§ 05EU AI Act compliance · what August 2026 changes

From August 2, 2026, KYC risk-scoring engines used in the EU are high-risk AI systems under the EU AI Act. Five requirements bite immediately. JPMorgan's engine clears all five; below is the conformity readout for ALSAFA's scoring decision.
Explainability

For each decision, the customer (or regulator) can demand the score, the factor inputs, the weights, and the contribution of each factor. Logged · per-decision

Human oversight

No High or Prohibited tier decision can be auto-final. MLRO sign-off required. Adverse decisions (decline, exit) require a second-person review. Workflow enforced

Bias monitoring

Quarterly disparate-impact analysis across nationality, gender, occupation. No protected class above 1.2× false-positive rate. Q2 2026 audit clean

Model card

Public-facing summary: training data, validation cohort, known limitations, version history. Signed by Chief AML Officer. v2026.1 published

Incident reporting

Material errors (wrong tier, missed PEP) reported to EU AML Authority within 15 days. 0 incidents in Q2 2026. Pipeline live

Conformity assessment

Third-party conformity assessment completed Mar 2026 · CE mark obtained. Next re-assessment Mar 2028 or on material model change. Valid

ENGAGEMENT · JPMORGAN PRIVATE BANK KYC ENGINE READOUT · FICTIONAL CUSTOMER FOR ILLUSTRATION · ENGINE: MacrosLM. Customer entity, beneficial-owner family, score progression, and event timeline are illustrative; not a real onboarding. Framework references FATF Recommendation 10, FFIEC BSA/AML manual, and the EU AI Act (Regulation 2024/1689) high-risk system requirements effective August 2, 2026.MacrosLM · Audit & Controls Series →