase.",{"slug":54,"title":55,"shortTitle":56,"definition":57,"status":19,"industries":58,"functions":59,"patterns":60,"audience":31,"autonomy":32,"adoptionStage":61,"segment":34,"evidenceCount":62,"publicEvidenceCount":62,"organizations":63,"bestGrade":40,"headline":65,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":70},"atm-and-self-service-device-assistance","AI agent for ATM and self service device assistance","ATM and device assistance","An AI agent that helps customers with problems at or around ATMs and other self service devices, such as a withdrawal that did not pay out, a retained card, a blocked PIN or finding a working machine with cash, over the app, chat or phone, and that opens and tracks the claim or hands it to a person when it cannot be resolved.",[21],[24,25],[27,28,29],"emerging",1,[64],"NatWest Group",{"kpi":66,"label":67,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":68,"qualifier":69,"claimant":49,"organization":64,"vendorReported":11},"customer-satisfaction-uplift","Satisfaction uplift",150,"exact","A customer facing assistant must tell people they are interacting with an AI system unless that is obvious (Article 50(1)). It does not evaluate creditworthiness (Annex III point 5(b)) or eligibility for public assistance benefits (point 5(a)), so it is not high risk; biometric verification whose sole purpose is to confirm identity is excluded from Annex III point 1(a).",{"slug":72,"title":73,"shortTitle":74,"definition":75,"status":19,"industries":76,"functions":77,"patterns":79,"audience":31,"autonomy":32,"adoptionStage":82,"segment":34,"evidenceCount":35,"publicEvidenceCount":83,"organizations":84,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":88},"card-dispute-and-chargeback-intake","AI agent for card dispute intake","Card dispute intake","A customer facing AI agent that handles the \"I do not recognise this charge\" moment: it finds the transaction, separates suspected fraud from merchant disputes and simple confusion, explains the customer's rights and timelines, collects the details and evidence the rules require, and opens a correctly classified dispute case for the operations team.",[21,22],[24,78,25],"fraud-prevention",[27,28,80,81,29],"classification-and-routing","document-processing","early-adopters",3,[38,85,86],"Klarna","Visa",null,"A customer facing assistant must tell people they are interacting with an AI system (Article 50(1)). It triages and opens cases but does not evaluate creditworthiness (Annex III point 5(b), which in any case excludes systems used to detect financial fraud) or decide access to an essential service, so it is not high risk under Annex III.",{"slug":90,"title":91,"shortTitle":92,"definition":93,"status":19,"industries":94,"functions":98,"patterns":101,"audience":104,"autonomy":105,"adoptionStage":82,"segment":106,"evidenceCount":36,"publicEvidenceCount":36,"organizations":107,"bestGrade":40,"headline":109,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":115},"complaints-handling-agent","AI agent for complaints recognition, investigation and response","Complaints handling","An AI agent that recognizes when a customer interaction is a complaint, logs it against the regulatory definition, classifies its root cause and severity, gathers the evidence, drafts the acknowledgement and the response for a human handler to approve, and tracks every statutory deadline until the case is closed.",[95,21,22,96,97],"cross-industry","insurance","telecommunications",[99,24,100],"case-management","regulatory-compliance",[80,102,103,29,30],"summarization","content-generation","employee-facing","copilot","middle-office",[108,64],"Lloyds Banking Group",{"kpi":110,"label":111,"unit":112,"n":62,"nUpTo":45,"kind":46,"value":113,"qualifier":48,"claimant":49,"organization":108,"vendorReported":11},"time-saved-per-task","Time saved per task","minutes",5,"context-dependent","Complaint handling is not listed in Annex III, so internal classification and drafting for a handler who decides is minimal risk. Where the agent talks to customers to take the complaint, Article 50(1) requires telling them they are dealing with AI. Only a system that also assessed creditworthiness or priced life and health insurance (Annex III point 5(b) or 5(c)) would be high risk for that part.",{"slug":117,"title":118,"shortTitle":119,"definition":120,"status":19,"industries":121,"functions":125,"patterns":126,"audience":31,"autonomy":32,"adoptionStage":33,"segment":34,"evidenceCount":127,"publicEvidenceCount":128,"organizations":129,"bestGrade":40,"headline":144,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":148},"first-line-contact-centre-agent","AI agent for first line contact centre service","First line contact centre","An AI agent that answers the first line of inbound customer contact on phone, chat and messaging, resolves general and routine questions end to end in the customer's own language, and routes everything complex, sensitive or regulated to the right human team with the context attached.",[95,21,22,97,122,123,124],"travel-and-hospitality","retail-and-ecommerce","wealth-and-asset-management",[24],[27,28,30,80],25,18,[130,131,132,133,134,38,135,136,85,137,138,64,139,140,141,142,143],"Air India","Airbnb","Bank of America","Bank of the Philippine Islands","BT Group","Ingka Group","JetBlue","Lufthansa Group","Mobily","Pegasus Airlines","Telkomsel","Together Credit Union","Vodafone Germany","Vodafone",{"kpi":42,"label":43,"unit":44,"n":145,"nUpTo":45,"kind":146,"value":147,"qualifier":69,"claimant":87,"organization":87,"vendorReported":11},7,"median",47,"An AI system that interacts directly with people must be designed so that they know they are dealing with AI, unless that is obvious from the context (Article 50(1)). It is not high risk under Annex III as long as it does not evaluate eligibility for essential public assistance benefits and services (point 5(a)), creditworthiness (point 5(b)), risk and pricing for life and health insurance (point 5(c)) or emergency calls (point 5(d)). This holds only if emotion or vulnerability signals are inferred from what the customer says (text or transcript content), not from voice or other biometric features; an agent that infers emotion from a caller's voice is an emotion recognition system (Article 3(39)), which is high risk under Annex III point 1(c) and triggers the deployer disclosure duty in Article 50(3).",{"slug":150,"title":151,"shortTitle":152,"definition":153,"status":19,"industries":154,"functions":155,"patterns":156,"audience":31,"autonomy":32,"adoptionStage":61,"segment":34,"evidenceCount":113,"publicEvidenceCount":113,"organizations":157,"bestGrade":40,"headline":162,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":166},"fraud-alert-confirmation","AI agent for fraud alert confirmation with cardholders","Fraud alert confirmation","A customer facing AI agent that contacts the cardholder as soon as the fraud engine flags a card transaction, in the channel they actually respond to, verifies them, asks whether they made the transaction and acts on the answer: releasing the block so a retry succeeds, or freezing the card and starting the fraud claim.",[21,22],[78,24],[27,28,29],[158,38,159,160,161],"Capital One","Macquarie Bank","Revolut","Westpac",{"kpi":163,"label":164,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":165,"qualifier":69,"claimant":49,"organization":38,"vendorReported":11},"fraud-loss-reduction","Fraud loss reduction",76,"Confirming flagged transactions with cardholders is not listed in Annex III, and point 5(b) expressly excludes AI used to detect financial fraud from the creditworthiness category, so the system is not high risk. An agent that messages or calls customers must tell them they are dealing with AI under Article 50(1), and synthetic voice output must be marked as AI generated under Article 50(2).",{"slug":168,"title":169,"shortTitle":170,"definition":171,"status":19,"industries":172,"functions":173,"patterns":174,"audience":104,"autonomy":32,"adoptionStage":82,"segment":106,"evidenceCount":83,"publicEvidenceCount":36,"organizations":176,"bestGrade":179,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":181},"fraud-alert-triage","AI agent for fraud alert triage","Fraud alert triage","An AI agent that works the fraud alert queue behind the scenes as the analyst's first pass, without contacting the customer: it enriches each alert with customer, device and payment context, closes clear false positives under documented rules, merges duplicates, and routes genuine risk to an analyst with a drafted rationale.",[21,22],[78,25],[29,80,102,175],"prediction-and-scoring",[177,178],"Coast","SEB","C","minimal","Internal triage of fraud alerts is not listed in Annex III, and point 5(b) explicitly excludes fraud detection from the high risk creditworthiness category. Article 50(1) covers any system that interacts directly with people, analysts included, but it does not apply where the use of AI is obvious to a reasonably well informed user, as it is in an internal analyst tool; the marking duties for generated content in Article 50(2) sit with the provider. Reassess if its output feeds credit decisions. Decisions that affect customers remain subject to GDPR and consumer protection rules.",{"slug":183,"title":184,"shortTitle":185,"definition":186,"status":19,"industries":187,"functions":188,"patterns":189,"audience":31,"autonomy":32,"adoptionStage":82,"segment":190,"evidenceCount":191,"publicEvidenceCount":191,"organizations":192,"bestGrade":40,"headline":199,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":202},"insurance-policy-servicing-agent","AI agent for insurance policy servicing","Policy servicing agent","An AI agent that answers policyholders' coverage questions from their own policy documents and completes routine policy changes and document requests (address and vehicle changes, adding a named driver or item, payment method updates, certificates and proof of cover) across chat, messaging and phone, and hands anything complex or sensitive to a human with the context.",[96],[24,25],[27,28,30,29],"policy-administration",6,[193,194,195,196,197,198],"LAQO","Lemonade","Nsure.com","Sun Life","Waterdrop","Zurich Insurance (Hong Kong)",{"kpi":42,"label":43,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":200,"qualifier":201,"claimant":49,"organization":194,"vendorReported":11},50,"at-least","A customer facing assistant must be designed so that people know they are interacting with AI (Article 50(1), applicable from 2 August 2026). It is not high risk as long as it does not carry out risk assessment and pricing in relation to natural persons in life and health insurance (Annex III point 5(c)).",{"slug":204,"title":205,"shortTitle":206,"definition":207,"status":19,"industries":208,"functions":211,"patterns":213,"audience":104,"autonomy":32,"adoptionStage":33,"evidenceCount":214,"publicEvidenceCount":191,"organizations":215,"bestGrade":40,"headline":221,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":226},"it-service-desk-resolution-agent","AI agent for IT service desk resolution","IT service desk resolution","An AI agent in Microsoft Teams, Slack or the intranet that takes the high volume IT support queue, such as password and MFA resets, account unlocks, VPN, device and software requests, and resolves common requests by acting in the identity and IT service management systems, handing the rest to the right resolver group with the context attached.",[95,21,209,123,210],"technology","healthcare",[212,25],"it-and-engineering",[27,29,30,80],8,[216,132,217,218,219,220],"7-Eleven Vietnam","Equinix","IBM","Mercari US","Vituity",{"kpi":222,"label":223,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":224,"qualifier":69,"claimant":225,"organization":219,"vendorReported":12},"employee-adoption","Employee adoption",94,"vendor","Article 50(1) requires an assistant that talks with people to make clear they are interacting with AI, unless that is obvious from the context. It is not listed in Annex III. The agent does allocate work, but it routes tickets to resolver and assignment groups based on the content of the request, not to individual workers based on their behaviour or personal traits or characteristics, so Annex III point 4(b) does not apply. It also does not