Annex III • essential private services
Annex III high-risk AI: credit scoring and financial services
AI intended to evaluate the creditworthiness of natural persons or establish their credit score is specifically listed in Annex III, subject to Article 6. Life and health insurance risk assessment/pricing is also listed. The main Annex III high-risk requirements apply from 2 December 2027.
Updated: 26 September 2026 · Reviewed by Constantin Razvan Gospodin.
Direct answer
Is credit scoring high-risk under the EU AI Act?
Yes, where the AI system is intended to evaluate the creditworthiness of a natural person or establish that person's credit score, subject to Article 6 and the Act's qualifications. Annex III expressly excludes AI systems used for detecting financial fraud from that specific creditworthiness category.
Listed use cases
Two financial-services categories are explicitly listed in Annex III point 5.
Creditworthiness / credit scoring
AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are listed as high-risk, except AI systems used for detecting financial fraud.
Life and health insurance
AI systems intended for risk assessment and pricing in relation to natural persons in life and health insurance are listed in Annex III.
Do not over-classify
Not every AI system used by a bank or insurer is high-risk.
Fraud detection
Annex III expressly excludes AI used for detecting financial fraud from the creditworthiness/credit-score category.
Corporate credit
Assessing the creditworthiness of legal entities using company financial data is not the same as evaluating the creditworthiness of a natural person.
Claims management
Insurance claims-management systems are not automatically within Annex III point 5(c) merely because they affect an insurance process; intended purpose matters.
Marketing/segmentation
Customer segmentation or personalised marketing is not automatically creditworthiness assessment where it does not participate in the formal credit decision.
Classification workflow
Financial firms should classify use cases, not departments.
- Define the AI system and intended purpose.
- Determine whether natural persons are being evaluated.
- Map the system to the exact Annex III use case.
- Assess Article 6 filters/qualifications and profiling rules.
- Document the classification rationale and evidence.
- Map the amended application date and readiness work.
AI Act + GDPR
Credit scoring can also require a separate GDPR Article 22 analysis.
The AI Act asks whether the system falls within the Annex III high-risk framework. GDPR Article 22 asks a different question about solely automated decisions with legal or similarly significant effects. The same credit-scoring workflow can require both analyses.
Current timeline
Annex III high-risk requirements apply from 2 December 2027.
The imported source previously referenced 2 August 2026. Regulation (EU) 2026/1744 changed the application date for Article 6(2)/Annex III systems to 2 December 2027. Firms should use the transition to build classification, governance and evidence — not to defer analysis.
Frequently asked
Annex III credit-scoring questions
Is AI credit scoring high-risk under the EU AI Act?
AI intended to evaluate the creditworthiness of natural persons or establish their credit score is listed in Annex III as high-risk, subject to Article 6 and the Act's qualifications. AI used for detecting financial fraud is excluded from that specific category.
When do Annex III high-risk requirements apply?
The main Chapter III requirements for Article 6(2)/Annex III high-risk systems apply from 2 December 2027 under Regulation (EU) 2026/1744.
Sources