Investment firm
The advisor with a generative AI copilot
“Our team uses an AI assistant to prepare investment proposals. It saves us hours, but what happens if a recommendation goes wrong? Can we just say the tool suggested it?”
AI in Financial Advice: AI Act and MiFID II for Investment Services
The AI Act rolls out its obligations in phases, and ESMA already warned in 2024: responsibility cannot be delegated to the machine. We help you inventory your firm’s AI uses, classify their risk and set up the controls that MiFID II requires today.
Using AI with clients or in your operations? Free assessment
Tell us which AI tools your firm uses (or wants to use) and we will send you a prioritized map of risks and controls.
- 50+ entities advised
- Reply within 24 h
- No commitment
- AI Regulation (AI Act)
- Reg. 2024/1689
- AI Act prohibitions
- February 2025
- GPAI model obligations
- August 2025
- ICT provider clauses
- DORA Art. 30
Services
AI compliance in investment services
From the inventory of uses to the provider contract: the six services we use to apply the AI Act and MiFID II to your day-to-day operations.
AI Act
AI Act compliance
We classify your systems under Regulation (EU) 2024/1689 (prohibited practices, high risk, GPAI), prioritize them by application timeline and design a compliance plan proportionate to your actual use.
Learn more →
Regulation 2024/1689High riskTimelineGPAI
MiFID II
MiFID II with AI built in
Investment services rules do not wait for 2026: if AI touches suitability, recommendations or client information, your firm is already accountable for controlling it and explaining it. We build AI into your policies.
Learn more →
ControlExplainabilityAccountabilityESMA
Automation
Robo-advisors
If the AI does more than support, and actually recommends or manages, review the platform’s full regulatory fit and its license.
Learn more →
LicenseAlgorithm
Suitability
Suitability test
AI-driven profiling: useful for spotting inconsistencies, dangerous without traceability. The test is still yours, not the model’s.
Learn more →
ProfilingTraceability
DORA
Resilience and ICT providers
AI usually comes in through a provider: the register of information, Art. 30 clauses and incident management under DORA.
Learn more →
Art. 30Providers
Third parties
Outsourcing of functions
Third-party models in critical processes: what your firm must reserve by contract and what it must be able to audit.
Learn more →
ContractsAudit
Profiles
How AI is getting into financial firms
Four real conversations from recent months. AI is already inside; the question is whether it is governed.
Banking
The scoring model that decides on loans
“Our model scores the creditworthiness of individual customers. We have been told that this is high risk under the AI Act and that August 2026 is for real. We need a plan with milestones.”
Marketing
The growth lead who segments with AI
“We generate creatives and audiences with AI to attract investors. Compliance stopped one of our campaigns: they wanted to know who reviewed the messages before they went live.”
Operations
The COO automating the back office
“We use AI for reconciliations, alerts and call summaries. It looks low risk, but we want clear criteria on what it can decide on its own and what it cannot.”
Before you deploy
The three mistakes when bringing AI into a regulated firm
None of these failures is technological. All three are about governance: who is accountable, what gets explained and how it is classified.
Delegating responsibility to the tool: ESMA said it publicly in 2024: the firm is responsible for decisions even when they are generated by AI. “The model said so” does not work with the client or with the supervisor.
Using AI in suitability without being able to explain it: if the profiling or the proposal comes from a model that no one can justify, your suitability test loses its evidential value exactly where you need it most.
Classifying wrongly (or late) under the AI Act: mistaking a high-risk use, such as credit scoring of natural persons, for a lesser one, or discovering the phased timeline when it is already upon you, turns an orderly project into a firefight.
| AI use | Regulatory risk level | Expected control |
|---|---|---|
| Credit scoring of natural persons | High risk under the AI Act; the bulk of the obligations apply from August 2026 | System risk management, data quality, technical documentation, human oversight and transparency. |
| Suitability profiling and recommendation generation | Not high risk per se, but MiFID II already requires full control, explainability and accountability from the firm | Traceable profiling, model validation, human review of proposals and alignment with your MiFID II policies. |
| Marketing, communication and internal automation | Generally lower regulatory risk, but still within the framework | Prior review of advertising messages, internal use criteria and oversight proportionate to the impact on clients. |
Shall we govern your firm’s AI?
