AI Act

(158) Union financial services law includes internal governance and risk-management rules and requirements which are applicable to regulated financial institutions in the course of provision of those services, including when they make use of AI systems. In order to ensure coherent application and enforcement of the obligations under this Regulation and relevant rules and requirements of the Union financial services legal acts, the competent authorities for the supervision and enforcement of those legal acts, in particular competent authorities as defined in Capital Requirements Regulation (CRR) of the European Parliament and of the Council ( 46 ) and Consumer Credit Directive ( 47 ) , 2009/138/EC ( 48 ) , 2013/36/EU ( 49 ) , 2014/17/EU ( 50 ) and (EU) 2016/97 ( 51 ) of the European Parliament and of the Council, should be designated, within their respective competences, as competent authorities for the purpose of supervising the implementation of this Regulation, including for market surveillance activities, as regards AI systems provided or used by regulated and supervised financial institutions unless Member States decide to designate another authority to fulfil these market surveillance tasks. Those competent authorities should have all powers under this Regulation and Market Surveillance Regulation to enforce the requirements and obligations of this Regulation, including powers to carry our ex post market surveillance activities that can be integrated, as appropriate, into their existing supervisory mechanisms and procedures under the relevant Union financial services law. It is appropriate to envisage that, when acting as market surveillance authorities under this Regulation, the national authorities responsible for the supervision of credit institutions regulated under Capital Requirements Directive (CRD IV), which are participating in the Single Supervisory Mechanism established by Council Single Supervisory Mechanism Regulation (SSMR) ( 52 ) , should report, without delay, to the European Central Bank any information identified in the course of their market surveillance activities that may be of potential interest for the European Central Bank’s prudential supervisory tasks as specified in that Regulation. To further enhance the consistency between this Regulation and the rules applicable to credit institutions regulated under Capital Requirements Directive (CRD IV), it is also appropriate to integrate some of the providers’ procedural obligations in relation to risk management, post marketing monitoring and documentation into the existing obligations and procedures under Capital Requirements Directive (CRD IV). In order to avoid overlaps, limited derogations should also be envisaged in relation to the quality management system of providers and the monitoring obligation placed on deployers of high-risk AI systems to the extent that these apply to credit institutions regulated by Capital Requirements Directive (CRD IV). The same regime should apply to insurance and re-insurance undertakings and insurance holding companies under Solvency II Directive (Insurance) and the insurance intermediaries under Insurance Distribution Directive (IDD) and other types of financial institutions subject to requirements regarding internal governance, arrangements or processes established pursuant to the relevant Union financial services law to ensure consistency and equal treatment in the financial sector.