The EU AI Act Is No Longer Theoretical: What Merchants Need to Do Now
As we’ve been talking about AI at MRC conferences and community calls over the last few years, I’ve watched the conversations we have with our merchant members shift in a very specific way. Three years ago, the question was almost always “how can we use AI?”: a question about experimentation, pilots, and use cases still mostly on the whiteboard. Today, that question has quietly disappeared, replaced by a different reality: AI is no longer something you’re deciding whether to adopt. It’s already built into the fraud tools, the risk scoring engines, the orchestration platforms, the chatbots, and the onboarding workflows you’re using every day, often supplied by vendors who made that decision on your behalf. The question has shifted from “should we use AI” to “do we actually understand the AI that’s already running inside our business”… and regulators have been moving in parallel with that shift. The EU AI Act is now the clearest signal yet that AI governance is not a “someday” problem but a “right-now” problem, with real deadlines and real penalties attached.
Last month, my colleague Kriti Trehan hosted a webinar with our partners at Shoosmiths: Alex Kirkhope, co-head of the firm’s AI Advisory team, and Thomas Brown, who leads Shoosmiths’ Payments practice. They cut through the headlines and got practical about what this means for merchants, payment service providers, and the technology vendors that serve them. I want to share the key takeaways here, because whether your organization is headquartered in the EU or not, if you’re offering products or services that touch EU consumers, you’re very likely within scope.
The Act’s global reach and its phased timeline
The EU AI Act is the world’s first comprehensive AI regulatory framework, and like other major EU legislative regimes (GDPR being the obvious comparison), its reach extends well beyond EU borders. So whether your organization is headquartered in the EU or not, if you’re deploying AI in connection with your EU operations, you need to understand whether the Act applies to you. (Technically, key triggers for non-EU organizations include putting AI systems/models on the EU market, or being a non-EU provider/deployer where the AI system’s output is used in the EU.)
It’s also arriving in phases, and one important note before you read this list: the EU passed a “Digital Omnibus” amendment this summer that pushed several of these dates back, so treat the following as the current state of play, as of September 2026:
- February 2025: Prohibited AI practices and baseline AI literacy obligations took effect.
- August 2025: Rules governing general-purpose AI models, along with the Act’s penalty framework, came into force.
- August 2, 2026: Most of the Act became applicable, including elements of Article 50 transparency obligations (chatbot disclosures, labeling of AI-generated content).
- December 2, 2026: Machine-readable marking/detection obligations for AI systems already on the market extend here (delayed from August 2026), and a new prohibition on AI-generated non-consensual intimate imagery and CSAM takes effect.
- December 2, 2027 (moved from August 2, 2026): This is now the date the bulk of the Act’s substantive high-risk system governance obligations take effect for standalone systems (credit scoring, biometric ID, employment decisions, and the like). The EU’s “Digital Omnibus” package pushed this deadline back 16 months because the technical standards and national enforcement bodies needed to support it were delayed and threatened effective implementation.
- August 2, 2028 (moved from August 2, 2027): High-risk requirements for AI embedded in regulated products (medical devices, machinery, and similar Annex I categories) reach final implementation.
The Council gave the “Digital Omnibus” package its final green light on June 29, and the amendments have since become law as Regulation (EU) 2026/1744.
As with GDPR, the penalties are material: up to €35 million or 7% of global turnover for prohibited AI practices, up to €15 million or 3% for high-risk noncompliance, and up to €7.5 million or 1% for transparency breaches, whichever figure is higher in each case. The penalty framework has been in force since August 2025 and applies as the corresponding substantive obligations take effect.
Risk categories: where does your AI system actually sit?
The Act is commonly summarized using four risk levels, and your obligations scale accordingly: unacceptable (prohibited outright), high-risk, limited-risk, and minimal-risk. Many systems in active use today will land in the minimal-risk bucket, but the ones MRC merchants should scrutinize closely are the high-risk and limited-risk categories, which cover things like credit and creditworthiness decisions, access to essential services, and AI systems subject to specific transparency obligations, such as certain chatbots and synthetic-content systems.
Your obligations also depend on where you sit in the AI value chain: as a provider (you built and market the system), a deployer (you use it in your business operations), an importer, or a distributor. Critically, the same organization can occupy different roles depending on context, so this isn’t a one-time classification exercise.
A key distinction for merchants: fraud detection vs. credit decisioning
This was one of the most important topics discussed during the webinar because the distinction has significant compliance implications for merchants. The Annex III provision that classifies creditworthiness and credit-scoring systems as high-risk expressly excludes AI systems used for the purpose of detecting financial fraud, which may include use cases such as suspicious transaction monitoring, unusual activity detection, and account takeover prevention. That exclusion meaningfully reduces (though doesn’t eliminate) the regulatory burden for merchants and their providers who are using AI to automate their fraud toolings.
