Changes from report parliamentary committee draft to plenary report

MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

Changedon the impact of artificial intelligence on the financial sector

(2025/2056(INI))

The European Parliament,

Changed– having regard to the European Commission’sCommission communication of 9 April 2025 entitled ‘AI Continent Action Plan’ (COM(2025)0165),

Added– having regard to the Commission communication of 24 September 2020 on a Digital Finance Strategy for the EU (COM(2020)0591),

– having regard to the report of 25 February 2025 by the European Securities and Markets Authority (ESMA) entitled ‘Artificial intelligence in EU investment funds: adoption, strategies and portfolio exposures’,

Changed– having regard to the public statement of 30 May 2024 by the ESMA on the use of Artificial Intelligence (AI) in the provision of retail investment services,

– having regard to the report of 10 February 2025 by the European Insurance and Occupational Pensions Authority (EIOPA) entitled ‘Impact Assessment of EIOPA’s Opinion on AI governance and risk management’,

Changed– having regard to the report of 30 April 2024 by the EIOPA entitled ‘Report on the digitalisation of the European insurance sector’,

– having regard to the report of 29 November 2024 by the European Banking Authority (EBA) entitled ‘Risk Assessment Questionnaire (RAQ) – Autumn 2024’,

– having regard to the report of 4 August 2023 by the EBA entitled ‘Machine learning for internal ratings-based models’,

Changed– having regard to the publicationarticle of 726 MayFebruary 2024 by Elizabeth McCaul, Member of the Supervisory Board of the European Central Bank entitled(ECB), ‘Theentitled rise‘From ofdata artificialto intelligence:decisions: benefitsAI and risks for financial stability’,supervision’,

Added– having regard to the publication of 7 May 2024 by the ECB entitled ‘The rise of artificial intelligence: benefits and risks for financial stability’,

– having regard to the working paper of 15 December 2023 by the Organisation for Economic Co-operation and Development entitled ‘Generative Artificial Intelligence in finance’,

– having regard to the report of 12 December 2024 of the Bank for International Settlements entitled ‘Regulating AI in the financial sector: recent developments and main challenges’,

– having regard to the report of 13 June 2024 of the Bank for International Settlements entitled ‘Intelligent financial system: how AI is transforming finance’,

Changed– having regard to the report of 19 December 2024 by the High-Level Panel of Experts to the G7 entitled ‘Artificial Intelligence and Economic and Financial Policy Making’,Policymaking’,

– having regard to the report of 14 November 2024 by the Financial Stability Board entitled ‘The Financial Stability Implications of Artificial Intelligence’,

Changed– having regard to Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing,financing1,

Changed– having regard to Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act),Act)2,

Changed– having regard to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011,2016/10113 (Digital Operational Resilience Act),

Changed– having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),Regulation)4,

Changed– having regard to Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution,distribution5(Insurance Distribution Directive),

Changed– having regard to Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012,648/20126(Markets in Financial Instruments Regulation),

Changed– having regard to Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU,2011/61/EU7(Markets in Financial Instruments Directive),

Changed– having regard to Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012,648/20128(Capital Requirements Regulation),

Changed– having regard to Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC,2006/49/EC9(Capital Requirements Directive),

Changed– having regard to Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010,1095/201010 (Alternative Investment Fund Managers Directive),

Changed– having regard to Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II),II)11,

Changed– having regard to Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS),(UCITS)12,

Removed– having regard to its resolution of 3 May 2022 on artificial intelligence in a digital age,

Added– having regard to Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC13 (Payment Services Directive),

Added– having regard to its resolution of 3 May 2022 on artificial intelligence in a digital age14,

– having regard to Rule 55 of its Rules of Procedure,

Changed– having regard to the report of the Committee on Economic and Monetary Affairs (A10-0000/2025),(A10-0225/2025),

Change 1

ChangedA. whereas the EU Artificial Intelligence Act (AI Act) introduces the world’s first comprehensive regulatory framework for artificial intelligence (AI);

Change 2

ChangedB. whereas points 5(b) and (c) of Annex III to the AI Act definesdefine two high-risk use cases for the financial services sector, namely the use of AI systems for consumer credit scoring and creditworthiness assessments and their use for risk assessments and pricing of life and health insurance;

C. whereas an AI system is defined in the AI Act as a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments;

Change 3

AddedD. whereas a general-purpose AI (GPAI) model is defined as an AI model, including those trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, but not including AI models that are used for research, development or prototyping activities before they are placed on the market;

