May 2026 Summaries

The EU AI Act, effective since August 2025, categorically bans eight specific categories of AI practices deemed harmful and incompatible with EU fundamental rights, imposing substantial penalties of up to €35 million or 7% of global revenue for violations. These prohibited practices include subliminal manipulation, exploitation of vulnerabilities, social scoring, emotion recognition in workplaces and education, biometric categorization, predictive policing based solely on profiling, untargeted facial image scraping, and real-time remote biometric identification in public spaces. The Act mandates pre-deployment classification, continuous monitoring for feature drift, and annual reviews to ensure compliance, as the European Commission can expand the list of prohibited categories without prior notice. The prohibited practices are regarded as fundamental rights breaches, not mere compliance failures, and require robust governance infrastructure to maintain evidence of compliance throughout the AI systems' lifecycle, with organizations needing to demonstrate real-time visibility into model behavior and maintain audit-ready trails to avoid regulatory exposure.

Openlayer is an AI governance and observability platform that has been recognized by Gartner®. It offers tools to help users deploy AI solutions with greater confidence by providing enhanced monitoring and management capabilities. The platform emphasizes privacy and offers customizable settings for cookies to improve user experience and deliver personalized content, while also analyzing traffic to optimize performance.

The EU AI Act outlines distinct obligations for AI system providers and deployers, highlighting the fluidity of roles based on specific actions rather than overall organizational identity. Providers, responsible for developing and marketing AI systems, face stringent pre-market requirements such as conformity assessments and CE marking, while deployers, who professionally use AI systems, must ensure human oversight, maintain usage logs, and report incidents. The Act's risk-based approach classifies AI systems into four tiers, with obligations varying according to risk level, and substantial modifications can shift a deployer into a provider role under Article 25, bringing a heavier compliance burden. The territorial scope of the Act applies to any AI system used or whose outputs are used within the EU, regardless of the provider's location, catching some non-EU companies by surprise. Organizations often juggle both roles, necessitating clear internal ownership and compliance strategies to navigate the differing obligations effectively, with tools like Openlayer automating governance to simplify adherence.

The EU AI Act mandates that financial services firms using high-risk AI systems, such as credit scoring models, insurance underwriting tools, and fraud detection engines, achieve full compliance by August 2, 2026. This includes technical documentation, human oversight controls, conformity assessments, and risk management processes. The Act's extraterritorial scope means that firms outside the EU must comply if their systems affect EU residents or are used by EU-based entities. High-risk systems require significant preparation, including inventorying AI systems, classifying them according to risk, and ensuring continuous monitoring and automated governance to prevent compliance issues. The enforcement regime imposes severe penalties, up to €35 million or 7% of global turnover for non-compliance, which surpasses GDPR penalties for large institutions. The Act integrates with existing regulations like DORA, CRR, and MCD, but introduces new standards for explainability and human oversight. Financial institutions must align their compliance strategies with both banking and AI authorities' requirements to navigate the complex regulatory landscape effectively.