The EU AI Act for fintech & credit scoring

If your fintech, lender or bank uses AI to assess creditworthiness or produce a credit score, the EU AI Act treats that system as high-risk — by name. Annex III, point 5(b) singles out credit scoring. Here is what a lending or risk team needs to know, without the legalese.

Why credit-scoring AI is high-risk

Annex III(5)(b) covers AI systems used to evaluate the creditworthiness of natural persons or establish their credit score, with one carve-out: fraud-detection systems are excluded. The reasoning is that a credit decision gates access to an essential service, so an opaque or biased model can entrench financial exclusion. That pulls most AI underwriting, alternative-data scoring and automated loan-decisioning tools into the high-risk regime. (Note: creditworthiness for natural persons — consumer lending — is the trigger; pure B2B credit is treated differently.)

What you have to do

• Human oversight. A person must be able to review and override automated credit decisions — this dovetails with GDPR Article 22 on solely-automated decisions.
• Bias & accuracy testing. Demonstrate the model does not discriminate across protected characteristics and performs to a stated accuracy — document the metrics and why they are appropriate.
• Data governance. Training and input data must be relevant, representative and examined for bias — a natural fit with existing model-risk practice.
• Technical documentation. Providers keep the Annex IV file and register the system; deployers keep logs and monitor it in production.
• Post-market monitoring. Track real-world performance and report serious incidents.

It layers on top of your existing rules

For regulated lenders this mostly extends obligations you already meet — model-risk governance, fair-lending testing, GDPR. The AI Act formalises them into a conformity assessment and a documentation trail. If you are a leaner fintech, this is where a purpose-built workflow saves the most time.

Deadlines

Annex III high-risk obligations were rescheduled to 2 December 2027 under the Digital Omnibus — see the deadlines guide. Given how long model validation and audit cycles run in lending, starting the paperwork now is the pragmatic move.

Where to start

Check exactly which of your models are in scope and at what tier with the free EU AI Act Snapshot — two minutes, no signup. SetAIComply then covers classification, bias testing, data-governance records and Annex IV documentation for credit-scoring systems; the plans start at €0.