E. whereas systems used to improve mathematical optimisation or to accelerate and approximate traditional, established optimisation methods, such as linear or logistic regression methods, fall outside the scope of the definition of an AI system;

State of AI adoption in financial services

Change 4

Changed1. Notes the broad and diverse adoption of AI across the EU financial services sector, with financial institutions, which have been using classical machine learning infor long-standingan extended period, now gradually experimenting with the use andof generative AIAI, increasinglyincluding appliedlarge language models (LLMs) and other foundation models, as a support tool; stresses that the majority of current AI use cases aim to streamline back-office processesprocesses, with most applications representing low-hanging fruit rather than high-risk innovationinnovation; notes, however, that the use of AI to evaluate the creditworthiness of natural persons or establish their credit score, currently defined as high-risk in the AI Act, is prevalent and onlyincreasing; astresses limitedthat numberthe beingdeployment customer-facingof fully autonomous AI systems in the financial sector should have human oversight15; notes that financial institutions continue to explore use cases involving GPAI models, the greater complexity of which entails higher operational and nocompliance autopilotrisk, cases;but also notes that these applications largely remain in the testing phase;

Change 5

Changed2. HighlightsBelieves that AI is a major opportunity for EU financial institutions to develop more innovative products, streamline operations and improve competitiveness on a global scale; highlights that the use of AI in financial services canhas the potential to bring societal benefits, including more effective fraud detection,detection and prevention, anti-money laundering checks and sanctions checks, customer support, transaction monitoring, sanctionspersonalised screening,financial claimsadvice, handling,environmental, personalisedsocial financialand advice,governance creditdata riskgathering, assessment,analysis and reporting, trading models and strategies, regulatory compliance assistance, customermarket on-boardingsurveillance and identityabuse verification,monitoring; marketconsiders surveillancethat the use of AI in the financial sector should strike a balance between innovation and marketcompetitiveness abuseon monitoring;the one hand, and risk management, consumer protection and financial stability on the other hand; stresses that the benefits of AI use in financial services should be passed on primarily to end customers, for example through lower prices, better coverage, improved financial advice, greater financial inclusion and access, and enhanced financial literacy;

Change 6

Removed3. Notes that the main risks linked to the use of AI in financial services stem from the quality, accuracy and representativeness of the data on which models are trained, and from the need to ensure robust data governance, prevent discriminatory outcomes and avoid systemic biases; observes challenges related to cybersecurity vulnerabilities and to the explainability of AI systems;

Added3. Notes that there are also risks from the use of AI in financial services; highlights that, prior to the recent breakthrough of LLMs, these risks stemmed from the quality, accuracy and representativeness of the data on which models were trained, as non-LLM AI outputs are only as reliable as the data inputs; underlines that poor data quality could lead, among other things, to discriminatory outcomes, mis-selling and reinforced systemic biases, while opaque and complex models could give rise to privacy breaches and the exclusion of vulnerable consumers through, for example, price discrimination, thereby exacerbating existing risks or creating new ones; stresses that LLMs introduce significant additional risks that can be hard to measure, including model hallucinations even where training data is of high quality; stresses that such risks and outcomes must be mitigated effectively; observes further challenges related to cybersecurity vulnerabilities and to the explainability of AI systems; stresses, therefore, the need to ensure robust data governance, rigorous testing and documentation of AI models, alongside maintaining a human in the loop and upholding a high standard for employing AI-systems in consumer-facing applications;

Change 7

Changed4. Understands that financial institutions have adopted a prudent and gradualmeasured approach to developingdeveloping, testing and deploying AI systems, with a view to ensuring compliance with existing cross-cutting and sectoral legislation; underlines that this prudent approach may also be driven by undemonstrated customer demand, evolving customer expectations and risk considerations;considerations, which have been outlined above;

Change 8

Removed5. Notes the dependency of EU financial actors on third-country technology providers for software and AI tools, which may lead to concentration risk and reduce the bargaining power of financial institutions when negotiating or modifying contractual terms for AI services; emphasises that EU companies must be able to use existing cloud infrastructure for AI development and deployment; supports, however, EU initiatives to boost AI and cloud development;

Added5. Highlights that the rise of AI poses challenges for supervisory authorities, particularly given the lack of AI-specific expertise and adequate supervisory tools to assess advanced machine learning and generative AI models; calls on the European and national supervisory authorities to adapt to the increasing use of AI in financial services and to monitor, assess and mitigate risks to consumers and financial stability, while being mindful not to discourage innovation through disproportionate compliance burdens or overly prescriptive regulatory approaches;

