Introduction
For the past two years, the EU AI Act has felt like a distant obligation, something to monitor, not act on. That’s changing. The European Commission just published its most detailed guidance yet on which AI systems fall into the high-risk category, and a political agreement in May shifted the key compliance deadline to December 2027. The rules are getting real. The question now is whether your organisation is treating that date as a deadline or a starting point.
What “high-risk” actually means
Most of the confusion around the AI Act comes down to one question: does it apply to me?
Article 6 gives two answers. The first covers AI embedded in physical products that already require third-party safety certification under EU law, think medical devices or industrial machinery. The second, and more relevant for financial services, is a defined list of use cases that carry high-risk status regardless of the product they sit in. That list includes credit assessment, access to essential financial services, and employment. Categories that cover a significant portion of what AI is actually being used for in ABF and private credit today.
The draft guidelines published on 19 May don’t expand that list. What they do is explain, with concrete examples, how the Commission expects firms to assess whether their specific systems fall inside or outside each category. For anyone who has been waiting for that level of clarity before starting their assessment, the waiting is over. If your systems touch any of those categories, the time to assess is now.
December 2027 is closer than it looks
The original deadline for Annex III obligations was August 2026. The Digital Omnibus agreement pushed that to December 2027, a meaningful extension, and one that gives organisations real room to get this right.
But high-risk classification under the Act isn’t a box-ticking exercise. Conformity assessments, technical documentation, human oversight mechanisms, transparency requirements, ongoing monitoring. Done properly, this takes time. Firms that start in 2027 will be rushing. Firms that start now will be ready.
How we think about this at Cardo AI
We’re an optimisation and data intelligence platform. Our job is to give ABF and private credit teams better information, faster, not to make decisions for them. The human stays in the loop. That’s not a compliance workaround; it’s how we think good AI in finance should work, and it’s been built into the platform from the start.
That design is central to how we approach Article 6. A platform built around human decision-making, auditability, and transparency starts from a fundamentally different position than one that doesn’t.
What we’re not doing is starting from scratch. Our AI framework has been aligned to the AI Act, GDPR, and ISO 42001 since before compliance was the reason to do it. The governance, auditability, and oversight controls our clients rely on aren’t a response to regulation, they’re what makes the platform work in environments where getting it wrong has real consequences.
For clients who want the detail, it’s all in our Trust Centre.
What comes next
The Commission’s consultation on these draft guidelines runs until 23rd July. Final guidance is expected before the end of the year, and we’ll continue to share how we’re thinking about these developments as they unfold.
If you have questions about what any of this means for your use of the Cardo AI platform, get in touch.