SuperML
← All issues

The EU AI Act Omnibus Saved Your Credit Model. It Didn't Save Your LLM Stack.

The EU AI Act Omnibus moved the credit scoring deadline to December 2027 — but GPAI enforcement and Article 50 transparency go live August 2, and banks using LLMs in production workflows are exposed right now.

Hi there,

Most banks read the EU AI Act Omnibus and felt relief. The credit scoring deadline moved to December 2027. Sixteen more months. The lawyers updated the compliance calendar and moved on. That was a mistake.

August 2, 2026 is still an active enforcement date — for GPAI models and transparency obligations. And if your bank is using Claude, GPT-5, or Gemini in any production workflow touching customers or regulated decisions, you have obligations that go live in 24 days.

🔥 Featured Post

The EU AI Act Omnibus Saved Your Credit Model. It Didn't Save Your LLM Stack.

  • The Omnibus formally passed June 29 — Annex III credit scoring AI is now deferred to December 2, 2027
  • But GPAI provider obligations and Article 50 transparency enforcement are NOT deferred — they go live August 2
  • Any EU bank using an LLM for customer interactions must disclose it is AI under Article 50 — starting August 2
  • Banks using GPAI models (Claude, GPT-5, Gemini) in AML, adverse action drafting, or credit memos are in the blast radius of GPAI enforcement — even if indirectly
  • The governance gap: most bank compliance teams read "Annex III deferred" and stopped reading

Read the full post →

📚 In Case You Missed It

The RAG Pattern That Stops LLMs From Inventing Fields That Don't Exist — AK-RAG is a reference architecture that indexes enterprise attribute metadata as first-class knowledge objects, then routes LLM output through a six-step governed pipeline — parse, retrieve, classify, clarify, govern, emit DSL — so the LLM can only select attributes that exist in your catalog, never invent them.

Shadow AI Is Now a Material Cybersecurity Risk. The SEC Just Proved It. — A bank employee used an unauthorized AI tool on customer SSNs — no hacker, no breach — and the parent company still filed an SEC Form 8-K under Item 1.05. The first shadow AI disclosure redefines what 'material cybersecurity incident' means at every bank.

CFPB Killed Disparate Impact. Your AI Credit Model Still Has Exposure. — The CFPB stripped disparate impact from Reg B — but AI credit models are still exposed under the Fair Housing Act, state laws, GSE requirements, and OCC examination. The governance gap opens July 21.

More posts dropping every week. Stay sharp.

— Bhanu @ superml.dev