EU AI Act and AML: what automated KYC must prove

The EU AI Act Meets AML: What Automated KYC Systems Now Have to Prove

This isn't a gray area open to interpretation. Fraud detection, AML transaction monitoring, credit scoring, and automated decisions about access to financial services are explicitly listed as high-risk under Annex III. The classification trigger is intended purpose: a system built in-house, licensed from a vendor, or adapted from a general-purpose model is treated the same way if it's used for AML risk profiling or KYC decisioning, regardless of deployment method.

By James Hickson · Published 27 August 2026

On 27 July 2026, the EU's Digital Omnibus on AI — Regulation (EU) 2026/1744 — entered into force, formally pushing back the AI Act's high-risk compliance deadline for standalone Annex III systems from 2 August 2026 to 2 December 2027. That includes AML risk-scoring, fraud detection, and automated KYC decisioning, all explicitly classified as high-risk under the Act. If your compliance function has been treating August 2026 as the live deadline, that's no longer accurate.

The more useful question is what the new timeline actually means once it sits alongside the EU's other major AML deadline, which didn't move at all.

What just changed, and what didn't

The Omnibus is narrower than "the AI Act got delayed." Standalone high-risk systems under Annex III (the category covering AML and KYC tools) now have until 2 December 2027 to meet the Act's full compliance obligations, up from the original 2 August 2026 date. High-risk AI embedded in already-regulated products under Annex I moves further out still, to 2 August 2028. The Act's transparency obligations under Article 50, including the duty to disclose that a person is interacting with an AI system, still apply from 2 August 2026 regardless. The classification framework itself, the four-tier risk structure, the conformity assessment regime, none of that changed. What moved is the compliance clock for one specific tier.

Why automated KYC/AML systems are high-risk in the first place

Fraud detection, AML transaction monitoring, credit scoring, and automated decisions about access to financial services are explicitly listed as high-risk under Annex III. The classification trigger is intended purpose: a system built in-house, licensed from a vendor, or adapted from a general-purpose model is treated the same way if it's used for AML risk profiling or KYC decisioning, regardless of deployment method. A general-purpose model deployed specifically to support KYC decisions is high-risk for that use case even if the same underlying model serves other, lower-risk purposes elsewhere in the business.

The AMLR clock is separate, and earlier

While the AI Act's Annex III deadline moved, the EU's Anti-Money Laundering Regulation didn't. Regulation (EU) 2024/1624 applies directly across all 27 member states from 10 July 2027, with no national transposition required and no dependency on the AI Act's timeline. AMLR sets the substantive standard for customer due diligence, beneficial ownership verification, and ongoing monitoring that obliged entities, including payment and crypto-asset service providers, have to meet.

That standard sets requirements for what due diligence has to accomplish, applying equally whether a human analyst or an automated tool is doing the accomplishing. A KYC system due for a substantive rebuild ahead of July 2027 is being rebuilt against AMLR's standard first, independent of anything the AI Act requires.

Two deadlines, one build

AMLR's application date is 10 July 2027. The AI Act's Annex III high-risk deadline, post-Omnibus, is 2 December 2027, five months later. A compliance or data team rebuilding a KYC system to meet AMLR's due-diligence standard in mid-2027 will, five months after that rebuild goes live, need the same system to satisfy AI Act high-risk obligations if it uses AI, covering risk management, data governance, human oversight, technical documentation, and post-market monitoring.

Treating these as two separate projects on two separate clocks creates avoidable rework. Building AI Act governance requirements into the AMLR-driven rebuild now, rather than bolting them on five months later, means one build cycle instead of two.

There's a sharper detail worth understanding in the Omnibus's own terms. AI systems placed on the market before their respective compliance dates aren't subject to high-risk obligations unless they undergo a substantial modification afterward. That grandfathering clause cuts both ways for a system rebuilt to meet AMLR in 2027: get the AI Act's governance requirements right during that rebuild, and the system may carry forward past December 2027 without retriggering full high-risk conformity assessment. Get it wrong, and the same system's AMLR-driven rebuild could itself count as the "substantial modification" that pulls it back into scope right as the AI Act deadline lands.

What good human oversight looks like

The AI Act's human oversight requirement is not satisfied by a person nominally reviewing outputs they don't have the context to challenge. It requires oversight that's meaningful: someone who can trace a specific decision back to its inputs, understand why a particular risk score or alert was generated, and override it when the system gets it wrong. Building that kind of oversight in from the start, so the reviewer's context and authority are part of the process rather than retrofitted onto an already-automated pipeline, is what actually satisfies the requirement. Systems where human judgment has stayed embedded throughout tend to clear this bar more naturally than ones where oversight gets bolted on after automation is already running.

Model-governance checklist for KYC/AML systems

Use this to bridge both regimes in a single build rather than treating them as sequential obligations:

Confirm classification, don't assume it. Document whether each AI-supported KYC/AML system falls under Annex III, covering the specific use case (risk scoring, fraud detection, decisioning), not just the underlying model.
Build explainability in from the start. Every flagged decision should be traceable from input to output well enough that a compliance analyst, not just a data scientist, can explain why it happened.
Design for AMLR's due-diligence standard first. Customer due diligence, beneficial ownership verification, and ongoing monitoring requirements under Regulation (EU) 2024/1624 apply from 10 July 2027 regardless of AI Act timing, so the system has to meet that bar on its own terms.
Make human oversight real, not procedural. Reviewers need the context and authority to actually challenge a system's output when it's wrong.
Log every material change against the "substantial modification" question. A documented rationale for why a change does or doesn't count as substantial protects a system's grandfathered status and gives you a paper trail if a supervisor asks.
Track both dates on one roadmap. 10 July 2027 (AMLR) and 2 December 2027 (AI Act Annex III) are five months apart on the same underlying system, so a single coordinated build covers both requirements without a second rework cycle.

Frequently asked questions

When is the new deadline for AI Act high-risk KYC/AML systems?

2 December 2027, for standalone Annex III systems including AML risk-scoring, fraud detection, and automated KYC decisioning. This is a delay from the original 2 August 2026 date, following the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force 27 July 2026.

Did all AI Act deadlines get pushed back?

No. High-risk AI embedded in already-regulated products under Annex I moved to 2 August 2028, but the Act's transparency obligations under Article 50, including disclosing that a person is interacting with an AI system, still apply from 2 August 2026.

How does the AMLR deadline relate to the AI Act deadline?

Regulation (EU) 2024/1624 (AMLR) applies directly from 10 July 2027, five months before the AI Act's Annex III deadline of 2 December 2027, with no dependency between the two timelines.

Why are automated KYC systems classified as high-risk under the AI Act?

The classification trigger is intended purpose. Any system used for AML risk profiling or KYC decisioning is treated as high-risk under Annex III, whether it's built in-house, licensed from a vendor, or adapted from a general-purpose model.

What happens if a KYC system is substantially modified after the deadline?

AI systems placed on the market before their compliance date aren't subject to high-risk obligations unless they undergo a substantial modification afterward. A rebuild done to meet AMLR in 2027 could either preserve or trigger that grandfathered status, depending on how the AI Act's governance requirements are handled during the rebuild.