AI Credit Scoring Under the EU AI Act: High-Risk, With One Exception

Annex III 5(b) covers AI systems “intended to be used to evaluate the creditworthiness of natural persons or establish their credit score”. The reasoning is access to essential services: a score decides whether someone gets a mortgage, a loan or a phone contract, and errors or bias scale across entire populations.

The classification does not depend on model sophistication. A gradient-boosted scorecard, an LLM-assisted underwriting assistant and a deep-learning affordability model all land in the same tier if they score natural persons. Scoring businesses (B2B credit) is outside this entry — it targets natural persons.

The same Annex III entry excludes AI systems used for the purpose of detecting financial fraud. A model that flags anomalous transactions or fake identities is not high-risk under 5(b) — even though it operates in finance and affects customers.

The boundary is purpose: a system that blocks a fraudulent application is fraud detection; a system that estimates the probability of repayment is creditworthiness assessment. If one model does both, assume the high-risk regime applies and document the fraud-only components separately.

If you build and sell the scoring system, you are the provider and carry the core stack before the Annex III application date currently indicated as 2 December 2027: risk management system (Art. 9), data governance covering training data representativeness and bias examination (Art. 10), technical documentation per Annex IV (Art. 11), automatic logging (Art. 12), instructions for use enabling deployer oversight (Art. 13), human oversight design (Art. 14), accuracy and robustness testing (Art. 15), conformity assessment and CE marking (Art. 43, 47–49), and registration in the EU database (Art. 49).

Data governance is where credit models feel the most heat: Article 10 demands examination for possible biases and appropriate mitigation. Expect to evidence performance across demographic groups — a single Gini coefficient will not satisfy an auditor.

Lenders using a third-party scoring system are deployers: they must use the system per instructions, assign competent human oversight, ensure input data relevance, monitor operation, keep logs (Art. 26), and — because credit decisions affect individuals — inform affected persons that they are subject to a high-risk AI system and, on request, explain the decision’s role (Art. 26(11), Art. 86).

Banks and insurers also connect to sectoral law: the Act aligns some governance duties with existing financial-services requirements to avoid duplication, but it does not waive them. If you sell scoring software to EU lenders, expect their procurement to pass these duties through to you contractually.

First, write the risk classification memo — confirm which of your systems fall under 5(b) and which sit in the fraud carve-out. Second, start Annex IV technical documentation; data provenance and bias-testing sections take the longest for credit models. Third, formalise human oversight: who can override a score, and how is that logged? Fourth, plan conformity assessment — Annex III point 5 systems generally follow internal control under Annex VI, without notified-body involvement under Article 43(2).