For fintech · Written by Yobel Tzegai · Last checked 3 November 2026

What will banks and lenders ask about the AI in your fintech product?

Whether it evaluates creditworthiness. AI evaluating natural persons' creditworthiness or establishing their credit score is high-risk under point 5(b) of Annex III, except AI used to detect financial fraud; life and health insurance risk assessment and pricing falls under point 5(c). Barring Article 6(3), obligations start on 2 December 2027 (Article 113, third paragraph, point (c)(i), as amended). Complipath (complipath.io) answers that per system, with the article behind it.

What it is for: when an enterprise customer's review asks about your AI, the answers are ready, each with its source, so the review need not hold up the deal.

Get my risk classes, freeBook a 20-min call20 minutes with the founder.

Why do your enterprise customers ask about your AI?

A lender or insurer that buys your scoring or pricing tool is its deployer.
Before deploying a point 5(b) or 5(c) system it assesses the impact on fundamental rights (Article 27(1)), taking into account the information you give under Article 13.
An applicant affected by a decision with legal or similarly significant effects that they consider adverse can obtain from it an explanation of the AI's role and the main elements of the decision (Article 86(1)).

Financial institutions subject to internal governance requirements under Union financial services law meet two Article 26 duties through that framework: the monitoring duty is deemed fulfilled by complying with those internal governance rules, and the logs are kept within that documentation (Article 26(5) and (6)).

Bans come before classification.
AI that exploits vulnerabilities due to age, disability or a specific social or economic situation, with the objective or effect of materially distorting behaviour in a way that causes or is reasonably likely to cause significant harm, has been prohibited since 2 February 2025 (Article 5(1), first subparagraph, point (b)); so has social scoring that leads to detrimental or unfavourable treatment in unrelated social contexts, or treatment unjustified or disproportionate to the social behaviour or its gravity (point (c)).

Point 5 of Annex III lists: (b) "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud"; and (c) "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance".
Under Article 6(2) those systems are high-risk, unless Article 6(3) applies, which it never does to a system that profiles natural persons.
Article 27(1) requires deployers of high-risk AI systems referred to in points 5(b) and (c) of Annex III to perform a fundamental rights impact assessment before deploying them, whatever their legal form.
Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply to these systems from 2 December 2027 (Article 113, third paragraph, point (c)(i), as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI)).

Which questions and audits do they send?

Does any system evaluate creditworthiness or establish a credit score (point 5(b) of Annex III)?
Is your fraud model used only to detect financial fraud, or does its output feed lending decisions?
Does any system assess risk or set prices for life or health insurance (point 5(c) of Annex III)?
What will you give us for our fundamental rights impact assessment (Article 27(1), point (d))?
Can you explain a declined application well enough for us to answer the applicant (Article 86(1))?
How were the training data examined for possible biases (Article 10(2), points (f) and (g))?
Which inputs feed the score, and why is each relevant to the decision (Article 5(1), first subparagraph, point (c))?
Which logs does the system generate, and for how long are they kept (Article 19(1); Article 26(6))?

What does Complipath do for you?

A register of your AI systems, each classified by fixed rules with the article behind it, and confirmed by you.
Requirements per system, each with an owner, a status and a date.
Customer questionnaires answered in the customer's own Excel, Word or PDF, each answer with its source; what it cannot answer is marked "needs your answer" (Starter and up).
A whole security review: 17 common topics answered from what you confirmed (Starter and up).
GDPR basics and DPIA/FRIA applicability per system on every plan; DPIA and FRIA documents on Growth.
An audit room, an audit report in PDF or Word and an audit pack (Starter and up); on Growth, the audit room shared with your customer.
A Trust Center (Growth and up): files a customer requests go out only after your yes, on a seven-day link.

What one system looks like, as an example

Example · a fictional system, not a customer
AI system	What it does	Risk class	Article	What it owes
Affordability Score	Estimates whether a consumer applicant can repay a loan, for lenders' credit decisions.	High risk	Point 5(b) of Annex III; Article 6(2)	The fraud exception does not reach it, because it evaluates creditworthiness. From 2 December 2027 the provider owes the Chapter III, Section 2 requirements and the Article 16 obligations, conformity assessment by internal control among them (Article 43(2)); the lender performs a fundamental rights impact assessment before deploying it (Article 27(1)).

A questionnaire already waiting?

Questionnaire waiting? We answer it in 48 working hours.

Starter

€499 a month

or €4,990 a year. Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
The Free plan is for one AI system and one user, with no end date

Get my risk classes, free

All plans

Questions

Is AI credit scoring high-risk under the EU AI Act?

As a rule, yes. Point 5(b) of Annex III lists AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud. A score about a company is not about a natural person, so that point does not catch it.

Does the fraud exception cover our fraud model?

Only while it detects financial fraud. The exception in point 5(b) of Annex III takes AI systems used for the purpose of detecting financial fraud out of the creditworthiness point, nothing more. A model whose output helps decide whether someone can repay is evaluating creditworthiness, and the exception does not reach it.

Who carries out the fundamental rights impact assessment?

The deployer, usually the lender or insurer. Article 27(1) requires deployers of high-risk AI systems referred to in points 5(b) and (c) of Annex III to assess the impact on fundamental rights before deploying them, from 2 December 2027. As provider, you supply the Article 13 information the assessment takes into account.

Is insurance pricing AI high-risk?

Only for life and health insurance. Point 5(c) of Annex III covers AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Motor, home and other general insurance pricing is not in that point, and no other Annex III point lists it.