Creditworthiness assessment is a different story entirely. AI used to establish or influence credit scores, or to determine access to credit products, is squarely a high-risk use case under the Act.
Here’s the catch: the same underlying AI platform can serve both purposes, and the classification hinges on purpose, not the technology itself.
“The distinction is not based on the technology; it’s based on what you use it for. The same underlying AI platform could be used for fraud monitoring, but you could also use it for creditworthiness assessment, and that tends to make it high-risk if you’re using it to determine eligibility for financial services.” - Thomas Brown, Shoosmiths
If your fraud detection system is a standalone tool, it may benefit from the exclusion. But if that same AI system also feeds into or supports a downstream creditworthiness decision, the system’s intended purpose and classification need to be reassessed; you should not assume that the financial-fraud exception will continue to apply. Understanding the end-to-end architecture of your AI systems, not just the individual tool, is essential to getting this classification right.
Understand your AI vendor stack
Your fraud platform, your onboarding workflow, your chatbot, your risk scoring engine… each one likely has an AI model sitting somewhere underneath it that your vendor built, licensed, or is itself reselling from a further layer of subcontractors. You need visibility into that full chain, not just your immediate contract counterparty. As the party deploying the AI tools, the EU AI Act imposes specific duties on you, even if they’re bought not built.
In practice, that means asking (and contracting for) more than “does this comply with the AI Act.” Ask your vendors what governance and compliance measures they have in place, and can they evidence them? What are their bias mitigation obligations and do they have responsible AI warranties in their contract with you? What escalation and review process kicks in when something goes wrong, and what are their ongoing monitoring and reporting obligations to you as the customer? And critically: what’s your own exit strategy story, so that if you become overly dependent on a single AI vendor and that vendor’s underlying model changes, degrades, or disappears, you’re not caught flat-footed. A single AI system in production today can rest on two or three layers of vendors you never directly negotiated with, each with their own data sources, their own model updates, and their own risk profile. Understanding that supply chain is therefore an important part of effective AI governance, particularly where you need information from providers to meet your own obligations as a deployer.
Where to focus your next 90 days
A few governance priorities came through clearly from Alex and Tom, and I recommend treating them as a checklist regardless of exactly where your organization lands on the Act’s applicability:
- Know what AI you’re using, including what’s buried in your supply chain. Maintain an inventory across the business; not just centrally procured tools, but shadow AI adopted by individual departments. And don’t stop at your own systems: most of the AI risk merchants and payment providers carry today isn’t in tools they built, it’s in tools they bought.
- Classify your use cases. Map each system against the risk categories, and pay particular attention to anywhere fraud prevention and credit/eligibility decisioning intersect.
- Assign accountable owners. Someone needs to own governance for each system, both at inception and on an ongoing basis. AI performance and accuracy drift over time in ways traditional IT procurement doesn’t.
- Build in transparency and human oversight. Both for internal users and end customers interacting with AI-driven outputs.
- Get your contracting house in order. There’s no market-standard approach yet to AI vendor contracts. Push for use-case scoping and clear allocation of liability when systems hallucinate or underperform, and prepare an exit strategy if you become overly dependent on a single AI vendor.
- Don’t treat agentic AI as “more of the same.” Layering autonomous agents on top of existing systems meaningfully increases risk: auditability, explainability, and accountability all get harder, and the card networks and major AI providers are actively building frameworks to address who bears responsibility when an agent errs.
One point Alex made that’s stuck with me: this isn’t a “set it and forget it” compliance exercise the way procuring a traditional IT system might be.
“Unlike normal IT systems, you can’t procure it and at that point forget about it. AI systems are by their nature dynamic: they can change in their performance and accuracy over time.” - Alex Kirkhope, Shoosmiths
AI systems evolve over time as underlying data and models shift, so ongoing monitoring, review, and escalation procedures need to be built into your governance from day one, not bolted on after an incident.
Keep the conversation going
If you weren’t able to join us live, the full session, including a deeper dive into contracting risk, supply chain due diligence, and an audience Q&A on agentic AI and explainability, is available for MRC members to rewatch anytime in the MRC Resource Center.
This won’t be the last word on AI governance from MRC this year. We’ll be continuing the conversation at our Member-only Conferences in San Diego this September and Dublin this November. Bring your toughest AI questions, because I guarantee you won’t be the only one in the room asking them.
Please note that this piece is purely for informational purposes, and does not constitute legal advice. We encourage you to engage with your lawyers on the specific impact of the legislation on your business.
