Banking & AI Act: governing scoring and assisted decision-making

What does the AI Act cover?

The AI Act classifies, in its Annex III, the assessment of creditworthiness and the credit scoring of natural persons as high-risk — except where used to detect financial fraud. High-risk systems are subject to obligations concerning risk management, data quality, transparency, human oversight, and robustness.

Internal or conversational uses generally fall under limited or minimal risk.

Is the 'Banking' sector in scope?

Banks are in scope as deployers and, where they develop their own models under their brand, as providers. Consumer credit scoring is the emblematic high-risk use case.

Fraud detection, although AI-based, falls outside the high-risk classification intended for credit scoring; it nonetheless remains subject to GDPR.

Detailed obligations

Sanctions & risks

Up to €35M or 7% of turnover for prohibited practices and €15M or 3% for high-risk non-compliance. GDPR risk on profiling is an additional exposure.

For a bank, a poorly documented or biased scoring system exposes the organisation to sanctions and a significant discrimination risk with serious consequences.

Application timeline

• 1Entry into force. 1 August 2024.
• 2High risk. Main obligations from 2 August 2026 for credit scoring.

Common mistakes in the sector

• 1High risk not identified. Treat credit scoring as ordinary use.
• 2Uncontrolled biases. Ignoring data biases, a source of discrimination and non-compliance.
• 3Cumulative GDPR forgotten. Failing to articulate the AI Act and GDPR on profiling.
• 4Superficial oversight. Displaying human oversight without real means of influencing the decision.

Practical case

A bank deploys a scoring model for consumer credit decisions. Classified as high-risk, it requires technical documentation, bias monitoring, and human oversight of rejections. The bank aligns these requirements with GDPR information obligations on profiling and the customer's right to human intervention, addressing both texts in a single coordinated approach.

Compliance roadmap

1. 1

   Inventory. Map all AI uses (credit, fraud, customer relations, internal).

2. 2

   Qualify. Isolate high-risk systems (credit scoring).

3. 3

   Ensure data reliability. Addressing the quality and biases of training data.

4. 4

   Document. Producing technical documentation and conformity assessment.

5. 5

   Frame. Implement human oversight and information notices, articulated with GDPR.

Frequently asked questions