Is our credit union's loan scoring high-risk AI, and what is due by December 2027?
If your lending platform uses AI to assess a member's creditworthiness, Annex III point 5(b) of the AI Act lists that use as high-risk. From 2 December 2027 the people who oversee such a system must have the competence, training and authority to do it, although a system already in service before that date is only caught once its design changes significantly. The first job is finding out whether the scoring feature you run is AI at all.
A loan application, step by step
Take a member applying for a €15,000 car loan. Here is where the AI Act touches that application.
The application comes in. The member applies online or at the counter. If a chatbot on your website answers their questions first, Article 50 requires that they are told they are dealing with AI, unless that is obvious. That duty has applied since 2 August 2026.
The platform produces a score. The lending system returns an affordability figure or a credit score. Annex III point 5(b) covers AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score. Whether your system is one depends on how the score is produced. Recital 12 of the AI Act says the definition of an AI system does not cover systems based on rules defined solely by people. A scorecard that adds up points your credit union set by hand may sit outside the definition. A model trained on past lending data is inside it. Your software provider knows which you have, and you should get the answer in writing.
A fraud check runs. Point 5(b) excepts AI systems used to detect financial fraud. A transaction monitoring flag is not high-risk under that heading. The people who review the flags are still using an AI system, so Article 4 covers them.
The loan officer decides. This is where December 2027 lands. Article 26 requires a deployer of a high-risk system to assign human oversight to people who have the necessary competence, training and authority. In practice the loan officer needs to know what the score is built from, when it tends to be wrong, and that they can depart from it. A loan officer who approves whatever the system recommends is not overseeing it.
The credit committee reviews. Committee members who see the score are relying on it too. If they are volunteers, they are still acting on the credit union's behalf, and they need the same understanding as the loan officer.
The member asks why. A member who is refused will ask for the reason. "The system said no" is a poor answer under data protection law and a poor one at the counter. Someone on your team has to be able to explain the decision in plain words.
What changed with the Digital Omnibus
The high-risk obligations in Annex III were due to apply from 2 August 2026. Regulation (EU) 2026/1744 moved most of them to 2 December 2027. The Central Bank's Regulatory and Supervisory Outlook 2026 names creditworthiness evaluation and credit scoring among the main high-risk uses in financial services.
Article 4 did not move. It has applied since 2 February 2025, so the people using a scoring feature today are already inside the duty to take measures that support their AI literacy.
Does it apply to a system we already run?
Only once it changes. Article 111(2) says the Act applies to operators of high-risk systems that were placed on the market or put into service before the application date only if, from that date, those systems are subject to significant changes in their design. A deployer is an operator. So a scoring feature your credit union was already running before 2 December 2027 sits outside the high-risk obligations until its design is significantly changed.
Lending software is updated often, and the provider is the one who knows when an update counts as a significant change. Ask them to tell you. The grace period does not touch Article 4, and it does nothing for a member who wants a refusal explained.
What to do between now and December 2027
- Ask your lending software provider, in writing, whether the scoring feature is an AI system, whether they treat it as high-risk under Annex III, and how they will tell you about a significant change to its design.
- Record the answer in your AI tool inventory.
- Name the roles that rely on the score: loan officers, the credit committee, the credit control function.
- Give those roles a session on how the score is produced, where it fails and when to override it. Record who attended.
- Put a date in the diary for mid-2027 to check what your provider has changed and what guidance has been published.
A credit union that does those five things has also taken its Article 4 measure for the lending team. Our credit union page covers how the full day handles lending roles.
What we do not know yet
The Commission is expected to publish guidance on high-risk classification, and providers will issue instructions for use closer to the date. Deployer duties under Article 26 go beyond oversight training, and this post does not cover them all. Treat it as a starting point and take advice on your own systems.
Sources
Checked on 1 October 2026.
- Regulation (EU) 2024/1689, the AI Act, Recital 12, Articles 4, 26, 50 and 111(2), and Annex III point 5(b).
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, for the 2 December 2027 date in Article 113 and the amended Article 111(2).
- Central Bank of Ireland, Regulatory and Supervisory Outlook 2026, Spotlight 1.
This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.
