EU AI Act for Financial Services: Credit Scoring & Insurance AI

Which Financial AI Is High-Risk

Annex III point 5 lists two financial-services use cases explicitly:

• Point 5(b) — creditworthiness and credit scoring. AI used to evaluate the creditworthiness of natural persons or establish their credit score is high-risk, with a carve-out for AI used to detect financial fraud.
• Point 5(c) — insurance. AI used for risk assessment and pricing in relation to natural persons for life and health insurance is high-risk.
• Scope note. The high-risk label attaches to decisions about natural persons. Pure back-office fraud detection and prudential-model use that does not decide individual access to credit or insurance sit outside these two points.

Classify each model against Annex III point 5 individually — a single lending platform may run both in-scope scoring models and out-of-scope fraud models.

Interplay with Existing Financial Regulation

Financial firms are already heavily regulated; the AI Act sits alongside, not instead of, that stack.

The Act coordinates with sectoral law: for credit institutions, the internal-governance and risk-management duties under the CRD (and the Basel framework it implements) can host the AI Act's Article 9 risk-management obligations, and the EU AI Act allows those to be built into existing internal processes rather than duplicated. Where firms provide investment services, MiFID II suitability and record-keeping duties overlap with AI Act logging and oversight. The European Banking Authority and other supervisors continue to issue guidance on model governance and the use of AI, which complements — but does not discharge — AI Act conformity.

Map each AI Act obligation to the sectoral control that already covers it so you extend one governance framework instead of running two.

Explainability and Adverse-Action Rationale

A rejected applicant will ask why — and the Act gives them a route to an answer:

• Article 86 — right to explanation. A person subject to a high-risk decision that produces legal or similarly significant effects (such as a declined loan) has the right to a clear, meaningful explanation of the role the AI played in that decision.
• Article 13 — transparency to deployers. The lender or insurer deploying the model must receive enough information to interpret its output and use it correctly.
• Article 14 — human oversight. A person must be able to review and override an automated credit or underwriting decision, not merely rubber-stamp it.
• Article 12 — logging. The inputs and reasoning behind each decision must be recorded so an adverse-action rationale can be reconstructed for the customer and the auditor.