decide on recruitment, promotion, credit or access to essential services. Any use that assigns work to individual analysts, or monitors and evaluates them from their behaviour or performance (including through the agent's logs), would need its own assessment.",{"slug":228,"title":229,"shortTitle":230,"definition":231,"status":19,"industries":232,"functions":233,"patterns":235,"audience":31,"autonomy":32,"adoptionStage":61,"segment":34,"evidenceCount":214,"publicEvidenceCount":145,"organizations":236,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":242},"agentic-payment-initiation","AI agent for payment initiation within a customer mandate","Agentic payment initiation","An AI agent that initiates and completes payments or purchases on a customer's behalf, within a mandate the customer set in advance (spending caps, allowed merchants or categories, a tokenized credential and rules for when to ask for confirmation), and then confirms and reconciles every transaction it made.",[22,21,123],[24,234,25],"sales",[29,27],[39,237,238,239,240,241,86],"ING","Majid Al Futtaim","PayPal","Banco Santander","Ulta Beauty","A customer facing agent must make clear that people are dealing with AI, unless that is obvious from the context (Article 50). Initiating payments within a customer's mandate is not listed in Annex III. It becomes high risk if the same agent evaluates creditworthiness, for example by deciding on a buy now pay later or credit line at checkout (Annex III point 5(b)).",{"slug":244,"title":245,"shortTitle":246,"definition":247,"status":19,"industries":248,"functions":249,"patterns":251,"audience":31,"autonomy":32,"adoptionStage":61,"segment":34,"evidenceCount":83,"publicEvidenceCount":83,"organizations":253,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":254},"proactive-outbound-engagement-agent","AI agent for proactive customer outreach, activation and retention","Proactive outreach and activation","An AI agent that holds the conversation when a bank reaches out first to change something about the customer's account or products, triggered by an event or a campaign: low balance and fee avoidance alerts, payment and renewal reminders, card activation, dormant account reactivation and offers the customer already qualifies for, over messaging or voice, while the bank's own systems decide who is contacted and why. Reminders about appointments and deliveries the customer booked, and the in app coach the customer opens, are separate use cases.",[21,22],[250,234,24],"marketing",[27,28,29,252],"recommendation-and-personalization",[132,158,38],"A customer facing agent must disclose that it is AI (Article 50(1)). It stays out of Annex III as long as eligibility for credit offers is decided upstream by the bank's own, separately governed credit processes; if the agent itself assessed creditworthiness it would be high risk under point 5(b).",{"slug":256,"title":257,"shortTitle":258,"definition":259,"status":19,"industries":260,"functions":261,"patterns":264,"audience":104,"autonomy":105,"adoptionStage":82,"segment":34,"evidenceCount":83,"publicEvidenceCount":83,"organizations":265,"bestGrade":40,"headline":87,"lastVerified":268,"indexable":12,"euAiActTier":114,"euAiActBasis":269},"source-of-wealth-diligence","AI agent for source of wealth due diligence in private banking","Source of wealth diligence","An AI agent that reads a prospective private client's documents, extracts and corroborates how their wealth was built, checks plausibility against benchmarks and external sources, and drafts the source of wealth and enhanced due diligence narrative for the relationship manager and compliance analyst, who decide on the risk rating and the relationship.",[124,21],[262,263],"onboarding-and-kyc","financial-crime-compliance",[81,29,103,102],[266,267],"Bank of Singapore","Deutsche Bank","2026-09-26","Anti money laundering due diligence is not listed in Annex III, so an assistant that drafts source of wealth reports for a human decision is not high risk by default. It becomes high risk if it adds remote biometric identification of the client (Annex III point 1(a); verification that only confirms a claimed identity is excluded) or feeds an assessment of a natural person's creditworthiness, for example for lending to the client (Annex III point 5(b)). GDPR Article 22 on solely automated decisions applies if it ever refused a client on its own.",{"slug":271,"title":272,"shortTitle":273,"definition":274,"status":19,"industries":275,"functions":276,"patterns":277,"audience":31,"autonomy":32,"adoptionStage":82,"segment":278,"evidenceCount":113,"publicEvidenceCount":36,"organizations":279,"bestGrade":40,"headline":280,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":284},"corporate-client-servicing-assistant","AI assistant for corporate and commercial client servicing","Corporate client servicing","A conversational assistant inside the corporate banking portal, app and messaging channels that answers finance and treasury teams' servicing questions, such as payment status, balances, cut off times, fees and how to submit an instruction, resolves routine requests end to end and hands the rest to a service specialist who has an AI copilot.",[21,22],[24,25],[27,30,29,102],"specialized-businesses",[132,39],{"kpi":281,"label":282,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":283,"qualifier":69,"claimant":49,"organization":132,"vendorReported":11},"contact-deflection","Contact deflection",16,"A chatbot that interacts with people at client companies must disclose that it is AI (Article 50). It does not evaluate creditworthiness or decide on access to an essential service (Annex III point 5), so it is not high risk.",{"slug":286,"title":287,"shortTitle":288,"definition":289,"status":19,"industries":290,"functions":291,"patterns":292,"audience":31,"autonomy":294,"adoptionStage":82,"segment":278,"evidenceCount":35,"publicEvidenceCount":35,"organizations":295,"bestGrade":40,"headline":300,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":302},"developer-api-integration-assistant","AI assistant for developers integrating a company's APIs","API integration assistant","An AI assistant on a developer portal and in its documentation that answers integration questions, recommends the right endpoints, helps debug connections and generates sample calls, grounded in the API catalogue, reference docs and test material, so clients and partners integrate faster with fewer support tickets.",[95,21,22,209],[212,24,262],[30,27,293],"code-generation","assist",[296,297,298,299],"CircleCI","Mapbox","monday.com","U.S. Bank",{"kpi":281,"label":282,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":301,"qualifier":69,"claimant":49,"organization":297,"vendorReported":11},30,"A chatbot that interacts with developers must disclose that it is AI (Article 50). Code generation for integration is not listed in Annex III.",{"slug":304,"title":305,"shortTitle":306,"definition":307,"status":19,"industries":308,"functions":309,"patterns":310,"audience":31,"autonomy":32,"adoptionStage":82,"segment":34,"evidenceCount":191,"publicEvidenceCount":83,"organizations":312,"bestGrade":179,"headline":315,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":319},"digital-onboarding-assistant","AI assistant for digital account onboarding and KYC","Digital onboarding","A customer facing AI assistant that guides a new applicant, a person or a small merchant, through a digital account, card or relationship application: it collects and checks identity and supporting documents, orchestrates the know your customer and anti money laundering checks, prefills what it can and sends only the unclear cases to a human reviewer with a summary. The ownership research for complex corporate clients is a separate back office job.",[21,22,124],[262,234,24],[27,81,311,29],"computer-vision",[313,267,314],"Albo","M-DAQ Global",{"kpi":316,"label":317,"unit":318,"n":62,"nUpTo":45,"kind":46,"value":301,"qualifier":69,"claimant":225,"organization":314,"vendorReported":12},"productivity-gain","Productivity gain","multiplier","The conversational assistant falls under the Article 50 transparency duty. Biometric verification whose sole purpose is to confirm that a person is who they claim to be is excluded from the Annex III biometric category. The system becomes high risk when the same journey assesses creditworthiness or a credit score of a natural person, for example for a credit card or overdraft (Annex III point 5(b)).",{"slug":321,"title":322,"shortTitle":323,"definition":324,"status":19,"industries":325,"functions":328,"patterns":332,"audience":104,"autonomy":105,"adoptionStage":82,"evidenceCount":191,"publicEvidenceCount":113,"organizations":333,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":338},"procurement-contract-review","AI assistant for procurement and supplier contract review","Procurement and contract review","An assistant for procurement and vendor management that reads supplier contracts and proposals, extracts the key terms, flags deviations from the organization's standard positions, drafts requests for proposal and evaluation matrices, and prepares negotiation positions, with a procurement or legal owner approving every conclusion.",[95,21,326,123,327],"government","manufacturing",[329,330,331],"procurement","legal","finance-and-accounting",[81,30,103,29],[334,335,336,337],"General Services Administration","Administration for Children and Families","Internal Revenue Service","Walmart","Contract review and sourcing are not among the Annex III high risk uses, so an internal assistant that makes no decisions about natural persons is minimal risk (with the Article 4 AI literacy duty). If a negotiation bot chats directly with supplier staff, Article 50(1) applies and it must tell them they are dealing with an AI system, unless that is obvious from the context. Public authorities using AI in procurement should still check national public procurement rules on transparency and equal treatment of bidders.",{"slug":340,"title":341,"shortTitle":342,"definition":343,"status":19,"industries":344,"functions":346,"patterns":349,"audience":104,"autonomy":294,"adoptionStage":82,"segment":278,"evidenceCount":113,"publicEvidenceCount":113,"organizations":350,"bestGrade":40,"headline":355,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":356},"treasury-cash-flow-forecasting","AI cash flow forecasting for corporate treasury","Treasury cash forecasting","Machine learning and conversational analytics, offered by some banks inside their cash management platforms, that categorise a company's cash flows, forecast positions across accounts and currencies, and answer treasurers' questions in plain language, so the treasury team decides on funding and idle balances with better information and less spreadsheet work.",[21,95,345,123,327],"logistics-and-transportation",[347,331,348],"treasury","analytics-and-reporting",[175,80,27,29],[351,132,352,353,354],"Amtrak","Domino's Pizza","JPMorgan Chase","Prysmian",{"kpi":316,"label":317,"unit":44,"n":36,"nUpTo":62,"kind":46,"value":47,"qualifier":48,"claimant":49,"organization":353,"vendorReported":11},"Forecasting a company's cash flows is not listed in Annex III and makes no decision about a natural person, so the forecasting model itself carries no obligations beyond AI literacy (Article 4). The conversational layer interacts directly with treasury staff, so under Article 50(1) they must be informed that they are dealing with an AI system unless that is obvious from the context. Without a conversational layer the use case is minimal risk.",{"slug":358,"title":359,"shortTitle":360,"definition":361,"status":19,"industries":362,"functions":363,"patterns":367,"audience":368,"autonomy":32,"adoptionStage":82,"segment":369,"evidenceCount":35,"publicEvidenceCount":35,"organizations":370,"bestGrade":40,"headline":87,"lastVerified":268,"indexable":12,"euAiActTier":114,"euAiActBasis":375},"sme-cash-flow-underwriting","AI cash flow underwriting for small business loans","SME cash flow underwriting","An underwriting engine that assesses a small business's repayment capacity from live bank transactions, point of sale and payment flows, receivables and accounting data instead of audited accounts, and returns a decision recommendation with the