We inventory your AI uses, classify them under the AI Act, fit them into your MiFID II policies and close out contracts and controls with providers. Proportionate compliance: neither holding back innovation nor signing blank checks on risk.
Frequently asked questions
AI and investment services: common questions
Does the AI Act ban the use of AI in financial advice?
No. Regulation (EU) 2024/1689 regulates AI by risk level: it bans a few extreme practices, imposes stricter obligations on high-risk systems and leaves everything else subject to much lighter requirements.
Financial advice is not listed among high-risk uses per se. That does not mean anything goes: it means that your demanding framework is not (yet) the AI Act, but the sector rules that already apply to you: MiFID II and its whole conduct and control apparatus. We cover this in our AI Act compliance service.
What is the AI Act’s application timeline?
It is phased, and the three dates are worth memorizing:
- February 2025: bans on prohibited practices.
- August 2025: obligations for general-purpose AI (GPAI) models.
- August 2026: the bulk of the obligations for high-risk systems.
The practical consequence: in 2026 there is no more room for pending inventories. If any system at your firm could be high risk, it should have been classified yesterday.
Which financial uses does the AI Act consider high risk?
The textbook case in the sector is creditworthiness assessment or credit scoring of natural persons, which is expressly listed among high-risk uses. Such a system must comply with the full package: risk management, data governance, technical documentation, human oversight and transparency.
Investment advice, suitability profiling and proposal generation are not listed as high risk per se, but classification is done system by system and use by use: the same technology can fall into different categories depending on what you use it for.
What did ESMA say about AI in 2024?
In a 2024 public statement on the use of AI in investment services, ESMA set the principle that governs everything else: MiFID II obligations apply in full when AI is involved, and responsibility toward the client remains with the firm, not with the tool or its provider.
In plain terms: acting in the client’s best interest, controlling the technology you use and being able to explain the results are not voluntary good practices; they are the standard required today. It is the lens through which we review every case in MiFID II compliance.
Can I use generative AI with clients?
You can, with controls proportionate to the impact. Three practical rules: nothing generated by AI reaches the client without defined human review (who approves it and on what criteria); usage limits are set out in writing (what the tool can do and what is off-limits); and everything is logged so it can be reconstructed.
And one line that allows no nuance: if the tool ends up making personalized recommendations on specific instruments, you are providing investment advice, a reserved activity with its full regime. How platforms fit in is covered under robo-advisors.
Who is liable if the AI produces a bad recommendation?
The firm. Toward the client and toward the supervisor, it cannot be passed on: the recommendation is yours, whether it was drafted by an employee, an in-house algorithm or a model contracted from a third party.
The contract with the provider serves to allocate costs internally (warranties, indemnities, service levels), but it does not shift regulatory responsibility an inch. That is why AI contracts are negotiated with an outsourcing of functions mindset: information, audit and orderly exit.
How does AI fit with the suitability test?
As support, fine; as an opaque substitute, not fine. AI can help detect inconsistencies in answers, keep profiles up to date or prepare proposals for review. What it cannot do is turn the suitability test into a black box: the profile and the recommendation must be justifiable with criteria that are understandable and can be reconstructed.
Golden rule: if the CNMV asks you tomorrow to explain why that client received that proposal, the answer has to exist in writing, with dates and versions. If it depends on asking the model, you do not have evidence: you have a problem.
What role do DORA and providers play in all this?
A central one, because most AI comes into firms through third parties. DORA, applicable since January 2025, requires firms to keep the register of information on ICT providers, include the contractual clauses of Art. 30 and manage incidents; and if the model supports a critical function, the outsourcing regime also applies, with effective control by the firm.
In practice: before plugging an external model into a relevant process, review the contract, the information available on the system and the exit plan. We can help through our DORA services.
Operational guide
AI governance in three layers
You do not need a new department: you need an inventory, a classification and controls with an owner. In that order.
An honest inventory
List every real AI use, including unofficial ones: the assistant the sales team uses on its own counts just as much as the corporate model. What is not in the inventory cannot be governed.
Classification through two lenses
Each use is examined through the AI Act lens (prohibited, high risk, other?) and the MiFID II lens (does it touch clients, suitability, information?). Crossing the two gives you the priority and the level of control required.
