The EU AI Act for banks: credit scoring, the new dates and the bank's duties

The European Union's Artificial Intelligence Act, Regulation (EU) 2024/1689, sorts AI systems by risk. For a bank, the central entry is Annex III point 5(b), which lists as high-risk "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud" [1]. A natural person is a human being, as opposed to a company. Point 5(c) adds AI used "for risk assessment and pricing in relation to natural persons in the case of life and health insurance" [1], which applies to a bank group that sells insurance.

This page covers what the Act asks of a bank, as of 26 October 2026. It is part of the guide on AI in banking. For the Act as it applies to any software product, see the EU AI Act and your product. The AI Act is law in every EU Member State, so the duties below are legal duties. A bank should confirm with its own counsel and its supervisor how they apply to each system it runs.

The dates, after the 2026 amendment

Regulation (EU) 2026/1744 amended the AI Act. It was published in the Official Journal of the European Union, where EU laws are published, on 24 July 2026, and it says it "shall enter into force on the third day following that of its publication" [2], which was 27 July 2026. The EU's own metadata listed it as the only act amending the AI Act when this guide checked on 26 October 2026.

What applies	Date	Source
Chapters I and II, including Article 4 on AI literacy	2 February 2025	[2]
The Act's general date of application, which covers Article 50 on AI that talks to people	2 August 2026	[1]
High-risk duties (Chapter III, Sections 1 to 3) for Annex III systems, including credit scoring	2 December 2027, moved from 2 August 2026	[2]
High-risk duties for Annex I systems (AI in products covered by EU product safety law)	2 August 2028	[2]
Regulation (EU) 2026/1744 in force	27 July 2026	[2]

The amending regulation gives its reason as "the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities" [2]. The technical standards that show how to comply were late, and so were the national authorities that enforce the Act.

The amendment also limits the reach to older systems. A high-risk system placed on the market or put into service before the application date is covered "only if, as from that date, those systems are subject to significant changes in their designs" [2]. A bank with a credit scoring model in use before 2 December 2027 should record its design as of that date, so it can show later whether a change counts.

AI literacy: the duty was rewritten

The original Article 4 said providers and deployers "shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff" [1]. Regulation (EU) 2026/1744 replaced that text. Providers and deployers now "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf" [2]. The new text adds: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual" [2]. The Act defines AI literacy as the skills, knowledge and understanding that let people make an informed use of AI systems and know their opportunities and risks [1].

Article 4 has applied since 2 February 2025, and its new wording since the amending regulation entered into force on 27 July 2026 [2]. It covers providers and deployers of every AI system, high-risk or not. A bank should keep a record of the training and guidance it gives to the staff who use AI, because that record is how it shows the measures exist.

The bank as deployer of a credit scoring system

The Act puts duties on providers, the companies that build an AI system and supply it, and on deployers, the organisations that use one. A bank that buys a credit scoring system from a vendor is a deployer. From 2 December 2027, Article 26 and Article 27 set its main duties.

Duty	What the Act says	Article
Follow the instructions	Deployers must use high-risk systems "in accordance with the instructions for use" [1]	26(1)
Human oversight	Deployers "shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support" [1]	26(2)
Monitoring	For financial institutions, the duty is "deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the relevant financial service law" [1]	26(5)
Logs	Keep system logs "of at least six months, unless provided otherwise in applicable Union or national law" [1]	26(6)
Data protection impact assessment	Use the provider's information to carry out the assessment the General Data Protection Regulation requires [1]	26(9)
Tell the people affected	Deployers "shall inform the natural persons that they are subject to the use of the high-risk AI system" [1]	26(11)
Fundamental rights impact assessment	Required before use for credit scoring and for life and health insurance pricing [1]	27(1)

Two of these duties reuse work a bank already does. The monitoring duty is met through the governance rules a bank already follows under financial services law [1]. And since the 2026 amendment, where the data protection impact assessment already meets one of the duties, the fundamental rights impact assessment may "include cross-references to the relevant sections of that data protection impact assessment" [2], so the bank can avoid writing the same analysis twice. A fundamental rights impact assessment is a written review of how a system could affect people's rights, such as the right not to be discriminated against. A data protection impact assessment is the review the General Data Protection Regulation (GDPR) requires before processing that is "likely to result in a high risk to the rights and freedoms of natural persons" [3]. The amending regulation says the EU's AI Office shall develop a questionnaire template for the fundamental rights assessment [2].