evidence and reasons behind it.",[21],[364,365,366],"lending-and-credit","underwriting","risk-management",[175,81,29,27],"back-office","lending",[371,372,373,374],"MYbank","National Australia Bank","OakNorth Bank","Sumitomo Mitsui Banking Corporation","Annex III point 5(b) makes AI systems that evaluate the creditworthiness of natural persons or establish their credit score high risk. Scoring a company is outside that point, but a sole trader is a natural person, and a model that also assesses the personal credit of owners, partners or guarantors evaluates natural persons. The tier therefore depends on who the borrower is and whose creditworthiness the model assesses.",{"slug":377,"title":378,"shortTitle":379,"definition":380,"status":19,"industries":381,"functions":384,"patterns":385,"audience":104,"autonomy":105,"adoptionStage":33,"evidenceCount":191,"publicEvidenceCount":191,"organizations":386,"bestGrade":40,"headline":392,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":394},"developer-coding-assistant","AI coding assistant for software developers","Developer coding assistant","An AI assistant in the developer's IDE and code review flow that completes and generates code, explains unfamiliar modules, drafts unit tests and reviews pull requests for common defects, while generated code goes through the same review, testing and change controls as any other code.",[95,21,382,209,383],"capital-markets","professional-services",[212],[293],[387,388,132,389,390,391],"Accenture","ANZ","Citi","CME Group","Meta",{"kpi":316,"label":317,"unit":44,"n":83,"nUpTo":45,"kind":146,"value":393,"qualifier":69,"claimant":87,"organization":87,"vendorReported":11},20,"A coding assistant used by developers is not a prohibited practice under Article 5 and is not listed in Annex III. Developers know they are working with an AI tool, so the Article 50 disclosure duty has no practical effect for the deploying organization, and the marking of generated content under Article 50(2) falls on the tool's provider. What remains is AI literacy (Article 4). Using an AI system to monitor or evaluate individual developers' performance would fall under Annex III point 4(b), and the software the assistant helps build may itself fall under the Act.",{"slug":396,"title":397,"shortTitle":398,"definition":399,"status":19,"industries":400,"functions":401,"patterns":403,"audience":104,"autonomy":105,"adoptionStage":82,"segment":278,"evidenceCount":83,"publicEvidenceCount":83,"organizations":404,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":407},"client-briefing-and-call-report-copilot","AI copilot for corporate client briefings and call reports","Client briefing and call reports","An AI copilot for relationship managers, mainly in corporate and commercial banking, whose main job is preparation: before a client meeting it assembles a briefing pack from filings, news, internal notes, product holdings and upcoming maturities, and afterwards it turns the banker's notes into a structured call report and CRM update. Unlike a meeting notetaker, which centres on capturing the conversation, it centres on the credit and cross sell context around the meeting; wealth advisor tools that also prepare meetings overlap with it. The banker reviews every output.",[21,124,382],[234,402],"knowledge-management",[30,102,103,29],[132,405,406],"Scotiabank","Standard Chartered","Bankers interact with the copilot directly, but Article 50(1) does not bite here: it requires telling people they are dealing with an AI system unless that is obvious to a reasonably well informed person, and an internal tool that is openly presented and labelled as an AI assistant meets that bar by design. The copilot never interacts with the client. Article 50(2) marking of generated text falls on the provider of the system, including a bank that builds it in house, but the copilot turns a banker's own notes into a call report, an assistive function for standard editing of the banker's input that does not substantially alter it, so the Article 50(2) exception applies and no machine readable marking is required. It is not an Annex III use: credit context about corporate clients is not the creditworthiness assessment of natural persons in Annex III point 5(b), so it falls outside the high risk tier. If a deployment starts to score individuals for credit, the tier changes. AI literacy duties under Article 4 still apply. If meeting capture is used, recording and transcription rules under data protection law apply separately.",{"slug":409,"title":410,"shortTitle":411,"definition":412,"status":19,"industries":413,"functions":414,"patterns":415,"audience":104,"autonomy":105,"adoptionStage":61,"segment":106,"evidenceCount":35,"publicEvidenceCount":35,"organizations":416,"bestGrade":40,"headline":87,"lastVerified":268,"indexable":12,"euAiActTier":180,"euAiActBasis":421},"suspicious-activity-report-drafting","AI copilot for SAR and STR narrative drafting","SAR and STR drafting","Generative AI that drafts the narrative of a single suspicious activity or suspicious transaction report from the investigation file (who, what, when, where, why and how), with every fact linked to its source record, so the investigator verifies, edits and files instead of starting from a blank page. It works case by case, unlike the periodic data returns of regulatory reporting.",[21,22],[263,99],[103,102,30,29],[417,418,419,420],"Finshark","BMO and Amalgamated Bank","Nexo","Uphold","Drafting internal reports for a human investigator is not listed in Annex III (the law enforcement uses in point 6 cover systems used by or for law enforcement authorities, not a bank's own reporting), and the text is not published to inform the public, so the deployer disclosure duty for generated text in Article 50(4) does not apply. Confidentiality rules for suspicious activity reports and GDPR apply in full.",{"slug":423,"title":424,"shortTitle":425,"definition":426,"status":19,"industries":427,"functions":428,"patterns":429,"audience":104,"autonomy":105,"adoptionStage":82,"segment":365,"evidenceCount":214,"publicEvidenceCount":214,"organizations":430,"bestGrade":40,"headline":439,"lastVerified":268,"indexable":12,"euAiActTier":114,"euAiActBasis":442},"underwriting-risk-assessment-copilot","AI copilot for underwriting risk assessment","Underwriting risk assessment copilot","A copilot that assembles everything relevant to a risk (the submission, loss history, internal guidelines, third party data and public information), highlights exposures and gaps against the insurer's underwriting guidelines and drafts the underwriting narrative or referral note, while the underwriter makes and signs every decision.",[96],[365,366],[30,102,103,29],[431,432,433,434,435,436,437,438],"Accelerant Holdings","American International Group","Arch Capital Group","Bowhead Specialty","Generali Global Corporate & Commercial","Hiscox","Skyward Specialty Insurance Group","Zurich North America",{"kpi":440,"label":441,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":200,"qualifier":69,"claimant":225,"organization":435,"vendorReported":12},"processing-time-reduction","Cycle time reduction","For commercial property and casualty lines the copilot is not listed in Annex III. Used for risk assessment of natural persons in life or health insurance it falls under Annex III point 5(c) and is high risk, with risk management, data governance, logging and human oversight duties, and deployers must carry out a fundamental rights impact assessment under Article 27.",{"slug":444,"title":445,"shortTitle":446,"definition":447,"status":19,"industries":448,"functions":449,"patterns":450,"audience":104,"autonomy":294,"adoptionStage":33,"evidenceCount":35,"publicEvidenceCount":35,"organizations":451,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":455},"enterprise-knowledge-search","AI enterprise knowledge search for employees","Enterprise knowledge search","An assistant that lets any employee ask a question in plain language and get a synthesized answer from the organization's own policies, procedures, product manuals and research, with citations to the source documents and only from documents the employee is allowed to see.",[95,21,124,96,326,383],[402,25,24],[30,27,102],[132,452,453,454],"Morgan Stanley","SIGNAL IDUNA","Wells Fargo","Article 50(1) requires that people who interact directly with an AI system are informed of it, unless this is obvious from the context, as it usually is for an internal assistant. The system would be high risk only if it were intended for an Annex III purpose, such as assessing the creditworthiness of natural persons (point 5(b)) or making decisions on or evaluating workers (point 4(b)).",{"slug":457,"title":458,"shortTitle":459,"definition":460,"status":19,"industries":461,"functions":462,"patterns":463,"audience":368,"autonomy":32,"adoptionStage":82,"segment":278,"evidenceCount":83,"publicEvidenceCount":83,"organizations":464,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":468},"trade-document-examination","AI examination of trade documents under letters of credit and collections","Trade document examination","AI that reads the full document presentation under a letter of credit or collection (bill of lading, commercial invoice, packing list, certificates), extracts and cross checks the data, tests it against the instructions and the ICC rules (for letters of credit, the credit terms, UCP 600 and ISBP), and lists discrepancies by severity with the rule cited, so qualified examiners focus on the genuine exceptions.",[21],[25,100],[81,80,29,102],[465,466,467],"ANZ, HSBC and Lloyds Banking Group","Rand Merchant Bank","Stanbic Bank Uganda","Checking trade documents for compliance with credit terms is not listed in Annex III and does not decide about natural persons. AI literacy duties under Article 4 apply, and the process falls under the bank's operational resilience and model governance.",{"slug":470,"title":471,"shortTitle":472,"definition":473,"status":19,"industries":474,"functions":475,"patterns":476,"audience":104,"autonomy":32,"adoptionStage":82,"segment":106,"evidenceCount":214,"publicEvidenceCount":214,"organizations":478,"bestGrade":40,"headline":484,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":488},"aml-alert-triage","AI for AML transaction monitoring alert triage","AML alert triage","Machine learning and AI agents that score anti money laundering alerts for genuine risk, close clear false positives with a written and stored rationale, and hand investigators the remaining alerts already enriched with the customer, counterparty and transaction context.",[21,22],[263],[175,477,29,102],"anomaly-detection",[479,418,480,419,481,482,483,420],"Australia Post","HSBC","Ratepay","Shift4","United Overseas Bank (UOB)",{"kpi":485,"label":486,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":487,"qualifier":69,"claimant":225,"organization":482,"vendorReported":12},"false-positive-reduction","False positive reduction",86,"AML transaction monitoring is not listed in Annex III; point 5(b) covers creditworthiness and credit scoring and excludes systems used to detect financial fraud. The Article 5(1)(d) ban on predicting criminal offences from profiling alone does not apply to systems that support a human assessment already based on objective and verifiable facts linked to criminal activity, which is how alert triage should be designed. A decision to restrict an account taken solely by automated means would fall under GDPR Article 22 and national AML law, so consequential decisions need human review.",{"slug":490,"title":491,"shortTitle":492,"definition":493,"status":19,"industries":494,"functions":495,"patterns":496,"audience":368,"autonomy":32,"adoptionStage":82,"segment":368,"evidenceCount":83,"publicEvidenceCount":36,"organizations":497,"bestGrade":179,"headline":500,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":502},"account-servicing-execution","AI for back office account servicing execution","Account servicing execution","AI that executes the servicing requests that land in operations queues, such as address and mandate changes, standing instructions, beneficiary updates, reissues, payoff and reference letters and loan maintenance, by reading the request, checking it against policy and entitlements, and