The EU AI Act for financial services: classifying credit scoring and pricing properly
Updated: 2026-10
AI for assessing the creditworthiness of natural persons and for risk assessment in life and health insurance is high-risk under Annex III of the AI Act; fraud detection is explicitly excluded. Financial services firms must therefore delimit their systems cleanly, document them and demonstrate the classification to supervisors and auditors.
Financial institutions use AI widely, but only part of it is high-risk. Credit decisions and insurance pricing are; fraud detection, customer service chatbots and document extraction usually are not. The line is not always obvious in practice, for example when a model assesses both fraud risk and ability to pay.
At the same time, supervisors and internal audit expect a traceable classification of every system. In Switzerland, FINMA has set out its expectations for inventory and risk classification in AI use; in the EU, financial supervisors become market surveillance authorities under the AI Act.
How it works
- 01
Record AI systems
Bring all applications in lending, pricing, fraud detection, customer service and back office together in one workspace.
- 02
Classify under Article 6
Check per system whether Annex III applies — creditworthiness of natural persons, life and health insurance — or an exception such as fraud detection.
- 03
Assign owners
Risk, compliance, business and IT work in the same workspace; tasks such as preparing the fundamental rights impact assessment are assigned and tracked.
- 04
Provide evidence
Export the classification as an audit-ready report for internal audit and supervisors and share status via a verifiable URL where needed.
Why it fits here
AI Risk Check classifies each system under Article 6 with legal citations — the basis for cleanly separating creditworthiness and pricing applications from excluded cases such as fraud detection.
White-label PDF reports serve as documentation for audit and supervisors, and team workspaces bring risk, compliance and IT together on one piece of evidence. The deeper analysis is in our article on the AI Act in financial services.
FAQ
Is AI-based fraud detection high-risk?
No. The AI Act explicitly excludes systems for detecting financial fraud from the high-risk category for creditworthiness. The delimitation should still be documented.
When do the high-risk obligations apply?
For Annex III systems from 2 December 2027. Preparation, especially documentation and the fundamental rights impact assessment, needs lead time.
Does this replace review by compliance or legal?
No. Classification structures the assessment and makes it traceable; the final judgement remains with the responsible functions.
AI Risk Check
AI Risk Check classifies each system under Article 6 with legal citations — the basis for cleanly separating creditworthiness and pricing applications from excluded cases such as fraud detection.
White-label PDF reports serve as documentation for audit and supervisors, and team workspaces bring risk, compliance and IT together on one piece of evidence. The deeper analysis is in our article on the AI Act in financial services.