Human oversight needs named people with training and authority. Reveneau's view is that a bank should write down, for each high-risk system, who can stop or override it and what evidence that person reviews. The guide page when a human must stay in the loop covers how to design that review.

When the bank builds the system itself

A bank that builds its own credit scoring model and puts it into service takes on provider duties. The 2026 amendment added two provisions for such a bank.

The new Article 4a says that providers of high-risk systems "may exceptionally process special categories of personal data" when this is strictly necessary to detect and correct bias, under conditions that include that other data, including synthetic or anonymised data, cannot do the job effectively [2]. Special categories of personal data are the sensitive types the GDPR protects most, such as data on racial or ethnic origin or health. Synthetic data is data generated to resemble real data without describing real people, and anonymised data can no longer be linked to a person.

The amended Article 25(4) says that a provider and a third party that supplies components for a high-risk system "shall, by written agreement, specify the necessary information, capabilities, technical access and other assistance" the provider needs [2]. A bank that builds a credit model on a vendor's tools needs that agreement in its contracts. The AI vendor question list for banks includes it.

Who supervises a bank's AI

For high-risk AI systems placed on the market, put into service or used by financial institutions regulated by EU financial services law, "the market surveillance authority for the purposes of this Regulation shall be the relevant national authority responsible for the financial supervision of those institutions" [1], as far as the system is directly connected with the financial services the institution provides. That is Article 74(6). Article 74(7) lets a Member State name another authority [1]. Unless the Member State names another authority, the supervisor that already examines the bank also checks its use of high-risk AI. A market surveillance authority is the body that checks whether products and systems on the market follow the law.

The Bank for International Settlements' Financial Stability Institute found in December 2024 that "Most financial authorities have not issued AI regulations specific to financial institutions as existing frameworks already address most of these risks" [4]. The AI Act gives the bank's existing supervisor this role, and lets the bank's existing governance rules meet the monitoring duty.

Explanations and transparency for customers

Article 86 gives a person affected by a decision based on an Annex III high-risk system "the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken" [1]. It applies only where no other EU law already gives that right [1]. Article 86 sits outside the high-risk chapter, whose duties start on 2 December 2027, while the Act's general date is 2 August 2026. The text does not settle which date applies to Article 86, so this guide gives none. A bank should ask its counsel.

The GDPR already gives a related right. Article 22 gives a person the right not to be subject to a decision based solely on automated processing that produces legal effects or affects them in a similar way, with exceptions [3]. The page AI in credit decisions and fair lending explains how the EU's highest court applied that right to credit scores in 2023.

For chatbots, Article 50(1) says providers must design AI systems that interact with people so "that the natural persons concerned are informed that they are interacting with an AI system" [1]. That article falls under the general date of 2 August 2026. The page AI in customer service for banks covers it.

Fines

Breaches of the duties of providers, deployers and other operators can bring "administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher" [1]. That is Article 99(4). Regulation (EU) 2026/1744 adds that for small mid-cap enterprises, firms that have grown past the EU's definition of small and medium-sized enterprises, the lower of the two amounts applies [2]. An undertaking is a business.

What to do before 2 December 2027

The months before the deadline are the time to build the evidence. A list for a bank that uses or builds credit scoring AI in the EU:

1. List every system that evaluates creditworthiness or sets a credit score, and every life or health insurance pricing system in the group.
2. Record whether the bank is the provider or the deployer of each one.
3. For bought systems, get the provider's instructions for use and the information the bank needs for its impact assessments.
4. Name the people who oversee each system, with their training and their authority to stop it.
5. Write the fundamental rights impact assessment, cross-referring to the data protection impact assessment.
6. Set log retention to at least six months, or longer where financial law requires.
7. Prepare the notice that tells applicants a high-risk AI system is used.
8. Record each system's design, so a later change can be judged against it.

Reveneau's view is that the bank should start from the evidence the Act asks for, and test the system in the form that evidence will be read. For a credit model, that means repeatable tests of its outputs on cases the bank chooses, including cases built to detect bias, run before each release and kept with their dates. The guide on why AI evals matter explains these tests for a buyer.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, which Reveneau says runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. To discuss a project, see Reveneau's services or contact Reveneau. For the US rules on the same systems, read model risk rules and AI.