preparing or making the change in core systems under dual control.",[21,96,124],[25,364],[29,81,80],[498,499],"Banco Supervielle","SS&C Technologies",{"kpi":440,"label":441,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":501,"qualifier":69,"claimant":225,"organization":499,"vendorReported":12},95,"The tier depends on how the system is built. It stays minimal when the agent only executes changes approved by a person and any letter comes from a fixed template, since executing servicing changes is not listed in Annex III. It moves to limited risk when the same system talks to customers directly (the Article 50 transparency duty, described on the customer facing servicing page) or when generative AI drafts the confirmation or letter text: the provider of that generative function, the bank if it builds the system, then carries the Article 50(2) duty to mark the generated content in a machine readable way, unless the output only gets an assistive role or standard editing that does not substantially alter the input data. An AI system used to evaluate the creditworthiness of natural persons, for example to decide on a loan restructuring, is high risk under Annex III point 5(b); keep that assessment outside this agent, which only executes the decided change.",{"slug":504,"title":505,"shortTitle":506,"definition":507,"status":19,"industries":508,"functions":509,"patterns":510,"audience":368,"autonomy":32,"adoptionStage":61,"segment":278,"evidenceCount":83,"publicEvidenceCount":83,"organizations":511,"bestGrade":179,"headline":514,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":517},"business-onboarding-and-ubo-discovery","AI for business onboarding (KYB) and beneficial ownership discovery","Business onboarding and UBO","An AI agent that builds the know your business (KYB) due diligence file for a new or reviewed corporate client, before any account is opened: it collects registry, incorporation and ownership documents, resolves the entity across sources, maps the ownership chain through holding companies, nominees and trusts to the ultimate beneficial owners, screens the entity and its owners, and presents a risk scored case for a compliance analyst to decide.",[21,22,382],[262,263],[81,29,80,102],[512,513,314],"BNY","Incore Bank",{"kpi":515,"label":516,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":127,"qualifier":69,"claimant":49,"organization":512,"vendorReported":11},"automation-rate","Automation rate","Customer due diligence on legal entities is not listed in Annex III, and an internal analyst tool usually carries no Article 50 transparency duty, so the system is usually minimal risk. The design decides the rest: biometric verification that only confirms a director is who they claim to be is excluded from Annex III point 1(a), but remote biometric identification (one to many matching) is high risk, and so is any use of the output to assess the creditworthiness of the natural persons involved (point 5(b)). GDPR applies to the personal data of owners and directors throughout. Keep biometric and credit steps in separately assessed components.",{"slug":519,"title":520,"shortTitle":521,"definition":522,"status":19,"industries":523,"functions":524,"patterns":525,"audience":368,"autonomy":32,"adoptionStage":82,"segment":368,"evidenceCount":83,"publicEvidenceCount":36,"organizations":526,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":528},"chargeback-and-representment","AI for chargeback and representment operations","Chargeback and representment","AI that runs the dispute engine room for issuers, acquirers and merchants: it maps each dispute to the network reason code, gathers the matching evidence, assembles a network compliant chargeback or representment package, drafts the rebuttal, tracks every deadline and processes pre dispute alerts so a refund can be issued before a chargeback lands.",[22,21,123],[25,78,24],[29,81,103,80],[527,86],"GitHub","Dispute processing between issuers, acquirers and merchants is not listed in Annex III. It is not an evaluation of creditworthiness or credit scoring under Annex III point 5(b), and because cardholders do not interact with the system directly, the Article 50(1) transparency duty for AI that talks to people does not apply. Article 50(2) marking of generated text is a duty of the provider of the AI system that generates it, which includes an institution that builds its own dispute drafting agent and puts it into service under its own name. A drafted rebuttal built from attached case evidence performs an assistive function for standard editing of that evidence and does not substantially alter the underlying input, so it falls under the Article 50(2) exception and does not need machine readable marking. With that point checked, the tier stays minimal. A customer facing intake agent is assessed separately.",{"slug":530,"title":531,"shortTitle":532,"definition":533,"status":19,"industries":534,"functions":535,"patterns":537,"audience":368,"autonomy":32,"adoptionStage":82,"segment":536,"evidenceCount":538,"publicEvidenceCount":145,"organizations":539,"bestGrade":40,"headline":545,"lastVerified":268,"indexable":12,"euAiActTier":114,"euAiActBasis":547},"claims-triage-and-straight-through-processing","AI for claims triage and straight through processing","Claims triage and STP","AI that reads each new insurance claim and its documents, scores its complexity, cover questions, fraud and recovery signals, sends it to the right handling path and handler, and settles simple, low risk claims end to end within set limits without a person touching them.",[96],[536,25],"claims",[80,175,81,29,102],9,[540,541,436,194,542,543,544],"Admiral Seguros","Allianz Partners","Sedgwick","Tokio Marine & Nichido Fire Insurance","Travelers",{"kpi":515,"label":516,"unit":44,"n":62,"nUpTo":62,"kind":46,"value":546,"qualifier":48,"claimant":49,"organization":194,"vendorReported":11},55,"Claims handling as such is not listed in Annex III. The same system becomes high risk when it is also used for risk assessment and pricing of natural persons in life and health insurance (point 5(c)), or when it is used by or on behalf of a public authority to grant, reduce, revoke or reclaim essential public assistance benefits and services, including healthcare services (point 5(a)). Otherwise the tier is minimal, so the design and the operator decide. Decisions on claims based solely on automated processing are also subject to Article 22 of the GDPR and the UK GDPR.",{"slug":549,"title":550,"shortTitle":551,"definition":552,"status":19,"industries":553,"functions":554,"patterns":555,"audience":368,"autonomy":32,"adoptionStage":82,"segment":365,"evidenceCount":538,"publicEvidenceCount":538,"organizations":556,"bestGrade":40,"headline":562,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":566},"commercial-underwriting-submission-triage","AI for commercial underwriting submission intake and triage","Underwriting submission triage","AI that reads incoming broker submissions for commercial insurance (emails, applications, schedules of values, loss runs and supplements), extracts the risk data into a structured record, checks clearance and appetite, enriches the risk with internal and third party data and ranks it, so underwriters open a complete, prioritized file instead of an inbox.",[96],[365,25],[81,80,175,29],[432,557,558,435,436,559,560,561,437],"AXIS Capital","CNA Financial","Kinsale Capital Group","Markel","Paragon Insurance Group",{"kpi":563,"label":564,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":565,"qualifier":48,"claimant":49,"organization":561,"vendorReported":11},"accuracy","Accuracy",98,"Intake and triage for commercial insurance is not listed in Annex III, which covers risk assessment and pricing of natural persons in life and health insurance. It moves up to high risk only if the same pipeline is used to assess or price life or health cover for individuals.",{"slug":568,"title":569,"shortTitle":570,"definition":571,"status":19,"industries":572,"functions":573,"patterns":574,"audience":368,"autonomy":32,"adoptionStage":61,"segment":575,"evidenceCount":83,"publicEvidenceCount":83,"organizations":576,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":580},"continuous-controls-testing","AI for continuous controls testing and control self assessment","Continuous controls testing","AI that moves control testing from periodic samples to continuous, full population assurance: it collects evidence from source systems, maps each artefact to the control it supports, tests every transaction or record against the control's rule, flags exceptions for a human to judge and prepares the risk and control self assessment from incident and loss data for the business to review.",[95,21,96,382,326],[366,100,25],[29,81,477,80],"second-line",[577,578,579],"Federal Deposit Insurance Corporation","U.S. Department of the Interior","Pension Benefit Guaranty Corporation","Testing controls over transactions and systems is not an Annex III use. Controls that monitor and evaluate individual employees' behaviour, such as trading or access conduct, can fall under Annex III point 4(b), so the design decides the tier.",{"slug":582,"title":583,"shortTitle":584,"definition":585,"status":19,"industries":586,"functions":587,"patterns":588,"audience":368,"autonomy":32,"adoptionStage":33,"segment":368,"evidenceCount":191,"publicEvidenceCount":191,"organizations":589,"bestGrade":40,"headline":595,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":597},"correspondence-triage-and-routing","AI for inbound correspondence triage and routing","Correspondence triage and routing","AI that sorts inbound correspondence before anyone answers it: it takes every inbound letter, email, upload and secure message into one intake, identifies what it is, extracts the key fields, links it to the right customer and account, sets priority and routes it to the right team or workflow, replacing the manual sorting desk.",[95,21,96,326],[25,24,99],[80,81,102],[590,591,592,593,544,594],"Ecclesia Group","Encova Insurance","Loadsure","The Master Trust Bank of Japan","U.S. Department of Veterans Affairs",{"kpi":563,"label":564,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":596,"qualifier":69,"claimant":225,"organization":544,"vendorReported":12},91,"It depends on where the system runs. Classifying and routing a bank's or insurer's correspondence is not a use listed in Annex III, so it is minimal risk: the AI literacy duty of Article 4 applies, and the Article 50 duty to tell people they are dealing with AI does not, because the system does not interact with the sender. Used by or for a public authority in a benefits process covered by Annex III point 5(a), the provider can treat it as not high risk only while it performs a narrow procedural or preparatory task under Article 6(3); the provider must then document that assessment before it goes live (Article 6(4)) and register the system in the EU database (Article 49(2)). If the system evaluates eligibility for benefits or profiles the people who write in, it is high risk, so those judgements stay with people.",{"slug":599,"title":600,"shortTitle":601,"definition":602,"status":19,"industries":603,"functions":604,"patterns":605,"audience":104,"autonomy":105,"adoptionStage":82,"evidenceCount":191,"publicEvidenceCount":113,"organizations":606,"bestGrade":40,"headline":611,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":612},"aiops-incident-triage","AI for IT incident triage and root cause analysis (AIOps)","AIOps incident triage","AI that turns a flood of monitoring alerts into one probable incident, routes it to the right team, proposes likely root causes and remediation from runbooks and past incidents, and drafts the stakeholder updates and the post incident review, while an engineer authorizes every change.",[95,21,209,97,22],[212,25,366],[477,80,102,30,29],[607,391,608,609,610],"Google","Microsoft","Mizuho Financial Group","TD Bank",{"kpi":563,"label":564,"unit":44,"n":83,"nUpTo":45,"kind":146,"value":47,"qualifier":69,"claimant":87,"organization":87,"vendorReported":11},"An internal tool that supports engineers on IT incidents; it is not a use listed in Annex III and makes no decisions about people. Annex III point 2 covers AI used as a safety component in the