Credit, lending, insurance and access-to-service AI can move directly into Annex III high-risk territory. The business question is not simply whether AI is used—it is what decision the system influences, how consequential that decision is, and what evidence supports the current classification and control environment.
The Regulation identifies certain AI systems used for creditworthiness evaluation, credit scoring, and life or health insurance risk assessment and pricing as high-risk. It also distinguishes some financial-services uses, including fraud-detection and prudential-capital purposes, from those high-risk categories.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Annex III identifies AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, subject to the Regulation’s exact exclusions and conditions.
AI that materially influences access to services such as housing, electricity, telecommunications or other essential private services can sit in a sensitive governance pathway because the outcome can significantly affect a person’s livelihood.
Annex III also identifies certain AI systems used for risk assessment and pricing in relation to natural persons for life and health insurance as high-risk.
Preserve system version, intended purpose, data sources, model inputs, decision role, human oversight, testing, bias and performance evidence, adverse-outcome handling, material changes and the records supporting the current classification.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Credit scoring, fraud detection, prudential capital calculations, underwriting, pricing, eligibility, customer service and portfolio analytics do not all sit on the same AI Act route. Classify the exact intended purpose.
Map the system against Article 6 and Annex III, while preserving any applicable exclusion, unresolved fact or regulatory boundary rather than treating all financial AI as automatically high-risk.
Connect risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, cybersecurity and review evidence to the decisions the AI can influence.
A model update, new dataset, changed cut-off, revised underwriting logic, new product, new customer segment or altered human-approval threshold can materially change the evidentiary basis for continued reliance.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
Yes, certain AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are listed in Annex III as high-risk.
No. Classification depends on intended purpose. The Regulation specifically distinguishes certain high-risk financial use cases and also notes exclusions, including AI systems provided for by Union law for detecting fraud in the offering of financial services and prudential purposes to calculate capital requirements.
Certain AI systems intended for risk assessment and pricing in relation to natural persons for life and health insurance are listed as high-risk in Annex III.
Certain deployers of high-risk AI systems, including specified banking and insurance entities for relevant Annex III systems, are subject to Article 27 fundamental-rights impact-assessment requirements before putting the high-risk system into use.
Organizations should preserve system identity and version, intended purpose, classification basis, data and model information, testing, human oversight, decision policies, logging, adverse-outcome processes, changes, limitations and the evidence supporting each material governance proposition.
No. TA-14 can preserve the classification basis, evidence, gaps, review history and revalidation state. It does not itself provide legal advice, conformity assessment, certification or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views