Six Weeks In, the EU AI Act Tests Banks Beyond the Chatbot
On 2 August 2026 most of the EU AI Act's obligations took effect, including its transparency requirements, with some rules for high-risk systems following on later dates. For banks, which have embedded AI across fraud detection, customer authentication, contact centres, collections and analytics, the milestone was never a single deadline. Six weeks on, it is
proving to be a test of whether they can see, govern and explain the AI already running inside their businesses, and whether the disclosures they have made are consistent across every channel a customer uses.
Amanda Panks, senior manager, strategy and operations, EMEA at TTEC Digital, advises financial services organisations on operational AI governance and customer experience. She answered The Datatech Times' questions in writing in two rounds, in the run-up to 2 August and again in September once the first obligations had been in force for six weeks.
When the 2 August milestone arrived, what changed for a bank in practical terms, and what should already have been in place rather than still in progress?
For banks and other organisations, 2 August should not be viewed as a single finish line. It is better understood as a point at which several important provisions take effect and businesses will need to show that their approach to AI is more than a work in progress.
The EU AI Act raises the standard for how AI is identified, governed, disclosed and overseen. Transparency requirements come into effect in August 2026, although some rules for high-risk systems now follow later implementation dates. [At this] stage, an organisation should have a credible view of where AI is being used across its customer and employee journeys. It should understand which systems could create higher levels of risk and know who is accountable for them. What should not still be happening is the first attempt to find those systems.
In a bank, AI may be supporting customer service, fraud detection, collections, employee productivity or operational decision-making. In another sector, the applications will be different, but the underlying challenge is the same: leaders need to know where AI is operating and how it is influencing people, decisions and outcomes.
The central question is no longer whether an organisation should use AI. It is whether the organisation understands where AI is being used and can demonstrate that it is being managed responsibly.
You describe the core challenge as operational rather than one of compliance deadlines: being able to identify every AI system that influences customers and staff. Where do banks most often find the blind spots in that inventory?
The biggest blind spots are rarely the obvious AI applications. Most leadership teams know about their chatbot or the generative AI tool being tested by employees. What they may not see is the AI that has gradually become part of the wider technology estate. It can appear in platform upgrades, copilots, analytics tools, workforce-management systems, qualityassurance platforms, speech analytics and decision-support technology. The same issue arises in financial services, retail, healthcare, travel, the public sector and almost every other industry.
This is sometimes described as "hidden AI" because the organisation did not make a deliberate decision to buy a new AI system. The capability arrived through an existing supplier, a software update or a new feature that was enabled within a platform already in use. That can leave the organisation without a clear owner, a formal assessment or a consolidated view of how the technology is affecting customers and employees.
The issue is not necessarily that the organisation is using AI irresponsibly. It is that it may not be able to see every place where AI is operating. Without that visibility, responsible governance becomes much harder.
A lot of bank AI has arrived quietly, through software updates and third-party tools. How should an institution bring that unseen AI into a governable inventory without stalling the services that depend on it?
Start with visibility rather than restriction. The aim should not be to pause every system that may contain AI. That would be disruptive and, in many cases, unnecessary.
Instead, organisations should examine their business processes and customer journeys and look for the points at which technology is generating content, making predictions, classifying information, recommending an action or influencing a decision. This approach often identifies far more AI than asking teams to list the products they believe contain it. For a
financial institution, the review might cover customer service, fraud operations, credit processes, collections, workforce planning and employee-support tools. Other organisations can apply the same method to areas such as recruitment, marketing, supply-chain planning, case management and customer support.
At TTEC Digital, we encourage leaders to move away from asking, "Where did we buy AI?" and instead ask, "Where is AI influencing an outcome?" That change in language is important. It shifts the focus from products and vendors to the effect the technology is having on the business and the people it serves.
The longer-term goal should be a living AI inventory connected to procurement, technology governance and change-management processes. That allows new AI capabilities to be identified as they are introduced, rather than discovered months later.
The Act asks firms to demonstrate appropriate human oversight. For a system such as fraud detection or collections, what does meaningful oversight look like, as opposed to a sign-off that only ticks a box?
Meaningful oversight means that people remain accountable for the outcome and are able to question, investigate and, when necessary, override the system. A policy document or an annual approval meeting is not enough. Oversight needs to be built into day-to-day operations through monitoring, clear escalation routes, regular performance reviews and
named accountability.
Consider an AI system that identifies potentially fraudulent activity, prioritises collections cases or recommends a course of action. The organisation should be able to explain: who reviews unusual or disputed outcomes? What information is available to that person? How are errors or unexpected patterns investigated? What happens when an employee disagrees
with the recommendation? Is the employee genuinely able to change the outcome? Are overrides and exceptions recorded and reviewed?
These questions are especially important in regulated sectors, but the principle is relevant to any organisation using AI to influence decisions about customers or employees. Human oversight is meaningful only when the person involved has the knowledge, authority and time to intervene. A human who can see the recommendation but cannot challenge it is not
providing effective oversight.
The regulation reaches well beyond the EU, much as GDPR did. For a bank with limited European operations, what is the minimum it cannot afford to ignore?
