# The EU AI Act Omnibus Saved Your Credit Model. It Didn't Save Your LLM Stack. > Source: > Published: 2026-07-10 04:07:16.607760+00:00 # The EU AI Act Omnibus Saved Your Credit Model. It Didn't Save Your LLM Stack. The EU AI Act Omnibus deferred Annex III credit scoring compliance to December 2027 — but GPAI transparency enforcement goes live August 2, 2026. Banks using foundation models in production workflows have obligations they're not prepared for. ## Table of Contents On June 29, 2026, the Council of the EU gave its final green light to the Digital Omnibus on AI — formally extending the compliance deadline for high-risk Annex III AI systems from August 2, 2026 to December 2, 2027. Banks using AI for credit scoring, insurance underwriting, and employment decisions got sixteen months they weren’t expecting. Most European banking compliance teams read the Omnibus headlines, updated the project schedule, and released the sprint capacity they’d allocated to conformity assessments. That is a mistake that will surface in exams and enforcement actions within twelve months. The Omnibus has a split that nearly every bank missed: it deferred Annex III high-risk obligations, but it left August 2, 2026 enforcement intact for general-purpose AI models and Article 50 transparency requirements. If your institution is using a foundation model — Claude, GPT-5, Gemini 3.5, or any other GPAI system — in any customer-facing workflow or in processes that produce regulated outputs, you have obligations that go live in twenty-four days. The compliance calendar your legal team updated last week is wrong. ## Regulatory & Compliance Angle The EU AI Act has always had two distinct tracks. Track one is the high-risk AI system track — Annex III lists the specific applications subject to conformity assessment, data governance requirements, human oversight design, and registration in the EU AI database. Credit scoring, insurance risk pricing, employment screening, access to education. The Omnibus moved the Annex III deadline to December 2, 2027 for standalone systems and August 2, 2028 for AI embedded in regulated products under Annex I. Track two is the GPAI track — obligations on providers of general-purpose AI models that meet capability thresholds. The Omnibus did not touch track two. From August 2, 2026, the European Commission has active enforcement powers over GPAI providers. Fines for GPAI-related infringements can reach 3% of global annual turnover or €15 million, whichever is higher. Alongside GPAI enforcement, Article 50 transparency obligations also activate on August 2. These require that AI systems interacting directly with people must identify themselves as AI. Synthetic audio, image, video, and text content must be machine-readable labeled. Emotion recognition and biometric categorisation systems trigger disclosure requirements regardless of whether the underlying model is high-risk. What this means for a bank operating in the EU: every customer-facing chatbot, every AI-generated email, every synthetic voice in your IVR, and every AI-drafted document that a customer receives needs to carry an appropriate disclosure starting August 2. This is not deferred. It is not covered by the Omnibus carve-out. It applies to your retail banking app, your wealth management portal, your loan application chatbot, and your fraud alert messaging system. The Omnibus also introduced new clarifications on GPAI model scope. A model qualifies as a GPAI model based on capability thresholds — specifically, training using significant compute (currently set at 10^25 FLOPs for systemic risk designation) and broad applicability across tasks. All of the major foundation models in bank production deployments — Claude Opus 4.8, GPT-5, Gemini 3.5 Flash — cross these thresholds. Their providers (Anthropic, OpenAI, Google) have direct GPAI obligations starting August 2. What those provider obligations mean for your bank’s vendor relationships is a question most procurement and third-party risk teams have not answered. The AMLA dimension compounds this. On July 10, 2026 — in one day — the EU Anti-Money Laundering Authority submits its draft Regulatory Technical Standards on Customer Due Diligence to the European Commission. Those RTS will define, in binding terms, what compliant customer identity verification looks like across the EU from 2027 onward. They will reference AI-enabled KYC tools, automated risk scoring, and transaction monitoring systems. The AML and AI Act compliance timelines are now running on parallel tracks that intersect for any bank using ML models in its CDD workflows. ## What the Examiner Will Find European banking supervisors — the ECB, national competent authorities, and the EBA — have signaled clearly how they intend to enforce the AI Act. The European Banking Authority’s November 2025 report confirmed that NCAs will incorporate AI Act compliance into the existing Supervisory Review and Evaluation Process (SREP). AI Act obligations are not a separate audit event. They are embedded in the supervisory framework banks already live under. An examiner walking into a EU-licensed bank in September 2026 will ask three questions on AI. First: do you have an inventory of AI systems in use, including third-party AI APIs and embedded foundation models? Second: for customer-facing AI applications, are you operating Article 50 disclosure mechanisms? Third: do you have documentation of which GPAI models your workflows depend on, and have you reviewed your vendor contracts for the AI Act compliance obligations that cascade from GPAI provider obligations to deployer obligations? Most banks will fail questions two and three. The Article 50 disclosure problem is one of implementation, not awareness — the question of how you label an AI-drafted adverse action letter, how you mark an AI-generated payment fraud alert, and how you log and retain evidence of disclosure is an engineering problem, not just a policy problem. Most banks do not have the technical controls in place. The vendor contract question is more subtle and more dangerous. When a GPAI provider faces an enforcement action from the European Commission, the downstream deployer — your bank — may face questions about whether it conducted adequate due diligence on the GPAI system’s compliance status before deploying it in regulated workflows. Article 25 of the AI Act places obligations on deployers of high-risk AI systems. For banks using foundation models in workflows that touch regulated decisions, even indirectly, the boundary between GPAI obligations and high-risk AI deployer obligations is not clearly defined in the Omnibus and is likely to be the focus of the first enforcement actions. The documentation gap is where examiners will spend