The EU AI Act credit scoring regime now has a fixed start date: AI systems that evaluate the creditworthiness of individuals will face the Act’s full high-risk regime from 2 December 2027, not 2 August 2026 as originally scheduled. The change comes from the Digital Omnibus on AI, which the Council of the EU gave its final green light on 29 June 2026 and which, according to the European Commission, entered into force on 27 July 2026.
For lenders, BNPL providers and fintechs that score consumers with machine learning, the delay buys roughly 16 months of runway. It does not change what has to be built.
Why the EU AI Act treats credit scoring as high-risk
The AI Act (Regulation (EU) 2024/1689) sorts AI systems into four tiers: prohibited, high-risk, limited or transparency risk, and minimal risk. Credit scoring sits in the second tier. Annex III, which lists stand-alone high-risk use cases, includes under “access to and enjoyment of essential public and private services” AI systems evaluating creditworthiness, except when they are used to detect financial fraud. The same heading covers AI used for risk assessment and pricing in health and life insurance.
The Commission’s own illustration of the category is direct: credit scoring denying citizens the opportunity to obtain a loan. The concern that model decisions are hard to explain overlaps with the debate Fintechly has covered in Explainable AI in finance: what it is and why regulators want it.
Which models are caught, and which may fall outside
Being listed in Annex III does not automatically make every system high-risk. Under Article 6, an Annex III system can fall outside the regime if it only performs a narrow procedural task, improves the result of a completed human activity, detects deviations from prior decision-making patterns without replacing human review, or performs a preparatory task. Two limits matter for lenders:
- Profiling overrides the exemptions. An Annex III system is always high-risk if it profiles individuals, meaning automated processing of personal data to assess aspects such as a person’s economic situation, reliability or behaviour. Most consumer credit models do exactly that.
- The exemption must be documented. A provider that believes its Annex III system is not high-risk must record that assessment before placing it on the market or putting it into service.
The fraud carve-out is also narrow. A transaction-monitoring model that flags suspected fraud is excluded from the creditworthiness category; a model that uses fraud signals to decide whether to extend credit is still assessing creditworthiness.
The new AI Act timeline after the Digital Omnibus
The Commission proposed the Omnibus in November 2025, the co-legislators reached political agreement on 7 May 2026, and the Council’s adoption on 29 June 2026 completed the process.
| Obligation | Applies from | Relevance to lenders |
|---|---|---|
| Prohibited practices (eight original bans) and AI literacy | 2 February 2025 | Already in force; social scoring and exploitation of vulnerabilities are banned |
| General-purpose AI model obligations | 2 August 2025 | Mainly model developers; affects firms building on foundation models |
| Article 50 transparency obligations; AI Office enforcement powers | 2 August 2026 | Customer-facing chatbots must disclose that users are dealing with AI |
| Grace period for Article 50(2) for systems already on the market | 2 December 2026 | Marking of AI-generated content |
| Stand-alone high-risk systems under Annex III, including creditworthiness | 2 December 2027 | Full regime for credit scoring models |
| High-risk AI embedded in regulated products under Annex I | 2 August 2028 | Limited relevance to financial services |
The Commission says the later dates are intended to ensure the rules apply when companies have support tools such as harmonised standards. Those are starting to arrive: the Commission lists the first harmonised standard supporting the AI Act as published in the Official Journal on 19 October 2026.
What providers of credit scoring AI must build
Most obligations fall on the provider, the organisation that develops a high-risk system and places it on the market or puts it into service under its own name. That includes a bank building its own scorecard in-house, a fintech selling a decisioning engine, and providers outside the EU whose system’s output is used in the EU. Before 2 December 2027, providers of creditworthiness models must:
- Run a risk management system across the model’s lifecycle.
- Apply data governance so that training, validation and testing data are relevant, sufficiently representative and, as far as possible, free of errors and complete.
- Prepare technical documentation that lets authorities assess compliance.
- Build in automatic logging so events relevant to risks, substantial modifications and post-market monitoring are recorded.