management and operation of critical digital infrastructure, and recital 55 limits safety components to systems that directly protect the physical integrity of that infrastructure or the health and safety of persons and property. A triage copilot that proposes causes and fixes to engineers does not normally do that, but operators of critical digital infrastructure (cloud, data centers, telecom networks) should confirm this for their own design.",{"slug":614,"title":615,"shortTitle":616,"definition":617,"status":19,"industries":618,"functions":619,"patterns":620,"audience":368,"autonomy":32,"adoptionStage":82,"segment":368,"evidenceCount":35,"publicEvidenceCount":35,"organizations":621,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":626},"ledger-and-payment-reconciliation","AI for ledger and payment reconciliation","Ledger and payment reconciliation","AI that matches entries across nostro and vostro statements, card and scheme settlement files, the general ledger and suspense accounts, proposes matches and clearing journals, and routes only the genuine breaks to an operator with a plain language explanation.",[21,22,382,95,124,326],[331,25],[29,477,81],[622,623,624,625],"Comrade Trustee Services","Ginnie Mae","National Bank of Greece (Cyprus)","World Food Programme","Matching entries between internal financial records is not a use listed in Annex III and is not a practice prohibited by Article 5. Operators knowingly use an internal AI tool, so no Article 50(1) disclosure is needed. If a generative model drafts the explanations or journals, the provider of that system may have to mark its output as AI generated under Article 50(2). The AI literacy duty of Article 4 applies to the bank as deployer.",{"slug":628,"title":629,"shortTitle":630,"definition":631,"status":19,"industries":632,"functions":634,"patterns":635,"audience":104,"autonomy":105,"adoptionStage":82,"evidenceCount":191,"publicEvidenceCount":113,"organizations":636,"bestGrade":40,"headline":639,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":640},"legacy-code-modernization","AI for legacy code modernization","Legacy code modernization","AI that reads legacy code such as COBOL, PL/I or old Java, explains what each program does, maps its data flows and dependencies, drafts the equivalent modern code or specification, and generates the regression tests needed to prove the new system behaves like the old one.",[95,21,382,633,209],"automotive",[212],[293,102,29],[131,637,607,452,638],"Amazon","Toyota Motor Europe",{"kpi":440,"label":441,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":200,"qualifier":48,"claimant":49,"organization":607,"vendorReported":11},"Tools that analyze, document and translate code are not prohibited practices under Article 5 and are not listed in Annex III, so no high risk obligations apply to the tooling. Engineers and analysts know they are working with an AI tool, including when they query the documentation through a chat assistant, so the Article 50 disclosure duty has no practical effect for the deploying organization. What remains is AI literacy for the staff who use it (Article 4). If the system being modernized is itself an AI system in an Annex III area (for example creditworthiness assessment, point 5(b)), its new version still has to meet the high risk requirements.",{"slug":642,"title":643,"shortTitle":644,"definition":645,"status":19,"industries":646,"functions":647,"patterns":648,"audience":368,"autonomy":32,"adoptionStage":82,"evidenceCount":35,"publicEvidenceCount":35,"organizations":649,"bestGrade":40,"headline":653,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":657},"merchant-underwriting-and-risk-monitoring","AI for merchant underwriting and risk monitoring","Merchant underwriting and monitoring","AI that helps acquirers, payment facilitators and software platforms with embedded payments decide which merchants to accept and on what terms, by checking what a business really sells and how risky it is at onboarding, and then watches every active merchant for changes in behaviour, ranking the few that need an analyst so fraud, prohibited trade and credit losses are caught early.",[22,209,21],[262,78,366],[175,477,80,102,29],[650,651,86,652],"Airwallex","Tekmetric","Weave Communications",{"kpi":654,"label":655,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":656,"qualifier":48,"claimant":225,"organization":652,"vendorReported":12},"alert-volume-reduction","Alert volume reduction",89,"Assessing businesses and detecting fraud is not an Annex III use as such, and Annex III point 5(b) excludes systems used to detect financial fraud. If the system evaluates the creditworthiness of a natural person, for example a sole trader applying to accept payments, it can fall under Annex III point 5(b), which covers evaluating the creditworthiness of natural persons or establishing their credit score, and be high risk. Keep credit assessment of individuals separate or treat it as a high risk system.",{"slug":659,"title":660,"shortTitle":661,"definition":662,"status":19,"industries":663,"functions":664,"patterns":665,"audience":368,"autonomy":105,"adoptionStage":82,"segment":106,"evidenceCount":83,"publicEvidenceCount":83,"organizations":666,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":670},"mule-network-detection","AI for money mule account and network detection","Mule network detection","Graph and behavioural machine learning that finds money mule accounts and the networks around them, such as circular flows, layering chains and clusters of newly linked accounts, and supports investigators in tracing scam proceeds and restricting accounts before the money is gone.",[21,22],[78,263],[477,175,29,102],[667,668,669],"BigPay","ANZ, Commonwealth Bank, NAB, Suncorp Bank and Westpac (BioCatch Trust Australia)","Reserve Bank Innovation Hub (Reserve Bank of India)","Detecting mule accounts is fraud and AML detection by a private firm, which Annex III does not list; point 5(b) explicitly excludes systems used to detect financial fraud from the credit scoring category. Restricting an account based solely on an automated score can be a decision with similarly significant effects under GDPR Article 22, so keep a human decision and a route to challenge.",{"slug":672,"title":673,"shortTitle":674,"definition":675,"status":19,"industries":676,"functions":677,"patterns":678,"audience":368,"autonomy":32,"adoptionStage":61,"segment":368,"evidenceCount":36,"publicEvidenceCount":36,"organizations":679,"bestGrade":40,"headline":680,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":682},"payment-investigations-and-exceptions","AI for payment investigations and exceptions","Payment investigations and exceptions","AI that works the payments that fall out of straight through processing: it reads the failure, repairs or enriches the message, drafts the ISO 20022 or SWIFT investigation, chases the counterparty bank and proposes a return, recall or correction, while an operator approves anything that moves money.",[21,22],[25,24],[29,81,80,103],[512,353],{"kpi":515,"label":516,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":681,"qualifier":201,"claimant":49,"organization":512,"vendorReported":11},10,"Handling payment exceptions is not a use listed in Annex III and is not a prohibited practice under Article 5. If the agent interacts directly with customers, for example in a chat about the case, Article 50(1) requires that they are told they are interacting with an AI system.",{"slug":684,"title":685,"shortTitle":686,"definition":687,"status":19,"industries":688,"functions":689,"patterns":690,"audience":104,"autonomy":105,"adoptionStage":61,"segment":368,"evidenceCount":36,"publicEvidenceCount":36,"organizations":691,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":694},"regulatory-report-assembly","AI for regulatory report assembly","Regulatory report assembly","AI that assembles periodic and data driven regulatory filings and returns, such as prudential and statistical returns, threshold and transaction reports and disclosure packs, by pulling data into the regulator's schema, validating it, reconciling figures to source, explaining movements against prior periods and drafting commentary, before a named officer reviews and submits. Narratives for individual suspicious activity cases are a separate use case.",[21,96,382,22],[100,331,263],[29,477,103,102],[692,693],"Board of Governors of the Federal Reserve System","National Credit Union Administration","Not an Article 5 practice and not listed in Annex III: the system prepares filings for authorities and makes no decision on the credit, insurance, employment or access to services of a natural person. It is an internal tool whose users know they are working with AI, and drafted text that ends up in public disclosures passes human review under a named person's editorial responsibility, which takes it outside the Article 50(4) deployer disclosure duty. The system still drafts variance commentary and plain language explanations of validation failures from underlying data, rather than lightly editing existing text, so the assistive function for standard editing exception does not fit. The bank that builds or operates the system is then the provider and carries the Article 50(2) duty to mark that generated text in a machine readable way as artificially generated, which has applied since 2 August 2026. The AI literacy duty of Article 4 also applies.",{"slug":696,"title":697,"shortTitle":698,"definition":699,"status":19,"industries":700,"functions":701,"patterns":702,"audience":368,"autonomy":32,"adoptionStage":82,"segment":106,"evidenceCount":145,"publicEvidenceCount":145,"organizations":703,"bestGrade":40,"headline":707,"lastVerified":268,"indexable":12,"euAiActTier":180,"euAiActBasis":709},"sanctions-screening-adjudication","AI for sanctions screening alert adjudication","Sanctions screening adjudication","AI that works the alerts raised when customer, counterparty or payment names match sanctions and watchlists: it resolves fuzzy matches across transliterations, aliases and naming conventions, clears clear non matches with a documented reason, and escalates true or uncertain hits with the evidence attached.",[21,22],[263],[80,175,29],[704,705,480,706,481,406,483],"AJ Bell","First National Bank of Omaha (FNBO)","Mashreq",{"kpi":485,"label":486,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":708,"qualifier":69,"claimant":49,"organization":483,"vendorReported":11},60,"Sanctions screening by banks and payment firms is not listed in Annex III: point 5 covers credit scoring and life and health insurance pricing, and point 6 covers AI used by or on behalf of law enforcement authorities. It is not a prohibited practice under Article 5, and as an internal tool it carries no Article 50 transparency duty. It still processes personal data at scale, so GDPR applies, and decisions that block a payment or freeze assets remain human decisions.",{"slug":711,"title":712,"shortTitle":713,"definition":714,"status":19,"industries":715,"functions":716,"patterns":718,"audience":104,"autonomy":32,"adoptionStage":82,"evidenceCount":145,"publicEvidenceCount":145,"organizations":719,"bestGrade":40,"headline":727,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":728},"security-alert-triage-and-investigation","AI for security alert triage and investigation in the SOC","Security alert triage","An AI agent in the security operations centre that picks up each new alert or user reported phishing email, gathers the evidence from the SIEM, endpoint, identity and threat intelligence tools, gives a verdict with its reasoning and a draft incident summary, and closes clear false positives while an analyst approves every containment action.",[95,210,209,326,383],[717,212],"security-operations",[29,80,102,30],[720,721,722,723,724,725,726],"Avanade","Federal Housing Finance Agency","Human Managed","SEP2","St. Luke's University Health Network","TÜV SÜD","U.S. Immigration and Customs Enforcement",{"kpi":316,"label":317,"unit":44,"n":83,"nUpTo":45,"kind":146,"value":708,"qualifier":69,"claimant":87,"organization":87,"vendorReported":11},"Triage of phishing, endpoint, network and cloud alerts for an organization's own cyber defence is not listed in Annex III. Recital 55 of the AI Act