This illustrative scenario describes how a Portugal-based fintech scale-up approached an AI Act gap assessment after the Digital Omnibus on AI (Regulation (EU) 2026/1744) reshaped key compliance deadlines in mid-2026. The engagement centred on mapping the company's automated decisioning tools against revised high-risk classification thresholds, Article 50 transparency obligations that took effect on 2 August 2026 as scheduled, and the supervisory expectations of Banco de Portugal and CMVM. The three transferable lessons are relevant to any fintech or technology business operating under Portuguese or EU law that deploys AI systems in regulated financial services.
The Client Profile and the Challenge
Note: this is an illustrative scenario based on patterns typical of the matters we handle. It does not describe a specific client, and no amounts, outcomes or client-identifying details are presented as real.
The company in this scenario is a fintech scale-up incorporated in Portugal, providing automated credit-scoring and investment-suitability tools to retail and SME customers across several EU member states. By early 2026, the business had grown to a size where its AI-driven decisioning layer was genuinely central to its regulated activities – raising questions it had not faced during its earlier, leaner phase of development.
The immediate trigger was not internal: it was external pressure. Banco de Portugal issued supervisory guidance referencing AI governance expectations, and the company received a routine information request from CMVM touching on the explainability of its suitability algorithm. Simultaneously, the company's legal and compliance team recognised that the Digital Omnibus on AI – at that point moving toward political agreement – was about to restructure the timeline they had been planning against. The fear was straightforward: being caught unprepared when enforcement powers became operational.
A secondary concern was the company's exposure to general-purpose AI models integrated via third-party API providers. The compliance team was uncertain whether those integrations created obligations for the company as a deployer, or whether responsibility rested entirely with the provider. That uncertainty was material, because the Article 50 transparency regime applied from 2 August 2026 regardless of the Digital Omnibus amendments.
Strategy and Rationale
Ferraz & Whitmore's approach began with a structured scoping exercise rather than an immediate documentation audit. The rationale was simple: before assessing gaps, the team needed a clear and defensible map of which AI systems were in scope under which provision of the AI Act, and under what revised timeline.
The Digital Omnibus on AI received political agreement on 7 May 2026, passed the European Parliament in plenary on 16 June 2026, was published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026. Its most significant operational effect for this client was the deferral of Annex III high-risk obligations – those covering AI systems listed in Annex III, including systems used in creditworthiness assessment and access to financial services – from 2 August 2026 to 2 December 2027. Annex I obligations (AI embedded in products covered by Union harmonisation legislation) were deferred further, to 2 August 2028.
That deferral was not, however, a reason to slow down. Article 50 transparency obligations and AI Office enforcement powers applied on 2 August 2026 as originally scheduled. The strategy therefore distinguished between two workstreams:
- Immediate obligations (from 2 August 2026): Article 50 transparency requirements, including obligations to inform natural persons when they interact with AI systems, and to label AI-generated content appropriately. These applied without any Digital Omnibus grace period.
- High-risk obligations (deadline 2 December 2027): The fuller Annex III compliance programme – risk management systems, data governance documentation, technical documentation, human oversight mechanisms, conformity assessments, and registration in the EU database. This workstream could proceed at a structured pace but needed a clear project plan to meet the revised deadline without compressing work into the final months.
The rationale for treating these as distinct was partly legal and partly practical: conflating them risked under-resourcing the immediate transparency work while over-engineering documentation that could evolve as national implementation rules in Portugal developed. Where specific national rules had not yet been established, the team described obligations as subject to national rules or pending Portuguese implementing measures, rather than treating any assumption as settled.
For context on how algorithmic transparency obligations operate across jurisdictions, the team also drew on analysis of Article 50 transparency requirements in comparable markets – see our guide to AI Act Article 50 transparency obligations for a comparative perspective.
If your business is working through its own AI Act timeline and is uncertain which obligations apply now and which apply under the revised Digital Omnibus schedule, we are happy to discuss your situation. Contact us at info@ferrazwhitmore.com or visit our contacts page.
Milestones in the Assessment
The gap assessment proceeded in four main phases, each producing a defined output that the client's compliance team could use independently of subsequent phases.
Phase 1 – System inventory and classification. Every AI tool in production or in advanced development was catalogued against the AI Act's classification framework: prohibited practices, Annex III high-risk categories, general-purpose AI components, and systems falling outside scope. The credit-scoring model was provisionally classified as an Annex III high-risk system given its use in creditworthiness assessment for retail customers. The suitability algorithm was assessed separately in light of CMVM's supervisory expectations.