their time. Most banks can show they have an AI policy. Few can show a complete inventory of GPAI models in production use across all business lines, including vendor-embedded AI in SaaS tools, development environments, and compliance platforms. Every AI-enabled product your bank uses — from a SWIFT messaging tool with an embedded risk AI to a document management system with an AI summarisation feature — is a GPAI deployment touchpoint. ## The Governance Gap The Omnibus created a compliance psychology problem that will cost banks more than the compliance work they delayed. When teams see a headline that says “EU AI Act high-risk deadline extended,” they stop reading. The nuance — that only some obligations are extended, that GPAI enforcement is active, that Article 50 is unaffected — gets lost. Banks are in the process of deprioritizing EU AI Act work at the exact moment a live enforcement regime is starting. This gap is visible in what banks are actually building. The governance programs initiated in late 2025 for the August 2026 deadline were largely focused on Annex III high-risk systems — credit scoring conformity assessments, data governance frameworks, human oversight mechanisms. That work is now less urgent. What banks did not build is an LLM inventory, an Article 50 disclosure mechanism, and a GPAI vendor due diligence framework. None of that work is deferred. The research community has started to surface this gap more formally. A paper published July 5, 2026 on arXiv (2607.04103) proposes a Generative AI Control Framework (GAICF) — an SR 26-2-compatible governance structure for generative AI workflows in financial institutions. The paper makes a point directly relevant here: generative AI in banks often does not directly make regulated decisions, but its outputs “materially affect the surrounding control environment through monitoring interpretation, policy analysis, or adverse-action language drafting.” That same principle applies to the EU AI Act. An LLM that drafts an adverse action letter is not itself classified as a high-risk AI system under the current framework — but its output is a regulated document with defined disclosure requirements, and the bank deploying that LLM has GPAI-layer and Article 50 obligations that are live on August 2. The practical governance gap for EU-operating banks is threefold. First, no inventory of GPAI model dependencies across all business lines and vendor contracts. Second, no Article 50 disclosure mechanism — no technical controls for labeling AI-generated content or identifying AI systems in customer interactions. Third, no vendor due diligence framework that maps GPAI provider compliance obligations onto deployer risk. Banks that built conformity assessment programs for Annex III have programs designed for the wrong compliance task. ## The SuperML Take The Omnibus is a genuine reprieve for banks with serious exposure in credit scoring and insurance AI. Conformity assessments for production ML models that inform lending decisions are expensive, time-consuming, and require documentation maturity that most banks don’t yet have. Sixteen extra months matters. But the Omnibus has allowed compliance teams to pattern-match to “delay” when the correct reading is “partial deferral with active enforcement.” GPAI obligations are not a regulatory hypothetical. They are active enforcement powers in the hands of the European Commission starting August 2. The Commission has demonstrated with GDPR that it will use penalty authority — and the first GPAI enforcement actions will be against the model providers, not the deployers. But deployers are not shielded by provider liability. When Anthropic or Google faces a Commission inquiry, your bank’s use of those models becomes part of the compliance picture. The actionable priority list for EU-operating banks right now is specific. Build the LLM inventory — every foundation model API call in production, including those embedded in vendor SaaS tools. Review vendor contracts for AI Act compliance representations and pass-through obligations — most enterprise contracts signed before mid-2025 do not have them. Implement Article 50 disclosure mechanisms for every customer-facing AI touchpoint before August 2 — this is not aspirational, it is a live obligation. And start the AMLA CDD alignment work now, because the RTS being submitted July 10 will shape what your KYC and transaction monitoring AI systems need to look like from 2027 onward. The banks that will be in the best position in 2027 are not the ones that build the most sophisticated conformity assessment programs for their credit models. They are the ones that treat August 2 as a real deadline, build genuine GPAI governance infrastructure, and use the Annex III reprieve to run that program properly rather than deferred. The compliance teams celebrating the Omnibus should be building. The ones who built the right thing before the Omnibus should be grateful they’re ahead. The EU AI Act does not pause between August 2 and December 2027. It enforces. If your institution does not have Article 50 disclosure controls in production, you are not in a grace period. You are out of compliance. ## Sources [EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/)— Gibson Dunn analysis of the formal Omnibus passage and what changed[EU AI Act for Financial Services: What Banks & Insurers Must Do](https://alicelabs.ai/en/insights/eu-ai-act-for-financial-services)— Scope and Annex III implications for banking and insurance[GPAI & Foundation Model Compliance Under the EU AI Act](https://www.glocertinternational.com/resources/guides/eu-ai-act-gpai-and-foundation-model-compliance/)— GPAI model obligations and August 2 enforcement[EU AI Act High-Risk Deadline: Enterprise Readiness Gap](https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-high-risk-compliance-deadline-20/)— Cloud Security Alliance note on enterprise readiness[Governing Generative AI Across Financial Institutions: An SR 26-2-Compatible Framework](https://arxiv.org/abs/2607.04103)— arXiv:2607.04103, July 5, 2026, proposing GAICF for genAI governance in banking[AMLA Consultation on Draft RTS on Customer Due Diligence](https://www.amla.europa.eu/policy/public-consultations/consultation-draft-rts-customer-due-diligence_en)— AMLA’s binding CDD standards due July 10[EU AI Act Omnibus: 2027 Deadlines, Narrower Scope](https://www.resultsense.com/news/2026-05-22-eu-ai-act-omnibus-simplification/)— What the Omnibus changed and what it didn’t[Implementation Timeline — EU Artificial Intelligence Act](https://artificialintelligenceact.eu/implementation-timeline/)— Official AI Act compliance calendar Enterprise AI Architecture ## Want more enterprise AI architecture breakdowns? Subscribe to SuperML.