says that components intended to be used solely for cybersecurity purposes should not qualify as safety components, so the agent does not fall under Annex III point 2 (critical infrastructure), and for this scope the tier is minimal. The design changes that when the agent triages identity, data loss prevention, insider risk or user behaviour alerts in a way that scores or monitors individual employees: monitoring and evaluating the behaviour of persons in a work relationship falls under Annex III point 4(b), so that scope needs its own high risk assessment before it goes live. The Article 50(1) duty to disclose AI interaction does not apply because it is obvious to a reasonably well informed analyst that they are working with an AI agent. An operator that lets AI act autonomously on network or operational technology controls should assess that design separately, and reading employees' emails and sign in data remains subject to data protection law.",{"slug":730,"title":731,"shortTitle":732,"definition":733,"status":19,"industries":734,"functions":735,"patterns":736,"audience":368,"autonomy":105,"adoptionStage":82,"segment":368,"evidenceCount":35,"publicEvidenceCount":35,"organizations":737,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":740},"settlement-fail-prediction-and-exception-management","AI for settlement fail prediction and post trade exception management","Settlement fail prediction","AI that scores each pending securities settlement instruction for its likelihood of failing, names the probable cause (unmatched instruction, wrong settlement details, lack of securities or cash), and helps operations teams work the exceptions and counterparty queries before the intended settlement date, so fewer trades fail and fewer late settlement penalties are paid.",[382,21,124],[25,366],[175,80,29,103],[512,738,739],"Clearstream","Euroclear","Predicting settlement fails and handling post trade exceptions between professional market participants is not a use listed in Annex III and is not a prohibited practice under Article 5, so the tier depends on how the agent communicates. While an operator reviews and sends every message, the system is minimal risk: the messages are the firm's own correspondence and the firm as deployer owes AI literacy for staff (Article 4). Once the agent sends queries or chasers to counterparty or custodian staff itself, as the playbook recommends for routine information requests, it interacts directly with natural persons and Article 50(1) requires telling the recipients they are dealing with an AI system. In both designs the provider of the text generating system must mark its output as AI generated in a machine readable format under Article 50(2). Model risk and operational resilience controls apply on top.",{"slug":742,"title":743,"shortTitle":744,"definition":745,"status":19,"industries":746,"functions":747,"patterns":748,"audience":104,"autonomy":105,"adoptionStage":82,"evidenceCount":35,"publicEvidenceCount":35,"organizations":749,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":752},"software-vulnerability-remediation","AI for software vulnerability triage and remediation","Vulnerability remediation","AI that takes security findings from scanners, fuzzers and bug reports, filters out duplicates and false positives, reproduces and ranks the real ones, and drafts a code fix with a test for each, which a developer reviews and merges through the normal change process.",[95,209,210],[717,212],[293,29,80],[607,750,751],"Labelbox","PatientPoint","Drafting and triaging code fixes for an organization's own software is not an Annex III use, and developers, not the public, interact with the system. The software being fixed remains subject to its own security and resilience rules, whoever wrote the fix.",{"slug":754,"title":755,"shortTitle":756,"definition":757,"status":19,"industries":758,"functions":759,"patterns":760,"audience":104,"autonomy":105,"adoptionStage":61,"segment":575,"evidenceCount":83,"publicEvidenceCount":83,"organizations":761,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":764},"supervisory-exam-response-assembly","AI for supervisory exam and information request responses","Exam response assembly","An assistant for the bank's regulatory affairs team that reads a supervisory information request or exam question, retrieves the relevant evidence, policies and prior correspondence, drafts a response for legal and compliance to approve, and tracks every commitment and remediation action through to closure.",[21,96,382,22],[100,330,99],[30,103,81,29],[762,763],"U.S. Department of Homeland Security","Federal Emergency Management Agency","Drafting regulatory correspondence for human approval is not an Annex III use. The main risks are confidentiality and accuracy, which are handled by supervisory information rules, data protection law and internal controls.",{"slug":766,"title":767,"shortTitle":768,"definition":769,"status":19,"industries":770,"functions":772,"patterns":773,"audience":368,"autonomy":32,"adoptionStage":33,"segment":368,"evidenceCount":113,"publicEvidenceCount":35,"organizations":774,"bestGrade":40,"headline":777,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":779},"supplier-invoice-processing","AI for supplier invoice processing in accounts payable","Supplier invoice processing","AI that captures supplier invoices from any format, extracts header and line data, matches them to purchase orders and goods receipts, proposes tax and cost centre coding, flags duplicates and suspected fraud, and routes them for approval and posting, leaving only exceptions to accounts payable staff.",[95,21,326,123,771],"energy-and-utilities",[331,329],[81,29,477,80],[577,775,726,776],"Kingfisher","Veolia",{"kpi":316,"label":317,"unit":44,"n":62,"nUpTo":62,"kind":46,"value":778,"qualifier":69,"claimant":49,"organization":775,"vendorReported":11},80,"Processing supplier invoices is not an Annex III use case, is not a practice prohibited by Article 5 and does not involve decisions about natural persons, so it is minimal risk and the AI literacy duty of Article 4 applies. Approvers who ask questions in chat use an internal tool they know is AI; if that is not obvious to the people using it, the provider must also inform them that they are interacting with an AI system (Article 50(1)).",{"slug":781,"title":782,"shortTitle":783,"definition":784,"status":19,"industries":785,"functions":786,"patterns":787,"audience":368,"autonomy":32,"adoptionStage":82,"evidenceCount":214,"publicEvidenceCount":145,"organizations":789,"bestGrade":40,"headline":795,"lastVerified":268,"indexable":12,"euAiActTier":114,"euAiActBasis":797},"synthetic-test-data-generation","AI for synthetic test data generation","Synthetic test data generation","AI that generates realistic synthetic datasets, such as customers, transactions, documents and conversations, which keep the structure and statistical properties of production data without containing real personal data, so teams can test software, train and validate models and run demos safely.",[95,21,210,96],[212,348],[788,103],"synthetic-data-generation",[790,791,336,353,792,793,794],"Boomi","Financial Conduct Authority","Kin Insurance","Merkur Versicherung AG","Patterson Dental",{"kpi":440,"label":441,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":796,"qualifier":69,"claimant":225,"organization":794,"vendorReported":12},75,"A generator of synthetic tabular test data is not listed in Annex III and does not interact with people, so it is minimal risk with only the AI literacy duty of Article 4. When the system generates synthetic text, images, audio or video, such as documents or conversation transcripts, Article 50(2) requires its provider to mark the output in a machine readable format as artificially generated. When synthetic data is used to train, validate or test a high risk system, such as credit scoring, it falls under that system's data governance duties in Article 10.",{"slug":799,"title":800,"shortTitle":801,"definition":802,"status":19,"industries":803,"functions":804,"patterns":805,"audience":104,"autonomy":105,"adoptionStage":82,"segment":575,"evidenceCount":35,"publicEvidenceCount":35,"organizations":806,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":810},"vendor-due-diligence","AI for third party and vendor risk due diligence","Vendor due diligence","AI that reviews a vendor's security questionnaires, SOC and assurance reports, contracts and model documentation against the organization's control requirements, researches the vendor's ownership, sanctions, financial health and adverse media, drafts the risk assessment for a human to approve and keeps the register of material service providers current with ongoing monitoring.",[95,21,96,326,22],[329,366,100],[81,30,29,102],[807,336,808,809],"U.S. Department of Justice","U.S. Department of Agriculture","U.S. Trade and Development Agency","Assessing organizations as vendors is not an Annex III use. If assessments score individual natural persons, such as sole traders, check the design against Annex III and data protection rules. The EU AI Act also shapes what to ask AI vendors, since providers of high risk systems carry specific obligations.",{"slug":812,"title":813,"shortTitle":814,"definition":815,"status":19,"industries":816,"functions":817,"patterns":818,"audience":368,"autonomy":105,"adoptionStage":82,"segment":106,"evidenceCount":83,"publicEvidenceCount":36,"organizations":820,"bestGrade":179,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":822},"portfolio-reporting-and-commentary","AI generated client portfolio reports and commentary","Portfolio commentary","AI that drafts each client's periodic portfolio commentary and report narrative (performance, attribution, what drove returns, positioning and outlook) in plain language and in the client's language, where every figure comes from the portfolio system of record and a reviewer approves the text before delivery.",[124,21],[348,24,25],[103,102,819],"translation",[452,821],"Quilter","Drafting client reports for human review is not listed in Annex III and is not a practice prohibited by Article 5, so the tier turns on the firm's role under Article 50. A firm that deploys a third party generator (for example a feature of its portfolio platform) for private client reports has no Article 50 duty: the Article 50(4) disclosure duty covers AI generated text published to inform the public on matters of public interest, which private client reports are not, and it lapses anyway after human review under editorial responsibility. For that firm the tier is minimal. A firm that builds the generating system or places it on the market under its own name is a provider under Article 50(2) and must mark the synthetic text in a machine readable format; drafting whole commentaries goes beyond the exemption for an assistive function for standard editing, so for that firm the tier is limited.",{"slug":824,"title":825,"shortTitle":826,"definition":827,"status":19,"industries":828,"functions":830,"patterns":831,"audience":31,"autonomy":32,"adoptionStage":82,"segment":34,"evidenceCount":83,"publicEvidenceCount":83,"organizations":832,"bestGrade":179,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":836},"home-loan-assistant-and-prequalification","AI home loan assistant with pre qualification","Home loan assistant","A customer facing assistant that answers home loan questions (rates, loan to value, fees, the documents needed), runs indicative affordability and borrowing estimates from the bank's published rules, and books the customer with a mortgage specialist, grounded in the bank's current, versioned product and policy documents.",[21,829],"real-estate",[364,234,24],[30,27,28],[833,834,835],"Figure","Loft","Safe Rate","Answering questions and giving indicative estimates from published rules is limited risk with an Article 50(1) disclosure that the customer is talking to an AI system. If the assistant evaluates an individual's creditworthiness to decide or filter access to a loan, it falls under Annex III point 5(b) and is high risk.",{"slug":838,"title":839,"shortTitle":840,"definition":841,"status":19,"industries":842,"functions":843,"patterns":844,"audience":104,"autonomy":294,"adoptionStage":33,"segment":34,"evidenceCount":191,"publicEvidenceCount":191,"organizations":845,"bestGrade":40,"headline":87,"lastVerified":268,"indexable":12,"euAiActTier":51,"euAiActBasis":848},"wealth-advisor-knowledge-assistant","AI