Creditworthiness and credit-scoring AI can directly affect access to lending, mortgages and other essential private services. Annex III treats these uses as high-risk, while expressly separating fraud-detection systems from this specific category. The governance challenge is proving the classification, the evidence behind the decision, the human role, and the basis for continued reliance after change.
Annex III classifies AI used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, while excluding systems used for financial-fraud detection from that specific category. Article 6(3) provides a limited derogation, but profiling remains high-risk and the provider must document any reliance on the derogation.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Annex III classifies AI intended to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, including consumer lending and mortgage use cases.
Annex III expressly excludes AI systems used for the purpose of detecting financial fraud from this specific creditworthiness high-risk category. The exact intended purpose still matters, and other AI Act or sector rules may apply.
An Annex III system may avoid high-risk status only in limited circumstances where it does not pose a significant risk or materially influence the decision. Profiling of natural persons remains high-risk, and any exclusion analysis must be documented.
Preserve the system and model version, credit-use case, input data, score or recommendation, human review, overrides, notices, adverse-outcome reasoning, logs, complaints, policy changes, and the evidence supporting continued reliance.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Separate affordability assessment, creditworthiness evaluation, credit scoring, pricing support, fraud detection, collections, marketing and purely administrative processing. These functions do not all sit on the same AI Act route.
Test Annex III point 5(b), Article 6(3), profiling, operator roles, and any other applicable product or sector obligations. Preserve the classification analysis before deployment or market placement.
Connect data inputs, model output, decision rules, human reviewer, override, explanations or notices, logs, performance and bias evidence, complaint or challenge pathways, and the resulting lending outcome.
A new scorecard, changed lending policy, new data source, model update, broader product scope, removed human checkpoint or changed intended purpose can make the prior classification and evidence stale.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
Yes, when the system is intended to evaluate the creditworthiness of natural persons or establish their credit score, subject to the Regulation’s classification rules and limited Article 6(3) derogation.
No. Annex III expressly excludes AI systems used for the purpose of detecting financial fraud from point 5(b). That does not mean every fraud-detection system is unregulated; it means this specific creditworthiness category does not apply on that basis alone.
Potentially, but only if it does not pose a significant risk or materially influence the outcome and fits one of the listed conditions. Systems that perform profiling of natural persons remain high-risk, and providers relying on the derogation must document their assessment.
Current European Commission guidance states that high-risk rules for Annex III systems apply from 2 December 2027.
Preserve system identity and version, intended purpose, provider and deployer roles, classification basis, data provenance, score or recommendation, human review, overrides, notices, logs, performance and bias evidence, complaints, material changes and revalidation history.
No. TA-14 can preserve the classification basis, evidence, human-oversight state, gaps, decision history and revalidation record. It does not provide legal advice, certification, conformity assessment or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views