Controls and evidence
Validation before deployment, human oversight with real authority, a log of decisions and periodic review. All documented: you cannot improvise on the day the request for information arrives.
Responsible AI checklist in 10 steps
- Inventory of uses: list every AI tool in the firm, official or not, with its purpose, its data and its users.
- AI Act classification: identify prohibited practices, high-risk cases (such as credit scoring of natural persons) and all other uses.
- Applicable timeline: map each use against the AI Act phases: prohibitions since February 2025, GPAI since August 2025 and, for the most part, high risk since August 2026.
- MiFID II lens: determine which uses touch suitability, recommendations or client information: there, control is required today, without waiting for anything.
- Explainability: make sure every relevant output can be justified in terms the client, the auditor and the supervisor can understand.
- Human oversight: appoint people with real power to review, correct and switch off the system, and document their interventions.
- Validation and monitoring: test models before using them and monitor their behavior afterward: drift, errors and client complaints.
- Providers and contracts: apply DORA and the outsourcing regime: information on the model, audit, incidents and exit plan.
- Team training: teach those who use AI what they can ask it, what they must verify and what they cannot sign off without review.
- Logging and review: document decisions, incidents and model changes, and review the whole framework at a set frequency.
For the regulatory detail, see our AI Act compliance service; for the fit with your investment operations, MiFID II compliance.
Working glossary
The vocabulary of regulated AI
Nine terms that link the AI Act with investment services rules. You will see them in supervisors’ questionnaires, provider contracts and internal committees.
AI ActLaw
Regulation (EU) 2024/1689
The EU framework for artificial intelligence: it regulates by risk level, from prohibited practices to minimal-risk uses, with phased application.
Key phases: 2025 (prohibitions, GPAI) and 2026 (high risk).
High riskCategory
Uses under the microscope
Systems listed by the AI Act with stricter obligations: risk management, quality data, documentation and human oversight. Credit scoring of natural persons is included.
Bulk of the obligations from August 2026.
GPAICategory
General-purpose models
Large models that can be used for many tasks. Their specific obligations apply from August 2025 and fall mainly on their providers.
If you use them, demand information from the provider.
Prohibited practicesLimit
Banned since 2025
Categories of use that the AI Act bans outright from February 2025. No project at a financial firm should come anywhere near them.
The first filter of any inventory.
ExplainabilityMiFID II
Being able to justify the output
The ability to explain why the system profiled, recommended or ruled out something, in terms the client and the supervisor can understand.
Without an explanation, the recommendation cannot be defended.
Human oversightControl
The person above the machine
People with the authority and resources to review AI outputs, correct them and stop the system if necessary.
A cross-cutting requirement: AI Act and MiFID II.
ESMA 2024 statementSupervisory view
Responsibility cannot be delegated
ESMA’s public statement on AI in investment services: MiFID obligations remain fully in place and responsibility lies with the firm.
Applies to in-house and third-party AI.
ProfilingUse
AI applied to the client
Use of models to classify clients and estimate their investor profile. Useful as support; sensitive if it replaces the test without traceability.
The suitability test remains the firm’s responsibility.
ICT providerThird parties
Where AI comes in
Most models arrive through third parties. DORA requires a register of information, contractual clauses and incident management; outsourcing rules require effective control.
DORA Art. 30 for the clauses.
AI playbook
Typical uses, risk and control: the working matrix
Profiling and suitability
Full MiFID II framework: AI support does not lower the test’s requirements or its evidential value.
Traceable profiles, documented model validation and human review of borderline cases.
Recommendation generation
The firm bears full responsibility for every proposal, with explainability and review before it reaches the client.
Human approval workflow, log of generated proposals and reproducible justification for each recommendation.
Marketing and communication
AI-generated messages go through the same filter as any financial advertising: clarity, balance and prior approval.
Advertising review procedure, approved versions and campaign log.
Credit scoring of natural persons
Treated as high risk under the AI Act, with the bulk of the obligations applicable from August 2026.
Formal classification of the system, a compliance plan with milestones and technical documentation of the model.
Internal automation
Proportionate use: clear criteria on what the machine decides on its own and oversight matched to the impact.
Internal AI use policy, matrix of decisions that can be automated and incident log.
Signs your AI is out of control
Five symptoms we find in almost every initial assessment. None of them fixes itself.