knowledge assistant for wealth advisors and relationship managers","Advisor knowledge assistant","A conversational assistant that answers a wealth advisor's or relationship manager's questions in seconds from the firm's own research, house view, product documentation and policies, with every answer linked to the source document so the advisor can check it before using it with a client.",[124,21],[402,234,24],[30,27],[132,389,353,452,846,847],"UBS","Yes Bank","Article 50(1) requires that people who interact directly with an AI system are informed of it, unless this is obvious from the context, as it usually is for an internal assistant labelled as AI; Article 50(2) requires providers of systems that generate text to mark the output as AI generated in a machine readable way. Helping advisors find information is not an Annex III use and not a prohibited practice under Article 5. It would become high risk only if the system were used to evaluate the creditworthiness of clients (point 5(b)) or to evaluate or make decisions about advisors (point 4(b)). If the assistant were opened to clients, they would have to be told they are dealing with AI.",{"slug":850,"title":851,"shortTitle":852,"definition":853,"status":19,"industries":854,"functions":855,"patterns":856,"audience":104,"autonomy":105,"adoptionStage":33,"segment":34,"evidenceCount":191,"publicEvidenceCount":191,"organizations":858,"bestGrade":40,"headline":861,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":863},"client-meeting-notes-and-crm-update","AI meeting notes and CRM update for wealth advisors","Advisor meeting notes","An AI notetaker for wealth advisors that turns a client advice meeting, recorded with the client's consent, into the file note, follow up message and CRM record the firm needs to evidence its advice; unlike a general meeting summarizer, its output becomes part of the regulated client record. It drafts a structured note with the client's goals, circumstances, decisions and action items, and writes it into the CRM once the advisor has approved it.",[124,21],[234,100,25],[102,857,29,103],"speech-analytics",[132,859,452,821,178,860],"Commerzbank","UniSuper",{"kpi":316,"label":317,"unit":44,"n":62,"nUpTo":45,"kind":46,"value":862,"qualifier":69,"claimant":225,"organization":178,"vendorReported":12},15,"Transcribing and summarizing meetings for an employee is not a use listed in Annex III, and the advisor reviews every note before it is filed or sent. The tier would change if the tool inferred emotions: emotion recognition is high risk under Annex III point 1(c), and inferring the emotions of employees at work is prohibited under Article 5(1)(f). Both stay out of scope.",{"slug":865,"title":866,"shortTitle":867,"definition":868,"status":19,"industries":869,"functions":870,"patterns":871,"audience":31,"autonomy":105,"adoptionStage":61,"segment":278,"evidenceCount":36,"publicEvidenceCount":36,"organizations":872,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":873},"corporate-account-onboarding-orchestration","AI orchestration of corporate account opening and channel setup","Corporate onboarding operations","An AI agent that runs the operational setup of a corporate client after the due diligence has been approved: it reads mandates, board resolutions and signatory documents, prepares accounts, users, roles and payment entitlements for approval, configures channel access, and chases outstanding items with the client, turning a manual setup that passes between several teams into a tracked, guided flow.",[21],[262,25],[29,81,27,103],[389,406],"Operational setup of accounts and entitlements for corporate clients is not listed in Annex III and makes no decision about a natural person's access to a service or creditworthiness. The agent chases documents directly with client staff, so Article 50(1) applies: the provider must design the system so that they are informed that they are interacting with an AI system, unless that is obvious from the context. A purely internal version without client contact would be minimal risk.",{"slug":875,"title":876,"shortTitle":877,"definition":878,"status":19,"industries":879,"functions":880,"patterns":881,"audience":368,"autonomy":105,"adoptionStage":61,"segment":106,"evidenceCount":35,"publicEvidenceCount":83,"organizations":882,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":885},"portfolio-drift-monitoring-and-rebalancing","AI portfolio drift monitoring and rebalancing proposals","Drift and rebalancing","Continuous monitoring of every client portfolio against its mandate or model, which detects drift beyond agreed bands and prepares a tax aware, low turnover rebalancing proposal with its rationale for an advisor or portfolio manager to approve before any trade is placed.",[124,21],[25,366,348],[477,29,175,103],[452,883,884],"SimCorp","Vanguard","Monitoring portfolios and proposing trades for human approval is not listed in Annex III and is not a prohibited practice under Article 5, so the tier turns on the firm's role under Article 50. A firm that builds or brands the rationale writer in house is a provider under Article 50(2) and must mark the generated text in a machine readable format: drafting a rationale for the drift and the proposed trades goes beyond the exemption for an assistive function for standard editing, so for that firm the tier is limited. Article 50(1) also applies once the rationale reaches the client, as this page's own implementation step allows. A firm that only deploys a third party feature for internal approver use has no Article 50 duty, and for that firm the tier is minimal. Investment conduct rules such as MiFID II suitability and best execution still apply to the resulting trades.",{"slug":887,"title":888,"shortTitle":889,"definition":890,"status":19,"industries":891,"functions":893,"patterns":894,"audience":104,"autonomy":294,"adoptionStage":82,"segment":895,"evidenceCount":35,"publicEvidenceCount":36,"organizations":896,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":897},"regulatory-horizon-scanning","AI regulatory horizon scanning and obligation mapping","Regulatory horizon scanning","An AI system that continuously reads publications from the regulators and standard setters an organization answers to, classifies each item by relevance and urgency, breaks new rules into individual obligations and maps them to the internal policies and controls that meet them, so compliance owners see what changed and where the gaps are.",[95,21,96,22,124,892,326],"pharma-and-life-sciences",[100,330,366],[80,81,30,102,29],"compliance",[791,335],"An internal tool that monitors and classifies regulatory publications for staff makes no decisions about natural persons, so it is not listed in Annex III and is not a prohibited practice under Article 5. Staff know they are using an AI tool and its summaries are not published to the public, so the Article 50 duties to inform users and to disclose published generated text add little for the deploying organization. Article 50(2) still requires the provider of a system that generates text to mark its output, in a machine readable format, as AI generated: usually the vendor, but an organization that builds its own summariser can itself be that provider, which is what puts this use case at the limited tier rather than minimal. Beyond this and AI literacy (Article 4), no specific obligations apply. General model risk and third party rules still apply.",{"slug":899,"title":900,"shortTitle":901,"definition":902,"status":19,"industries":903,"functions":904,"patterns":905,"audience":31,"autonomy":32,"adoptionStage":82,"segment":34,"evidenceCount":191,"publicEvidenceCount":191,"organizations":906,"bestGrade":40,"headline":909,"lastVerified":268,"indexable":12,"euAiActTier":51,"euAiActBasis":913},"scam-payment-interception","AI scam intervention for instant payments","Scam payment interception","AI that talks to the customer when they are about to authorise an instant payment that looks like a scam: it combines the payee check and the risk score, asks targeted questions about the payment in plain language, explains the specific scam pattern, and holds, delays or escalates the payment to a human specialist when the risk stays high. Unlike fraud scoring, which stops payments the customer did not make, it protects customers from payments they are being manipulated into making.",[21,22],[78,24],[27,175,29,28],[38,907,160,908,143,161],"Mastercard","Starling Bank",{"kpi":910,"label":911,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":912,"qualifier":69,"claimant":225,"organization":908,"vendorReported":12},"detection-rate-improvement","Detection improvement",300,"Annex III point 5(b) expressly excludes AI systems used to detect financial fraud from the high risk creditworthiness category, so the scoring is not high risk. The conversational part must disclose that it is AI under Article 50(1). If a voice component infers the customer's emotions from their voice, it becomes an emotion recognition system under Annex III point 1(c), which is high risk and needs the Article 50(3) notice, so keep coaching detection to what is said rather than to biometric signals.",{"slug":915,"title":916,"shortTitle":917,"definition":918,"status":19,"industries":919,"functions":920,"patterns":921,"audience":368,"autonomy":32,"adoptionStage":61,"segment":278,"evidenceCount":83,"publicEvidenceCount":83,"organizations":922,"bestGrade":179,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":924},"trade-finance-crime-screening","AI screening of trade finance transactions for trade based money laundering","Trade crime screening","AI that screens every trade finance transaction for financial crime risk: it checks parties, vessels and ports against sanctions and watchlists, tests goods descriptions against dual use and controlled goods lists, compares unit prices with benchmarks for over or under invoicing, and reads trade documents and messages for laundering red flags, then prepares a case narrative for a human investigator.",[21],[263,25],[81,477,80,102],[465,467,923],"United Bank Limited","Financial crime screening of trade transactions is not listed in Annex III. It still processes personal data of individual parties, so GDPR applies, and supervisors expect it to be governed like any financial crime model.",{"slug":926,"title":927,"shortTitle":928,"definition":929,"status":19,"industries":930,"functions":931,"patterns":932,"audience":104,"autonomy":105,"adoptionStage":82,"segment":34,"evidenceCount":35,"publicEvidenceCount":35,"organizations":933,"bestGrade":40,"headline":934,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":937},"investment-research-summarization","AI summaries of investment research and the house view","Research summaries","An AI assistant that condenses long research reports, overnight market moves and the house view into short, sourced briefings for advisors and analysts, answers \"what is our view on X\" on demand, and adapts approved research for different client segments and languages, with every figure traced to the original research.",[124,382,21],[348,234,402],[102,30,103,819],[389,267,452,846],{"kpi":110,"label":111,"unit":112,"n":45,"nUpTo":62,"kind":46,"value":935,"qualifier":936,"claimant":49,"organization":267,"vendorReported":11},120,"up-to","Summarizing research for staff is not an Annex III use and is not a practice prohibited by Article 5, so the tier turns on the firm's role under Article 50. It is minimal for a purchased internal tool with no client or public facing exposure. Article 50 transparency applies when the firm builds the generating system itself, which brings the Article 50(2) duty to mark synthetic text in a machine readable format; when the assistant is offered to clients as a chatbot, which brings the Article 50(1) duty to tell them they are interacting with AI; or when AI generated text is published to inform the public on matters of public interest, which brings the Article 50(4) disclosure duty unless the text has gone through human review or editorial control and a person holds editorial responsibility for