How Does the AI Act Apply to Credit Scoring?

Which credit functions are listed?

Annex III point 5(a) lists AI systems intended to be used to evaluate the creditworthiness of natural persons or to establish their credit score. That covers systems that assess whether a person is likely to repay, that produce a score or rating used in a lending decision, and that evaluate credit risk on the basis of personal data. A system that only stores credit data, only presents an application form, or only calculates an interest rate from a score already determined, without evaluating creditworthiness or establishing a score, is assessed differently, and the distinction must be recorded from the actual function. The record should describe what the system evaluates, what data it uses, what score or evaluation it produces, who uses the output and what lending decision follows. A vendor's description of a system as a data tool or a decision aid does not settle the question: the function of evaluating creditworthiness or establishing a score is what the listing describes, and it must be tested on the facts.

How is a credit scoring system classified?

Classification follows the Article 6 route, with profiling as the decisive question. A credit scoring system that evaluates a person on the basis of personal data will ordinarily involve profiling, which means the Article 6(3) route is unavailable and the system is always high-risk where it falls within the listing. The classification record should address profiling directly, citing the data, the evaluation and the output, and should not rely on a narrow-task claim where the system materially influences a lending decision. The provider's documentation and the deployer's assessment should describe the same system and the same function, and the deployer should not assume the provider's classification without seeing the reasoning. Where the system is supplied by a third party, the deployer should obtain the provider's classification, conformity and documentation information, and should record how it assessed the system for its own lending context, population and decision process.

For the broader regulatory framework, see finance, insurance and critical infrastructure.

What data governance and bias questions arise?

Credit scoring engages data governance, bias and discrimination questions that go to the heart of the high-risk requirements. The provider must address data quality, representativeness, bias examination and mitigation in the data governance requirements, and the deployer must monitor outcomes for the population it serves. A scoring model trained on historical lending data can reproduce historical patterns, including patterns that reflect discrimination, and a model that uses proxies for protected characteristics can produce uneven outcomes even where the protected characteristic itself is not an input. The team should therefore examine the training and validation data, the features used, the performance across groups, and the outcomes in deployment, and should record the bias examination, the mitigations and the residual risks. That examination should be done with data protection and equality advice, since special-category data can be processed for bias detection only in the defined circumstances the consolidated text provides, and the examination itself must be lawful.

What oversight and explanation must a lender plan?

A lender deploying a high-risk credit scoring system must assign human oversight to competent people, use the system in accordance with instructions, monitor its operation and retain logs, and must be able to explain a lending decision to the person affected. Oversight means a person with the competence, time and authority to assess the score, to consider information beyond the score, and to decide differently from the system where the facts require it. Explanation means the person scored can understand the main factors behind the decision, the data used and the route to challenge it, subject to the rights and procedures in the Act, data protection law and consumer credit law. The lender should also plan for the Article 86 explanation right where it applies, for data subject rights, and for complaints and appeals, with a named owner and a timescale for each. A lending decision that follows a score automatically, without oversight or explanation, does not reflect the deployment the Act requires for a high-risk system.

What sector law sits alongside the AI Act for credit?

Credit scoring sits within financial regulation, consumer credit law, data protection law and equality law, each of which imposes duties the AI Act does not replace. Authorisation, conduct, disclosure, responsible lending, creditworthiness assessment and the handling of credit data are governed by sector and national law, and the AI Act file should be kept alongside the sector file, describing the same system, data and decisions. The combined file should record the sector authorisation and conduct position, the data protection assessment, the equality and bias examination, and the AI Act classification and conformity position, with a shared system identifier and a single review cycle. This guide gives no dates for sector law, and any sector date must be verified in the sector instrument itself. A credit decision that is compliant with the AI Act but breaches responsible lending or equality law is not a lawful decision, and the file should be designed to prevent that gap.

Continue with insurance pricing and underwriting.

What does this guide not decide?

This guide does not decide whether any credit scoring system is high-risk, does not determine whether a lending decision was lawful or fair, and does not give financial, credit or legal advice. Those questions depend on the system's function, data and outputs, the lending decision process, and the applicable financial, consumer, data protection and equality law, applied to the specific facts with qualified advice. The guide also does not assess the predictive validity of any scoring model. Where a credit scoring system is to be deployed, confirm the classification, data governance, oversight, explanation and sector position with a competent authority or legal adviser before the system influences a lending decision.

Frequently asked questions

Continue through this AI Act cluster

• finance, insurance and critical infrastructure
• insurance pricing and underwriting
• Article 6(3) and profiling in sector uses
• sector oversight, evidence and impact assessment
• deployer responsibilities
• high-risk AI systems