The GDPR and the AI Act: the upcoming challenge of financial institutions
Risk servicesFebruary 2025 marks the beginning of the regulatory shift towards the implementation of the EU Artificial Intelligence Act, or the so-called AI Act.

Amsterdam
Internal Audit Services Director
Ralu is the Director of Internal Audit Services at Grant Thornton Netherlands.
With an international experience that spams over 20 years in internal audit in various industriesand countries around Europe, Ralu has been involved over the years in setting up internal audit functions and building a culture of effective internal control, managing internal audit co-sourcers, delivering assurance over large IT assurance programs, fraud investigations, governance reviews and leading a service attestation reporting service (3rdparties' assurance) line.
Ralu is a certified internal auditor (CIA) and a certified information systems auditor (CISA). She previously worked for Deloitte ERS (Milan, Italy), Smurfit Kappa (Dublin, Ireland), Atos (France),Post Office UK, Grant Thornton UK. Currently Ralu is also an Audit and Risk Committee and Board Member for an UK non-for-profit organisation.
February 2025 marks the beginning of the regulatory shift towards the implementation of the EU Artificial Intelligence Act, or the so-called AI Act.
By 2 August 2027, every financial institution in Europe will have to comply with one of the most significant and wide-reaching AI regulations to date, becoming accountable not only for what their AI does but also for how it was built. Moreover, most of the requirements of the AI Act will already become applicable by 2 August 2026
In line with the Dutch National Bank (DNB) licensing requirements, your payment institution is required to have an internal audit function in place. A strong internal audit (IA) function is crucial to creating a structure for risk management, supporting compliance activities, and providing opportunities to improve business performance.