it.",{"slug":939,"title":940,"shortTitle":941,"definition":942,"status":19,"industries":943,"functions":944,"patterns":945,"audience":104,"autonomy":105,"adoptionStage":82,"segment":365,"evidenceCount":36,"publicEvidenceCount":36,"organizations":946,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":949,"euAiActBasis":950},"life-underwriting-medical-record-summarization","AI summarization of medical evidence for life and health underwriting","Life underwriting medical summaries","AI that reads the medical evidence behind a life or health insurance application (attending physician statements, electronic health records, lab results and disclosures), turns it into a structured, cited summary of conditions, treatments and dates, and maps it to the insurer's underwriting manual so an underwriter can decide faster and more consistently.",[96],[365],[81,102,30],[947,948],"Manulife","Prudential plc","high","Annex III point 5(c): AI intended for risk assessment and pricing in relation to natural persons in life and health insurance. Article 6(3) exempts some purely preparatory tasks, but never a system that profiles natural persons. Extracting an applicant's health conditions and mapping them to the underwriting manual evaluates their health, which is profiling, so treat the system as high risk. Under the timeline as amended, the obligations for Annex III high risk systems apply from 2 December 2027, and Article 27 requires deployers of point 5(c) systems to assess the impact on fundamental rights before first use.",{"slug":952,"title":953,"shortTitle":954,"definition":955,"status":19,"industries":956,"functions":957,"patterns":958,"audience":104,"autonomy":105,"adoptionStage":82,"evidenceCount":35,"publicEvidenceCount":35,"organizations":959,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":962},"ai-model-inventory","AI system and model inventory with shadow AI discovery","AI model inventory","A governed register of every AI system and model an organization builds, buys or uses, with its owner, purpose, data, risk tier and approval status, kept current by AI that discovers unregistered use, reads the documentation and assembles the evidence a board, auditor or supervisor asks for.",[95,21,96,326,327],[366,100,212],[29,81,30,80],[692,960,961,807],"Office of Management and Budget","Unilever","Minimal for a system level register of systems and owners with no monitoring of individual employees; it is not listed in Annex III and is the instrument deployers use to meet obligations such as the Article 26 duties for high risk systems and the Article 49 registration of Annex III systems in the EU database. Limited where the plain language assistant that staff and auditors query is not obviously an AI system to its users: under Article 50(1) its provider must then design it so people are told they are dealing with AI. Possibly high risk under Annex III point 4(b) on worker management if the discovery process monitors or evaluates the behavior of individual employees rather than staying at the level of systems and owners.",{"slug":964,"title":965,"shortTitle":966,"definition":967,"status":19,"industries":968,"functions":969,"patterns":970,"audience":104,"autonomy":105,"adoptionStage":61,"evidenceCount":191,"publicEvidenceCount":113,"organizations":971,"bestGrade":40,"headline":976,"lastVerified":268,"indexable":12,"euAiActTier":180,"euAiActBasis":978},"requirements-to-test-case-generation","AI that turns requirements into user stories, acceptance criteria and test cases","Requirements to test cases","AI that reads product requirements, specifications or recorded sessions, checks them for gaps, ambiguity and contradictions, and drafts structured user stories, acceptance criteria and test cases (for example in Gherkin) that QA engineers review, with each item traced back to the requirement it covers.",[209,326,21,95],[212],[103,81],[972,973,974,975,594],"BrowserStack","Continental AG","LTIMindtree","National Aeronautics and Space Administration",{"kpi":440,"label":441,"unit":44,"n":62,"nUpTo":62,"kind":46,"value":977,"qualifier":69,"claimant":225,"organization":974,"vendorReported":12},67,"An internal assistant that drafts requirements artifacts and test cases for engineers is not listed in Annex III and does not interact with the public, so no specific obligations apply beyond AI literacy (Article 4). The system under test may itself fall under the Act.",{"slug":980,"title":981,"shortTitle":982,"definition":983,"status":19,"industries":984,"functions":985,"patterns":986,"audience":31,"autonomy":32,"adoptionStage":82,"segment":987,"evidenceCount":62,"publicEvidenceCount":62,"organizations":988,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":989},"conversational-insurance-quote-and-buy","Conversational AI for insurance quote and buy","Conversational quote and buy","A customer facing AI agent that sells insurance directly in a conversation: it asks the rating questions in plain language, explains cover options, returns a price from the insurer's rating engine, handles objections and takes payment to bind the policy, with a licensed human available for advice and anything outside its limits.",[96],[234,24],[27,29,252,28],"distribution",[194],"The conversational layer carries the Article 50 transparency duty. If the system assesses risk or sets prices for life or health insurance of natural persons, that part is high risk under Annex III point 5(c); pricing for property and casualty products is not listed.",{"slug":991,"title":992,"shortTitle":993,"definition":994,"status":19,"industries":995,"functions":996,"patterns":997,"audience":31,"autonomy":32,"adoptionStage":82,"segment":34,"evidenceCount":191,"publicEvidenceCount":113,"organizations":998,"bestGrade":179,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":1002},"conversational-loan-application-intake","Conversational AI for loan application intake","Loan application intake","A conversational assistant on web, app, messaging or voice that explains loan products, captures the application through dialogue in the customer's language, checks documents and basic eligibility rules, and hands a complete, structured application to origination, without making the credit decision.",[21],[364,234,24],[27,81,30,28],[999,833,108,1000,1001],"Absa Bank","Oper Credits","Rocket Mortgage","Explaining products and capturing an application is limited risk with an Article 50 disclosure. If the assistant evaluates creditworthiness or filters applicants on its own assessment, it falls under Annex III point 5(b) and becomes high risk, so keep the decision in the governed credit process.",{"slug":1004,"title":1005,"shortTitle":1006,"definition":1007,"status":19,"industries":1008,"functions":1009,"patterns":1010,"audience":104,"autonomy":105,"adoptionStage":82,"evidenceCount":83,"publicEvidenceCount":83,"organizations":1011,"bestGrade":179,"headline":1015,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":1018},"internal-audit-copilot","Generative AI copilot for internal audit","Internal audit copilot","A copilot for internal auditors that drafts planning memos and document request lists from prior audits, summarises large evidence sets, builds risk and control matrices from policies and process documents, and drafts findings and reports, with every statement traceable to its evidence and a qualified auditor accountable for every conclusion.",[95,21,96,326,382,124],[366,100,331],[30,102,103,81,477],[1012,1013,1014],"Banco Bradesco","British Columbia Investment Management Corporation","XP Inc.",{"kpi":1016,"label":1017,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":546,"qualifier":69,"claimant":225,"organization":1012,"vendorReported":12},"handling-time-reduction","Handling time reduction","An internal drafting and analysis assistant for auditors that makes no decisions about natural persons. It would need reassessment if used to evaluate individual employees' behaviour or performance, which falls under Annex III point 4(b).",{"slug":1020,"title":1021,"shortTitle":1022,"definition":1023,"status":19,"industries":1024,"functions":1025,"patterns":1026,"audience":104,"autonomy":294,"adoptionStage":82,"evidenceCount":83,"publicEvidenceCount":83,"organizations":1027,"bestGrade":40,"headline":87,"lastVerified":50,"indexable":12,"euAiActTier":51,"euAiActBasis":1031},"governed-text-to-sql-analytics","Governed text to SQL analytics assistant","Governed SQL analytics","An assistant that turns a business user's plain language question into a query against governed data, runs it under that user's own data permissions and returns the table or chart together with the SQL and the tables used, so routine ad hoc questions no longer queue for the data team.",[95,21,96,123,209,892],[348,212],[27,293,30],[1028,1029,1030],"Bayer","LinkedIn","Uber Technologies","Article 50(1) requires providers to design AI systems that interact directly with people so that those people are informed they are dealing with AI, unless this is obvious from the context, as it usually is for an internal assistant. An analytics assistant that makes no decisions about people is not a prohibited practice under Article 5 and is not listed in Annex III. It would be high risk only if it were intended for an Annex III purpose, such as assessing the creditworthiness of natural persons (point 5(b)).",{"slug":1033,"title":1034,"shortTitle":1035,"definition":1036,"status":19,"industries":1037,"functions":1038,"patterns":1039,"audience":104,"autonomy":294,"adoptionStage":33,"evidenceCount":145,"publicEvidenceCount":113,"organizations":1040,"bestGrade":40,"headline":1043,"lastVerified":50,"indexable":12,"euAiActTier":114,"euAiActBasis":1044},"live-agent-assist","Real time AI assist for contact centre agents","Live agent assist","A real time copilot for human contact centre agents during a live call or chat: it transcribes the conversation as it happens, surfaces the relevant knowledge and next step, drafts responses, and writes the after call summary and CRM notes, while the agent stays in control of what is said and done.",[95,21,96,97,210,123,209],[24,25],[857,30,102,103],[39,1041,1042,178,453],"Definity","Oportun",{"kpi":316,"label":317,"unit":44,"n":36,"nUpTo":45,"kind":46,"value":862,"qualifier":69,"claimant":225,"organization":1041,"vendorReported":12},"As a pure assist tool for agents it is minimal risk; the customer does not interact with the AI. It becomes high risk under Annex III point 4(b) if its data is used to monitor and evaluate individual agents' performance, and inferring agents' emotions at work is prohibited under Article 5(1)(f).",{"slug":1046,"title":1047,"shortTitle":1048,"definition":1049,"status":19,"industries":1050,"functions":1051,"patterns":1052,"audience":368,"autonomy":1053,"adoptionStage":33,"segment":106,"evidenceCount":538,"publicEvidenceCount":538,"organizations":1054,"bestGrade":40,"headline":1057,"lastVerified":50,"indexable":12,"euAiActTier":180,"euAiActBasis":1058},"real-time-fraud-scoring","Real time fraud scoring for card and instant payments","Real time fraud scoring","Machine learning that decides in milliseconds, without any conversation, how likely each card authorization and account to account payment is to be fraudulent, combining behavioural, device and network signals, so the bank can approve, challenge or block a payment before the money leaves. Working the resulting alerts and talking to the customer about them are separate use cases.",[21,22],[78],[175,477],"autonomous",[668,38,907,64,1055,160,1056,86],"Pay.UK","Stripe",{"kpi":163,"label":164,"unit":44,"n":83,"nUpTo":45,"kind":146,"value":301,"qualifier":69,"claimant":49,"organization":87,"vendorReported":11},"Annex III point 5(b) lists creditworthiness assessment and credit scoring of natural persons as high risk but explicitly excludes AI systems used for the purpose of detecting financial fraud, and payment fraud scoring is not otherwise listed in Annex III or prohibited by Article 5. Behavioural biometrics used only to confirm that customers are who they claim to be fall under the biometric verification exclusion in Annex III point 1(a). The model does not interact with people, so Article 50 does not apply. GDPR Article 22 can still apply to solely automated declines with significant effects on customers.",1790598319207]