- There is no inventory of AI tools: each team uses its own and nobody has the full picture.
- AI-generated proposals reach the client without anyone reviewing them and with no record of who approved them.
- No one has checked whether any in-house system falls into the AI Act’s high-risk categories.
- The contract with the model provider gives no right to information, audit or an orderly exit.
- The internal narrative is “the tool got it wrong”: nobody takes ownership of the decisions.
Related decisions
The control ecosystem around AI
AI is not governed in a vacuum: it relies on the risk management function, on provider management and on the personal data framework. These pieces complete your governance system.
Control
Risk management in investment firms
The second line must also monitor model risk: how to integrate AI into the firm’s risk map.
See the function →
RisksInvestment firms
Innovation
Financial sandbox
For innovative AI projects, the controlled testing environment under Law 7/2020 may be the way in.
See the sandbox →
Law 7/2020Testing
Data
Outsourced DPO
AI feeds on personal data: the data protection officer is part of the governance system.
See the service →
GDPRData
Framework
Financial compliance
Build AI into your overall compliance program instead of treating it as a stand-alone project.
See the approach →
ProgramIntegration
Start with the AI Act assessment and how it fits with MiFID II compliance. If your case is a fully automated platform, see robo-advisors; if AI comes in through providers, DORA.
Contact
Book a call
Tell us which processes AI supports at your firm (profiling, proposals, marketing, back office) and we will explain what the AI Act requires and what MiFID II already requires.
AI in financial advice and investment services: the AI Act, MiFID II and ESMA’s position
Artificial intelligence is already at work inside Spanish investment firms: it profiles clients, prepares proposals, generates campaigns and automates the back office. Regulation (EU) 2024/1689 (AI Act) gives it a framework with phased application, but the costliest mistake is to believe there is a legal vacuum until that timeline is complete: a supervised firm never starts from zero, because MiFID II already requires full control, explainability and accountability for any technology that touches the client. This page brings both levels together and turns them into a working map.
The AI Act’s phased timeline
The AI Act applies in phases: the prohibitions on banned practices have applied since February 2025; the obligations for general-purpose AI models (GPAI) since August 2025; and the bulk of the obligations for high-risk systems since August 2026. In the financial sector, the high-risk case par excellence is creditworthiness assessment or credit scoring of natural persons, which brings with it risk management, data governance, technical documentation, human oversight and transparency. Classification is done system by system: the same technology can be high risk in one use and not in another.
Advice is not high risk per se… but MiFID II is already here
Financial advice is not among the AI Act’s high-risk uses. It would be a mistake to read that as a free zone: in 2024 ESMA published a statement on the use of AI in investment services with an unequivocal message: MiFID II obligations apply in full and responsibility is not delegated to the AI or to its provider. If a model takes part in the suitability test, in generating recommendations or in client information, the firm must control it, be able to explain its outputs and answer for them as if an employee had produced them. This is the standard we apply in MiFID II compliance.
Map of uses: from profiling to the back office
In practice, we group uses into four families with decreasing requirements. Profiling and suitability: maximum care, because it goes to the evidentiary core of advice. Recommendation generation: prior human review and reproducible justification; if the system recommends autonomously, you are in robo-advisor territory and the analysis includes the license. Marketing: AI-generated messages go through the same filter as any financial advertising. And internal automation: lower risk, but with written criteria on what can be decided without a human and an incident log.
Governance: providers, DORA and evidence
Almost all AI comes in through third parties, so governance is won or lost in the contracts. DORA, applicable since January 2025, requires firms to keep the register of information on ICT providers, include the Art. 30 clauses and manage incidents; when the model supports a relevant function, the outsourcing regime is added, with rights of information, audit and exit. The system is completed by evidence: a living inventory, documented classifications, validations, recorded human interventions and periodic review. When the supervisor asks (and it will), the answer must already be in writing.
AI and regulated technology
MiFID II compliance
Official sources
Key legislation, linked to the official text:
- Regulation (EU) 2024/1689 of June 13, 2024 laying down harmonized rules on artificial intelligenceEUR-Lex · Official Journal of the EU
- Law 7/2020 of November 13 on the digital transformation of the financial systemBOE · consolidated text
Legislation and links reviewed in .