Companies Flying Blind
AI Act Massively Underestimated

Time is running short: From August 2, 2026, binding rules for the use of Artificial Intelligence will apply throughout Europe. The EU AI Act brings comprehensive requirements that particularly affect sensitive areas such as lending, credit assessment, and monitoring of business risks. Requirements such as transparency, documentation obligations, and traceability will become the new norm for companies using AI in risk management.

The current 2025 Risk Management Study by CRIF, together with EY Austria and Business Circle, paints a grim picture of corporate preparedness. The key findings are a wake-up call:

• Hardly Any Preparation, High Adjustment Need

  Almost two-thirds (63.6%) of companies have taken little or no measures to implement the new requirements. At the same time, 72.7% estimate the adjustment need for their AI systems as very or rather high.

According to the study, the biggest challenge lies in the data situation. While 61.8% of companies plan to use AI, the basic prerequisites are often lacking.

• Missing data basis: 45.5% of companies state that they don't have sufficient data available for agile risk management.
• Lack of real-time data: Only 14.5% of respondents have complete real-time data, which is essential for modern AI applications.

Technology can only be as good as the data it's based on. Without high-quality, up-to-date, and structured data, no AI in risk management can reach its full potential.— Anca Eisner-Schwarz, CEO of CRIF Austria

The CRIF study makes clear: Companies that invest early in data quality, technological integration, and regulatory knowledge create a stable foundation. This serves not only to comply with the new AI Act requirements but is also crucial for long-term resilience and strategic capability.