Is AI credit scoring high-risk under the EU AI Act?

What is in point 5(b), and what is not?

• Creditworthiness and credit scores of natural persons are in; detecting financial fraud is out.
• A score about a company is not about a natural person.
• AI fraud detection under the EU AI Act takes the exception further.
• The sector view, banking and insurance together: is fintech AI high-risk under the EU AI Act?.

• Point 5(b) of Annex III: AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud.
• Article 6(3): by derogation from Article 6(2), an Annex III system is not considered high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. That applies where any one of four conditions is fulfilled: the system is intended to perform a narrow procedural task; it is intended to improve the result of a previously completed human activity; it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or it is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III. An Annex III system that performs profiling of natural persons is always considered high-risk, and a provider who considers an Annex III system not high-risk documents that assessment before placing it on the market or putting it into service, and is subject to registration under Article 49(2) (Article 6(4)).

What does the lender owe as deployer?

• The Article 26 duties as adapted for financial institutions, and the impact assessment.
• Article 27 sits in Chapter III, Section 3, which applies from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Article 26(5) and (6): a deployer monitors the high-risk system on the basis of the instructions for use, and keeps the logs under its control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise. For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the monitoring obligation is deemed fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms under the relevant financial service law, and the logs are maintained as part of the documentation kept under that law.
• Article 27(1): before deploying a high-risk AI system referred to in Article 6(2), with the exception of one intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5(b) and (c) of Annex III, perform an assessment of the impact on fundamental rights that the use of the system may produce. It consists of a description of the deployer’s processes in which the system will be used in line with its intended purpose; the period of time within which, and the frequency with which, it is intended to be used; the categories of natural persons and groups likely to be affected by its use in the specific context; the specific risks of harm likely to have an impact on them, taking into account the information given by the provider under Article 13; a description of the implementation of human oversight measures, according to the instructions for use; and the measures to be taken if those risks materialise, including the arrangements for internal governance and complaint mechanisms.
• Article 27(2) to (4): the assessment applies to the first use, and in similar cases the deployer may rely on previously conducted fundamental rights impact assessments or existing impact assessments carried out by the provider; an element that has changed or is no longer up to date is updated. The deployer notifies the market surveillance authority of the results, submitting the filled-out template referred to in paragraph 5, and may be exempt from notifying in the case referred to in Article 46(1). Under Article 27(4), as replaced by Regulation (EU) 2026/1744, where an obligation is already met through a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the deployer may include cross-references to the relevant sections of it, or relevant parts of it, in the fundamental rights impact assessment.

What can the borrower ask for?

An explanation of the role the system played in a decision that produces legal effects or similarly significantly affects them.

• Article 86(1): an affected person subject to a decision taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III, with the exception of systems listed under point 2, which produces legal effects or similarly significantly affects that person in a way that they consider to have an adverse impact on their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken. The right does not apply where exceptions from, or restrictions to, it follow from Union or national law in compliance with Union law, and it applies only to the extent it is not otherwise provided for under Union law (Article 86(2) and (3)).