- Give deployers instructions for use and design the system so deployers can exercise human oversight.
- Achieve appropriate accuracy, robustness and cybersecurity.
- Operate a quality management system, complete a conformity assessment, issue an EU declaration of conformity and affix the CE marking.
- Register the system in the EU database for high-risk AI systems.
The Omnibus also extends certain simplified requirements, including lighter technical documentation, from SMEs to small mid-cap companies.
Deployers: lenders using third-party scores still carry duties
A lender that buys a scoring model rather than building one is a deployer. Deployers carry fewer obligations than providers but are not out of scope. The Commission’s description of the post-market phase is that deployers ensure human oversight and monitoring, providers run post-market monitoring, and both report serious incidents and malfunctioning. The Act also applies to deployers outside the EU where the system’s output is used in the EU.
The provider and deployer line can blur. A lender that retrains a vendor model on its own data, or puts its name on a white-labelled decision engine, should assess whether it has taken on provider obligations. Contracts with scoring vendors should already address who holds the technical documentation, who keeps the logs and how incidents are escalated.
What the EU AI Act credit scoring delay does not change
The Omnibus deferred the high-risk regime; it did not repeal it or water down the requirements for creditworthiness models. Three points deserve attention now:
- Prohibitions are live. Since February 2025 the Act has banned practices including social scoring and AI that exploits vulnerabilities linked to age, disability or socio-economic circumstances to distort behaviour and cause significant harm. Aggressive collections or targeting models need checking against these bans today.
- Transparency rules are live. Article 50 has applied since 2 August 2026, so AI assistants used in onboarding, servicing or collections must tell customers they are interacting with AI.
- Supervision is split. The Council noted that, for AI systems built on a provider’s own general-purpose model, national authorities rather than the AI Office remain competent in certain areas, including financial institutions.
EU AI Act credit scoring FAQs
Does the AI Act apply to a traditional logistic regression scorecard?
It depends on whether the scorecard meets the Act’s definition of an AI system, which the Commission has addressed in separate guidelines on the AI system definition. Firms should run each credit model through that definition and record the outcome. If a model qualifies as an AI system and evaluates individuals’ creditworthiness, the Annex III high-risk regime applies from 2 December 2027.
Are fraud detection models used in lending classed as high-risk?
Annex III expressly excludes AI systems used to detect financial fraud from the creditworthiness category. The exclusion covers fraud detection, not credit decisioning that happens to use fraud signals. If a model’s output decides whether a person is offered credit, it should be assessed as a creditworthiness system.
Can a lender argue its credit model is not high-risk under Article 6?
Article 6 lets an Annex III system escape the high-risk tier if it performs only narrow procedural or preparatory tasks. However, any Annex III system that profiles individuals is always high-risk, and most consumer credit models profile applicants’ economic situation or reliability. A provider relying on an exemption must document its assessment before placing the system on the market.
Does a non-EU fintech need to comply if it lends to EU residents?
Yes, in many cases. The AI Act applies to providers that place high-risk systems on the EU market regardless of where they are established, and to third-country providers and deployers where the system’s output is used in the EU. A UK, US or UAE lender scoring EU applicants should assume the regime reaches it.
What should a lender complete before December 2027?
A practical sequence is an inventory of every model that touches credit decisions, a classification of each against Annex III and Article 6, and a clear provider or deployer role for each. Providers then need the risk management, data governance, logging, documentation, quality management and conformity assessment work. Registration in the EU database is required before a high-risk system is placed on the market.
For lenders and credit fintechs, the December 2027 date is best read as a build deadline rather than a reprieve. The obligations for creditworthiness models are unchanged, harmonised standards are beginning to land, and transparency duties are already enforceable. Firms operating on both sides of the Atlantic will need to reconcile this regime with US expectations covered in AI Underwriting Is Reshaping US Consumer Lending Risk and AI Model Risk Management Rules for US Banks Just Got Narrower.
