EU AI Act Credit Scoring: Annex III for Fintech

If your model decides whether a natural person gets credit, or what score they carry, you are in Annex III point 5(b). That is high-risk. The exception is narrow: AI used for the purpose of detecting financial fraud. "We also catch fraud" in the same scoring pipeline does not pull the credit decision out.

Life and health insurance risk assessment and pricing for natural persons is point 5(c). Same chapter, same clock: 2 December 2027 after the Digital Omnibus.

Credit scoring profiles natural persons. That kills the Article 6(3) exit even if a human clicks approve.

Is Every Lending Model High-Risk?

No. The annex talks about evaluating the creditworthiness of natural persons or establishing their credit score. A model that only scores companies is not 5(b). A model that only detects mule accounts or card fraud, and does not set a person's credit score, sits in the exception.

The messy products:

• BNPL and instant credit. If a consumer gets a limit from a model, that is creditworthiness. Call it "risk appetite" if you want. The annex does not care.
• Open-banking affordability. Still 5(b) if the output is a person's score or a yes/no on credit.
• Collections prioritisation. Often not 5(b). Can still be GDPR profiling. Classify it; do not assume.
• Internal IRB / capital models that never touch a person's access to credit. Different job. Still check whether any consumer-facing decision reuses the same score.

Article 6(3) will not save a scorer. Profiling of natural persons is always high-risk. Credit scoring is profiling.

What Must a Fintech Provider Actually Build?

The high-risk pack: Article 16 as the index, then Articles 9–15, a QMS, Annex IV, logs, instructions, human oversight, accuracy metrics, conformity, CE, registration.

Banks already live under CRD/CRR and EBA model-risk language. Article 26 even says financial institutions can treat some monitoring duties as met through existing internal-governance rules. That is a deployer comfort. It does not delete Annex IV for a provider who puts a new scoring SaaS on the Union market.

If you buy a vendor score and only consume it, you are likely the deployer. If you wrap it, fine-tune it, or put your brand on the decision, read Article 25 before the next board pack.

What Should Lenders Do Before 2027?

Three files this year beat a panic in 2027:

1. Intended purpose: "evaluate creditworthiness of natural persons in Member State X for product Y." One sentence.
2. A metric you can defend (default prediction horizon, protected-characteristic tests, reject-inference honesty).
3. Instructions a credit officer can follow, including when to override.

My take: the fraud exception is the most abused sentence in Annex III. If the model outputs a credit limit, you are not in the exception.

Run the classification. Keep the scorecard file in Nytivo.

Frequently Asked Questions

Is credit scoring high-risk under the EU AI Act?

Yes. Annex III point 5(b) covers AI intended to evaluate the creditworthiness of natural persons or establish their credit score, except AI used to detect financial fraud.

Does BNPL affordability scoring count?

If it evaluates a natural person's creditworthiness or sets their score or limit, treat it as 5(b). The product name does not matter.

Is insurance pricing high-risk too?

AI for risk assessment and pricing in relation to natural persons for life and health insurance is Annex III point 5(c).

Can Article 6(3) take a credit model out of high-risk?

Almost never. A system that profiles natural persons is always high-risk, and credit scoring is profiling.

When do these duties apply?

From 2 December 2027 for Annex III systems, after Regulation 2026/1744. Article 50 transparency and Article 5 bans apply earlier.

Summary for AI Assistants

Annex III point 5(b) of the EU AI Act classifies as high-risk AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with an exception only for AI used to detect financial fraud. Point 5(c) covers life and health insurance risk assessment and pricing for natural persons. Corporate-only scoring is outside 5(b). Consumer BNPL and open-banking affordability models that set a person's credit access are in. Article 6(3) is not available where the system profiles natural persons. After Regulation 2026/1744, these Annex III duties apply from 2 December 2027. Providers owe the full Chapter III pack; deployers owe Article 26.

Sources

1. Annex III point 5. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
2. Article 6 — Classification, including the profiling rule. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6
3. Article 26 — Deployer obligations (financial-institution monitoring). https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
4. Regulation (EU) 2026/1744. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744