The AI act is less than a month old; you were likely dealing with either older or local legislation, or some attempt at corporate responsibility (possibly risk management; if you tell your financial regulators “yeah, an unverifiable magic box makes the lending decisions, unreviewed”, you will likely get in trouble, at least in the post-noughties-financial-crisis era).

The EC is usually rather sceptical of attempts to work around the rules.

Yup, that's my worry about these things, too.

As a regulator, you don't penalize the employee; you penalize the company as though it were a wilful violation.