Added6. Notes that the concentration among AI service providers that offer investment advice may lead to herd behaviour, driven by similar models and limited data sources; urges the European and national supervisors to monitor these risks and financial institutions in order to account for them when developing AI tools;

Added7. Notes the dependency of EU financial actors on third party technology providers (TPPs) to host and develop their AI models and highlights that the majority of financial firms are reliant on only a few TPPs for these services, which may lead to concentration risk and reduce the bargaining power of financial institutions when negotiating or modifying contractual terms for AI services; cautions that reliance on a small number of providers for a given service could lead to systemic risks in the event of disruptions, especially if rapid migration to alternative providers is not feasible;

Added8. Notes that the recently enacted Digital Operational Resilience Act (DORA) requires financial institutions to implement measures to mitigate concentration risk stemming from information and communication technology (ICT) TPPs, including contingency plans and arrangements to ensure business continuity; requests that the Commission and the European supervisory authorities assess, in particular, the feasibility of applying the exit strategies and transition provisions stipulated in DORA to AI models hosted by the infrastructure of TPPs, especially with regard to the considerable reliance on third-country TPPs for AI services;

Added9. Emphasises that EU companies must be able to use existing cloud infrastructure for AI development and deployment; calls for actively exploring avenues to strengthen the compatibility and interoperability of AI models and compliance frameworks with those of like-minded international partners, especially those that aspire to provide equally robust regulatory safeguards, to ensure that EU financial institutions maintain access to AI tools and suppliers and with a view to shaping balanced global standards while safeguarding legal certainty for European businesses;

Added10. Supports initiatives to boost AI and cloud development in the EU, especially with a view to developing AI services that are fully compliant with EU data protection and fundamental rights frameworks, while also strengthening strategic autonomy and resilience;

Regulatory landscape for AI in financial services

Change 9

Changed6.11. Stresses that the financial services sector is highly regulated, subject to multiple pieces of sectoral legislation at both national and EU level, requiring actors to manage risks in a variety of areas including data protection, data lineage, data quality, data governance, operational resilience, outsourcing, model risk, discriminatory outcomes, and market and credit risk, which together form the framework for AI deployment and governance in the financial services sector;sector16; emphasises, however, the importance of continuously monitoring regulatory gaps and evolving use cases of AI in finance, especially with a view to safeguarding consumer rights and the right to privacy;

Change 10

Removed7. Expresses concern about regulatory overlaps and legal uncertainties between the AI Act and sectoral legislation;

Added12. Notes that the EU has adopted a more risk-based approach to AI regulation than other jurisdictions; underlines that, while this may create challenges for the adoption and development of AI in financial services, it also offers an opportunity to build trust and support innovation, provided that the framework is clarified and implemented in a way that fosters legal certainty, proportionality and market confidence; recognises that the AI Act has not yet been fully implemented and that its practical implications have not yet been assessed;

Change 11

Changed8.13. Recalls that the AI Act allowsexplicitly takes into account the current financial services acquis and seeks to avoid duplication of requirements, particularly with regard to internal governance and quality management processes, by allowing for limited derogations for financial institutions wherein so far as equivalent requirements existare underlaid down in EU financial services law; expresses concern aboutthat thethere are, nonetheless, regulatory overlaps and a lack of sufficient guidance on the interpretation of these regulatory overlaps and interactions;interactions, cautionswhich againstintroduces adoptingundue complexity, compliance burdens and legal uncertainty, thus hindering the uptake of AI in the financial services sector; underlines the importance of guaranteeing a maximalistlegal, approachregulatory toand administrative framework that is based on certainty, predictability and stability; notes that an expansive interpretation of the AI Act, whichrather wouldthan furthera complicateproportional one, may risk leading to undue compliance requirements for financial institutions;institutions and causing legal uncertainty; recognises the challenge arising from the fact that supervisory agencies have differing legal interpretations and expectations in terms of the application of the acquis, resulting in fragmentation of the single market; asks the Commission and the national competent authorities to identify and address any inconsistencies in the course of the AI Act’s implementation and as part of the upcoming Digital Omnibus package;

Change 12

Removed9. Expresses concern that the GDPR and its requirements on data minimisation, purpose limitation, customer consent, and financial institutions’ processing of personal data impose limitations to the use of AI in financial services;