AI Act: high-risk rules for credit scoring postponed to December 2027

The AI Act, Regulation (EU) 2024/1689 (external site), sets EU rules for artificial intelligence (AI) systems according to the risk they pose. Systems used for the sensitive purposes listed in its Annex III are high-risk AI systems and carry the strictest requirements.

In finance, Annex III covers AI used to evaluate the creditworthiness of individuals or set their credit score, except for fraud detection. It also covers AI used for risk assessment and pricing in life and health insurance (EUR-Lex (external site)).

The high-risk rules for Annex III systems were due to apply from 2 August 2026. Regulation (EU) 2026/1744 (external site), known as the Digital Omnibus on AI, replaces that date with 2 December 2027. High-risk AI that is part of products covered by the EU product laws listed in the Act's first annex follows from 2 August 2028.

The requirements include a risk management system, data governance for training, validation and testing data, and an appropriate level of accuracy, robustness and cybersecurity throughout the lifecycle (EUR-Lex (external site)).

Deployers of credit scoring and of life and health insurance pricing systems also carry out a fundamental rights impact assessment before first use (EUR-Lex (external site)).

As an example, a machine learning credit score first put into service from 2 December 2027 must comply with these requirements; one already in service before that date is caught only if its design changes significantly (EUR-Lex (external site)).

Banks, insurers and payment institutions are concerned when they build or use AI systems for credit or insurance decisions about individuals (EUR-Lex (external site)). The roles most directly concerned:

• Credit Risk Model Developer: documents AI credit scores against the risk management and data requirements.
• Model Validation Analyst: tests the accuracy of high-risk AI models and its stability over their lifecycle.
• Data Scientist (Banking): prepares training, validation and testing data sets under data governance rules.
• Data Governance Analyst: records the lineage and quality of the data that feeds high-risk systems.
• Loan Officer (Retail & SME Lending): uses AI-supported credit assessments that fall under the high-risk rules from 2 December 2027.
• Life & Pensions Actuarial Analyst: checks AI used in life and health pricing against the same requirements.
• AI Business Analyst: classifies AI use cases against the Annex III list.

The Commission proposed the change in 2025 (EUR-Lex (external site)). Council and Parliament reached a provisional agreement on 7 May 2026 (Council (external site)), and the Council gave its final approval on 29 June 2026 (Council (external site)).

The regulation is dated 8 July 2026 and was published in the Official Journal on 24 July 2026 (EUR-Lex (external site)).

Both application dates are fixed in the text and confirmed: 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products (EUR-Lex (external site)). The 2025 proposal had tied the start to a Commission decision followed by six or twelve months; the adopted text uses fixed dates instead (EUR-Lex (external site)).

The AI Act was adopted in 2024 with staged application: prohibited practices first, then general-purpose AI models, then high-risk systems (EUR-Lex (external site)).

The recitals of the amending regulation link the new date to the availability of harmonised standards, the European technical standards used to show compliance, and of national authorities, and to the costs of applying the rules earlier (EUR-Lex (external site)).