EU AI Act Rules for Credit Scoring and Insurance Pricing

Annex III includes AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, except systems used to detect financial fraud. This is about assessment of a person’s ability to obtain credit, not every automated task in banking. A model that estimates default risk for a natural-person borrower may be in scope; a tool that detects suspicious card transactions has an express carve-out from this listed use. The exact purpose, affected person, and system boundary should be recorded. Insurance requires a careful distinction. Annex III specifically lists risk assessment and pricing for natural persons in life and health insurance. It does not say that every insurance model, every line of insurance, or every pricing operation is automatically high-risk under this item. Other Annex III categories, product-safety rules, or other laws may still be relevant depending on the case. Avoid expanding a category beyond its text or assuming that a use outside this entry is unregulated. For covered high-risk systems, providers have obligations concerning risk management, data governance, technical documentation, logging, information for deployers, human oversight, accuracy, robustness, and cybersecurity. Deployers must use systems as instructed, monitor them, assign oversight, and ensure input data under their control is relevant and sufficiently representative for the intended purpose. These AI Act duties coexist with financial-services, consumer-protection, equality, and data-protection requirements. A high-risk label is not a lawful basis to process data or a defense for an unfair lending decision. The AI Omnibus entered into force on 27 July 2026 and moved Annex III application to 2 December 2027. Teams should inventory systems and decisions now, preserve documentation, and identify which legal regime addresses each risk. A human review that cannot change an outcome is a weak safeguard. Applicants should be able to receive required explanations or challenge decisions under the applicable law, though the precise rights depend on the decision and jurisdiction.