.svg)
The EU’s AI Act, which came into force in August 2024, will be the first legal framework for the use of AI and, despite having to implement a new set of rules, payments professionals seem relatively pleased with the legislation.
The act is the EU’s first comprehensive regulation on categorising AI applications into four categories: unacceptable; high; limited; and minimal risk.
Each of these has different levels of compliance requirements for organisations developing or using AI systems.
Applications posing an unacceptable risk, such as government-run social scoring, which has occurred in some jurisdictions, including China, are banned.
High-risk tools, such as CV-scanning systems, must meet specific legal requirements, whereas the third level of risk, limited risk, includes AI systems prone to manipulation or deceit, which means informing users of AI interactions and labelling deep fakes.
Chatbots, particularly generative AI, come into this category.
The lowest risk level, minimal risk, meanwhile, covers AI systems that do not fit higher-risk categories. These have no mandatory obligations but should follow principles such as human oversight, non-discrimination and fairness.
Like another piece of EU legislation that went global, the General Data Protection Regulation (GDPR), the AI Act could become a global standard, with jurisdictions such as Brazil and the US state of California following the EU’s lead.
However, unlike the GDPR, which high-profile EU bureaucrat Mario Draghi recently hinted is hindering competition in the trading bloc, Brussels’ foray into emerging technology appears to be being warmly received in the payments space.
For example, Richard Harmon, vice president at global financial services industry technology provider RedHat, said: “One positive aspect of the EU AI Act is that it's risk-based.”
He explained that the regulation is open-ended and becomes stringent only when it addresses areas such as generative AI that have direct implications for citizens, such as the GDPR, the financial system and cybersecurity. “This includes issues like malware and other areas where structural problems could arise within institutions."
"The challenge with AI, unlike crypto, which has a well-defined solution through the EU’s Markets In Crypto-Assets regulation, is that AI is still the 'wild west,' largely unregulated and wide open,” he pointed out.
Harmon said that in this “unstructured environment”, control and guidance are highly beneficial for firms using these tools, including those in the open-source community, where significant AI innovation occurs.
“We may see a strong focus on data privacy and citizen protection in the EU regulation, whereas other global regions may have different priorities. The key for businesses will be to achieve a balance between innovation and risk."
Scott Dawson, CEO of DECTA, which provides end-to-end payments infrastructure, agrees. "AI is a complex field with practical, legal and philosophical dimensions. It has already driven significant advancements.”
“While the EU AI Act may not be perfect, its existence is crucial as it provides a framework for innovation within the EU market,” he said.
Furthermore, he warned that AI is expected to advance rapidly, and regulation often lags technological progress.
This has already been a concern for some in the UK, including lawmaker Lord Chris Holmes, who called on the UK government to introduce AI legislation during a recent interview with Vixio.
“My concern with the approach in the UK is that it is too reactive. By the time we respond to developments, it may be too late,” said Dawson.
“Without proper legislation, people might develop or invest into solutions that end up not fitting into the regulatory framework that is implemented at a later date,” he said.
“While principles sound good, they are not the same as enforceable rules. The main goal should be protecting consumers and ensuring a fair and equal playing field."
João Veiga, senior manager of AI at Feedzai, was also supportive of the idea of more regulation for AI.
"I've always been a supporter of strong governance around AI, and this approach with the AI Act looks solid and sensible,” he said.
Veiga added that many processes in payments and banking already undergo rigorous quality assurance, but that AI has lacked such scrutiny.
“It's encouraging to see that legislators are not just concerned with AI itself, but with ensuring that those using it can explain their decisions and outcomes."
How is AI harnessed by payment service providers at the moment?
"People have long been asking how AI can be harnessed for payments, particularly in areas like incident correction and fraud detection,” said Ramon Villarreal, global architect and payments lead, financial services at RedHat.
Villarreal explained that, in the payments process, it is crucial to streamline operations and add value for customers while improving efficiency.
“AI capabilities should focus on detecting fraud and enhancing various aspects of the process.”
Nauman Abuzar, ACAMS member and compliance and regtech expert, pointed out that, currently, AI is being utilised in detection models, particularly in onboarding, screening and ongoing monitoring processes.
“The forthcoming AI Act will further unlock AI's potential within institutions, enabling better evaluation of how these systems are developed and trained. It is also crucial to consider the scope of activity tracking involved," he said.
"AI is heavily utilised in AML [anti-money laundering] compliance processes such as know your customer (KYC), with third-party solutions playing a key role,” he continued. “These systems are also deployed for continuous screening of customer names and activities, helping to reduce false positives.”
Villareal continued to suggest that generative AI is now being explored for new use cases, such as transactional payments.
“In the event of system failures, having robust support engines is crucial. However, many of these applications are still exploratory and not yet market-ready.
“Payments is an area where caution is necessary due to its impact on business continuity, the everyday lives of citizens and the stability of countries,” he said.
“Models need continuous improvement, which can delay regulatory timelines and oversight. It’s essential to consider data types for training and to address data protection comprehensively."
Elsewhere in the payments ecosystem, Veiga said, AI is being used by stakeholders in the acquiring and merchant space.
"Acquirers are typically more concerned with acceptance rates and ensuring that businesses are healthy and legitimate. This involves thorough merchant onboarding to verify their legitimacy and understand what the merchants are doing, such as whether they are selling cryptocurrency,” he added.
And with merchants, Veiga said that AI is being used to enhance the customer experience. “The goal is to increase sales, often by coming up with innovative methods to do so. A key aspect is reducing friction in the purchasing process, such as implementing seamless, userless checkouts.”
“Merchants need systems in place to assess the probability of a person not being who they claim to be, typically by checking the risk through behavioural biometrics, all of this without requiring the customer to create an account,” he said.
Overall, he suggested that by leveraging AI, payment service providers can improve customer experience and build greater trust. “When it comes to liability, the focus is often on the responsibility of sending or receiving money. With the rise of romance fraud and other scams in the UK, legislators are working to minimise the damage.”
“As a result, banks will need stronger AI and data systems to effectively monitor fraud on the receiving end,” he said.
Take a look at Vixio's AI Outlook here.