The more useful question is not, "What is the minimum we need to do?" but, "What practices will help us use AI responsibly, serve customers well and strengthen the business over the long term?" These are not only regulatory questions. They are the foundations of good AI governance and responsible customer experience. Organisations that put them in place will
be better positioned to build trust, improve performance and scale AI safely over time.
The lesson from GDPR is that location is often less important than impact. Many banks and financial institutions assume that a limited European presence means limited responsibility. However, an organisation may still need to consider the Act if it serves customers in the EU, provides services to people in the EU or uses AI systems whose outputs affect EU users. The same principle applies across other sectors.
This is not only a European issue. Businesses like banks in the UK, North America and elsewhere need to understand how the Act may apply to their operations, their technology partners and the way AI-generated outputs are used.
But organisations should not approach this solely as a legal or compliance exercise. Knowing where AI is being used, what it is doing and who is accountable for it is simply good business practice. It supports better customer service, reduces the risk of poor or inconsistent outcomes and helps employees understand when and how they should rely on AI.
TTEC Digital's forthcoming CX Dive research suggests many leaders still cannot see where AI is operating across their customer experience. What is the first practical step to closing that visibility gap?
The first step is to appoint a senior executive to own the AI inventory, supported by a crossfunctional team spanning technology, risk, legal, procurement, operations, data and customer experience. Rather than trying to map everything at once, organisations should begin with the customer and employee journeys where AI is most likely to influence people, experiences or important decisions.
At TTEC Digital, we help clients bring these perspectives together by mapping journeys, reviewing the supporting technology estate and identifying where AI is generating content, making predictions, recommending actions or influencing outcomes. We also help assess risk, establish ownership and create the governance processes needed to keep the inventory
current. The goal is not a one-off list, but a living inventory embedded into procurement, technology governance and change management.
Our CX Dive research, published in August, reinforces what we see in our client work: organisations cannot manage technology they cannot see. Once that visibility is in place, leaders can strengthen oversight, identify opportunities for value and adopt AI more confidently and responsibly.
Six weeks on from 2 August, what has actually changed in how banks label AI-generated content and AI interactions with customers, and where have firms fallen short in the first weeks of the Article 50 obligations applying?
The real transparency challenge is no longer just the chatbot. It is the AI customers do not always see.
Since 2 August, organisations like banks have had to think much more deliberately about where AI sits in the customer journey and how clearly that is communicated. Transparency has moved from being good CX hygiene to something that needs to be designed into the experience.
That matters in financial services, because trust is already part of the product. If a customer is using a virtual assistant, receiving an AI-supported communication or moving through a self-service journey, they need to understand when AI is involved and what role it is playing.
But from a CX perspective, a disclosure alone is not enough. Saying “you are interacting with AI” may satisfy the first part of the conversation, but customers also want to know what the technology can do, where its limits are and how quickly they can get to a person when they need one.
Six weeks in, I would not describe the issue as “falling short”. The bigger challenge is inconsistency. A bank may have a clear disclosure in webchat, for example, but that same clarity can get lost when the journey moves into voice, messaging or a third-party platform. That is understandable this early in adoption. The real test is whether firms use this period to remove those gaps and create a consistent experience across channels.
There is also a bigger shift happening. Customers are becoming used to AI in everyday life, so the debate is moving on from “should we disclose it?” to “how do we make that disclosure useful?” That is where CX becomes important.
The next transparency challenge is not just customer-facing AI, either. It is the AI sitting beside the employee. Advisors and contact centre agents are increasingly being supported by AI-generated summaries, prompts, recommendations and next-best actions. If they do not understand or trust those tools, the customer will feel the impact. For AI to scale well, trust has to exist on both sides of the conversation.
How have banks and their vendors responded in practice, and what should a bank that has not yet built its transparency controls prioritise before the next EU AI Act milestone?
For banks, the challenge is not simply telling customers that AI is being used. It is making that use feel trustworthy.
The response from banks and technology providers has become much more practical over the past year. Financial institutions are mapping where AI appears across the customer journey, while vendors are putting more focus on monitoring, governance and transparency within their platforms.
For a bank that is still building its approach, I would start with one simple question: where is AI influencing the customer experience today? The answer will go well beyond the chatbot. AI may be supporting advisors, summarising customer conversations, recommending actions or helping back-office teams make decisions faster. A customer may never knowingly interact with AI, but it may still be shaping the service they receive.
That is why I think we are now dealing with two connected CX challenges. The first is the customer experience with AI. Customers need to know what the technology can do, where human support sits and how much control they still have. The second is the employee experience with AI. If the advisor or agent using the technology does not trust the recommendation, understand the reasoning or know when to challenge it, that uncertainty will eventually show up in the customer interaction.
This is where banks should focus next. Not on creating more disclosure for the sake of it, but on making AI visible where it matters, easy to question and simple to escalate to a person.
For financial services, that is the bigger opportunity. Trust has always been a differentiator. The firms that do this well will not be the ones with the longest AI disclaimer. They will be the ones that make AI feel useful, transparent and easy to challenge when something does not look right.