What rules apply to AI credit scoring?

AI used to evaluate people's creditworthiness or set their credit score is high-risk under the EU AI Act (Annex III, point 5(b)), except where it is used only to detect financial fraud. Deployers must also carry out a fundamental rights impact assessment. GDPR rules on automated decisions apply, as do consumer credit law and, in the UK, the FCA's Consumer Duty and its expectations on model risk.

How it works

1. Treat the model as high-risk: oversight, logging, documentation, testing for bias.
2. Carry out and record a fundamental rights impact assessment before use.
3. Give customers a route to human review and an explanation.
4. Seal every decision, so each one can be shown to a regulator or ombudsman.