EU AI Act compliance for LLM deployments
The EU AI Act entered into force in August 2024. GPAI model obligations under Article 53 have been enforceable since August 2025. High-risk AI system requirements under Articles 9 and 15 apply to any system that influences decisions with significant impact on people. If your firm deploys LLMs in any such context, you have obligations now.
What applies to your LLM deployments
The EU AI Act creates a risk-tiered framework. Most enterprise LLM deployments in fintech fall into one of two categories:
Note: LLMSec is not a legal advisory service. This page summarizes our understanding of the AI Act's technical requirements. Consult qualified EU legal counsel for your specific compliance obligations.
LLMSec coverage by Article
Article 9 — Risk Management
Requirement: Establish, implement, document, and maintain a risk management system. Includes testing for foreseeable misuse, known and foreseeable risks.
LLMSec probes covering this article
Article 10 — Data Governance
Requirement: Training, validation, and testing data must be free from errors and complete. Models must be tested on data representative of intended use.
LLMSec probes covering this article
Article 15 — Robustness, Accuracy, Cybersecurity
Requirement: High-risk AI systems must achieve appropriate levels of accuracy, robustness, and cybersecurity. Must be resilient against attempts by third parties to manipulate outputs.
LLMSec probes covering this article
Article 53 — GPAI Model Obligations
Requirement: Providers of general-purpose AI models must maintain technical documentation, comply with copyright law, and publish a summary of training data used.
LLMSec probes covering this article
The risk tier that matters most for fintech
Annex III, point 5(b) of the EU AI Act lists "AI systems intended to be used for creditworthiness assessment or credit scoring" as high-risk. If your LLM is used in any workflow that feeds into credit decisions — even as an assistant to a human analyst — you are likely in high-risk territory.
Article 9 requires that high-risk AI systems be subject to a formal risk management process that includes "testing procedures to address situations that may occur in reality." This is exactly what LLMSec's probe library provides — systematic, documented testing that produces evidence for your technical documentation file.
Article 15 requires that high-risk systems be "resilient as regards attempts by unauthorized third parties to alter their use, outputs or performance." LLMSec's adversarial probe suite — jailbreaking, prompt injection, encoding bypass — tests exactly this resilience.
Why on-premise scanning matters for EU AI Act
EU AI Act compliance requires that you maintain technical documentation of your AI systems. This documentation must include test results and evidence of risk management. If you use a cloud-hosted LLM safety scanner, your test data — including potentially sensitive system prompts and model outputs — leaves your network.
With LLMSec, all scan data stays inside your infrastructure. Your technical documentation is generated and stored locally. You never expose system prompts, model outputs, or findings to any third party — including us. This is the structural prerequisite for any regulated EU deployment.
How is accuracy measured?EU AI Act Article 15 requires transparent evaluation methodology for high-risk systems. Every LLMSec judge's precision, recall, F1, and false-negative rate is published — including weaknesses — on the calibration & methodology page.