AI and financial-sector governance

Assess the institution’s intended use, provider/deployer role and system risk category. Certain uses involving natural persons’ creditworthiness may be high-risk; financial analysis is not uniformly classified. Trace tools can support relevant obligations but do not make a model automatically compliant. European Commission AI Act framework.

The Commission’s published timetable distinguishes general application from transitional dates for specific high-risk categories and reflects Digital Omnibus on AI changes. Check the current official timetable together with the applicable legal text for the actual use case. No single date governs every obligation. Official implementation timetable.

Banking/customer confidentiality, information-security, outsourcing, access, audit-trail and continuity duties depend on the institution’s applicable rules. An on-premises installation alone does not fulfil them. Agree deployment location, key custody, access, change management and audit arrangements with the institution’s technology and legal teams. Do not assume a universal ten-year period for every log category. BDDK legislation directory.

Assess ICT contract requirements, support for critical or important functions, subcontractors and locations, incident assistance, audit access and exit provisions. Sigillum is not represented as a designated critical ICT third-party provider in every engagement. The institution’s assessment and contract determine the applicable duties. DORA legal text.

Hashing, signatures and witness verification are technical integrity mechanisms. They do not automatically constitute a secure electronic signature or qualified certificate under Türkiye’s Law No. 5070, or a qualified electronic seal under eIDAS. Required trust-service, certificate and provider conditions need separate assessment. Evidential weight depends on the facts and procedure. BTK electronic-signature information; EU eIDAS framework.