Prompt Attention: The Treatment of AI Assistants at Banks, Investment Firms and CASPs Under EU Laws

October 27, 2026

The European Banking Authority (“EBA”) reported in September 2025 that more than half of the banks it surveyed were using general-purpose or agentic AI in processes facing consumers. Behind most client assistants sits a model that the bank, investment firm or crypto-asset service provider (“CASP”) did not build and would not ordinarily be able to inspect or change, while the firm would appear to answer for what the assistant tells its clients.

Under the EU’s AI Act, a firm that builds an assistant on a third-party model and offers it under its own name is likely to be the assistant’s provider, with a short list of obligations centered on telling clients they are dealing with an AI system and marking what it writes. The list grows considerably where the assistant is put to a use the Act treats as high-risk, such as assessing creditworthiness, while the heavier obligations for the most capable models would ordinarily stay with the companies that train them.

The more demanding requirements are the familiar ones in the Markets in Financial Instruments Directive (“MiFID II”) and the Markets in Crypto-Assets Regulation (“MiCA”), which regulate what is done for a client whoever, or whatever, does it. An assistant built to explain products can drift into advising, and one that takes orders in conversation may misread an instruction. A firm would appear best placed where the model conducts the conversation and the decisions the firm answers for rest on rules the firm controls or on the client’s confirmation of each order and payment.

Cahill’s alert also considers when the second Payment Services Directive (“PSD II”) applies to assistants that deal with payments and agents that make them, and what a firm should secure in its agreement with the model provider under the Digital Operational Resilience Act (“DORA”). Consumers concluding financial services contracts at a distance may also, since 19 June 2026, ask for a human to intervene where a firm uses online tools such as chatbots. Competent authorities may be expected to judge a client assistant much as they would an agency hire at the front desk, by what it tells clients and does on their accounts and by how carefully the firm briefed and supervised it.

Read the full alert below.

Prompt Attention: The Treatment of AI Assistants at Banks, Investment Firms and CASPs Under EU Laws