Phase 2 – Third-party and supply-chain mapping. The company's API-based integrations of general-purpose AI models were reviewed to identify where provider obligations ended and deployer obligations began. Contractual terms with two API providers were found to be inadequate for AI Act purposes – they did not contain the information-sharing provisions that the Act requires providers to extend to downstream deployers.
Phase 3 – Article 50 gap analysis. The existing customer-facing disclosures were tested against the transparency obligations that took effect on 2 August 2026. Several gaps were identified: the company's chatbot interactions did not include a sufficiently clear disclosure that customers were interacting with an AI system; the documentation underlying the credit-scoring output visible to customers was not meeting the level of algorithmic transparency the AI Act requires for automated individual decisions in a financial context.
Phase 4 – High-risk compliance roadmap. A detailed project plan was prepared for the Annex III programme, benchmarked against the 2 December 2027 deadline. The roadmap covered risk management system design, technical documentation templates, data governance policy updates, human oversight procedure drafting, and anticipated registration requirements once the EU database procedures for Portugal were confirmed.
Complications Encountered
Three complications arose that are worth highlighting because they appear frequently in similar matters.
Regulatory coordination. The company's activities placed it within the supervisory perimeter of both Banco de Portugal and CMVM, with the AI Office holding overarching enforcement powers under the AI Act. Aligning the AI Act compliance posture with the existing regulatory obligations under both Portuguese financial regulators required careful sequencing. Neither regulator had, at the time of the assessment, published detailed guidance on how they would integrate AI Act supervision with their existing supervisory frameworks – a situation common across member states in mid-2026.
Employment and HR AI tools. During the system inventory, the company identified that it also used an AI-assisted CV-screening and performance-monitoring tool. This raised a question about Annex III classification in an employment context, as well as obligations under Portuguese employment law. The intersection of AI Act requirements with employment law is a distinct area; for companies facing similar questions, our employment law practice in Portugal works alongside the AI Act compliance team on precisely these cross-cutting matters.
Pending national implementation measures. Several aspects of the AI Act's obligations – particularly around the designation of market surveillance authorities and the precise procedural rules for conformity assessment and registration in Portugal – remained subject to national implementing measures that had not been finalised at the time of the assessment. The team built structured optionality into the roadmap to accommodate those rules once published, rather than drafting compliance documentation around assumptions that could prove incorrect.
Outcome Category
By the time the assessment concluded, the company had a classified inventory of its AI systems, remediated Article 50 transparency gaps for the obligations that had already come into force, renegotiated the most critical API provider terms to include the information-sharing provisions required under the Act, and a phased roadmap for full Annex III compliance by 2 December 2027. No guarantees of regulatory outcome are implied: compliance programmes reduce risk and demonstrate good faith; they do not predetermine how a regulator will assess any given situation.
For companies operating in multiple jurisdictions, it is worth noting that the gap assessment methodology developed for this Portugal-based client is substantially applicable across EU member states. For businesses with Dutch operations, our AI Act compliance services in the Netherlands follow an equivalent framework adapted to local supervisory expectations.
Three Transferable Lessons
1. The Digital Omnibus deferred the hard deadlines – but not the live ones. The most common misreading of the Digital Omnibus on AI, which entered into force on 27 July 2026, is that it relieved near-term pressure across the board. It did not. Article 50 transparency obligations and AI Office enforcement powers applied from 2 August 2026 as originally scheduled. Companies that treated the Digital Omnibus as a general reprieve found themselves exposed on the very obligations with the shortest runway.
2. Third-party AI integrations create deployer obligations that contracts rarely reflect. Most companies using general-purpose AI via API have contracts drafted for commercial rather than regulatory purposes. The AI Act imposes information-sharing obligations on providers toward deployers, but those obligations are only operationally useful if the contract actually requires the provider to furnish the relevant technical documentation. Reviewing and renegotiating API terms is a necessary step, not an optional one.
3. Build the compliance programme for the 2 December 2027 deadline now – not in 2027. The Annex III high-risk obligations that were deferred to 2 December 2027 require substantial internal work: risk management systems, technical documentation, data governance updates, human oversight procedures and conformity assessment processes. Companies that treat this deadline as distant will find themselves compressing a twelve-to-eighteen-month programme into a fraction of that time. Starting the structured roadmap in 2026 is the difference between a managed programme and a crisis response.
If your organisation is assessing its AI Act compliance position – whether focused on the transparency obligations already in force, the Annex III programme ahead, or the interaction with Portuguese financial regulators – Ferraz & Whitmore's team can assist with a structured gap assessment. Reach us at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.