The EU AI Act for banks: credit scoring, deadlines and what applies now
The EU AI Act treats AI used to assess the creditworthiness of individuals, and certain life and health insurance pricing, as high-risk. Under the Digital Omnibus provisional agreement of May 2026, obligations for these stand-alone high-risk systems move from 2 August 2026 to 2 December 2027. Prohibited practices and AI literacy duties have applied since February 2025 and transparency duties are largely unaffected.
Check the final text in the Official Journal: the Omnibus dates were agreed politically and institutions should confirm the adopted dates before relying on them.
What should a bank operating in the EU do before December 2027?
- Identify AI systems used for creditworthiness or insurance pricing and classify them.
- Prepare the risk management system, data governance, technical documentation, logging and human oversight that high-risk classification requires.
- Confirm whether the bank is provider or deployer for each system: obligations differ.
- Use the extra time to align EU AI Act work with SR 26-2-style model risk and FSB practices, not as a separate project.
Primary sources (reviewed 17 Oct 2026)
- Regulation (EU) 2024/1689, the EU Artificial Intelligence Act
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
Is credit scoring high-risk under the EU AI Act?
Yes. AI systems used to evaluate the creditworthiness of natural persons or establish their credit score are listed as high-risk, with an exception for systems used to detect financial fraud.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.