AI that scores credit, prices insurance, or detects fraud is treated as high-risk. Providers need risk-management systems, data-governance controls, and audit logs. If an AI system decides who gets a loan, a human must be able to review and override the decision.
The EU AI Act reaches any company whose AI output is used in the European Union — regardless of where the company is based. If your product has EU users or clients, the rules apply to you. The first question is always the same: which risk tier does your system fall into, and what duties come with that tier?
The Act sorts AI into four tiers: prohibited (banned outright), high-risk (heavy duties), limited-risk (transparency only), and minimal-risk (no mandatory duties). Most software starts in limited or minimal risk. The expensive surprises live in high-risk and prohibited — which is exactly why scanning early matters.
Annex III point 5(b) covers AI used to evaluate the creditworthiness of natural persons or establish their credit score. That means your lending-decision model is high-risk by default. Lenders must be able to explain decisions to customers, retain logs of every scoring decision, monitor drift, and give a human authority to review and overturn machine decisions before they are final — duties that map to Articles 9–15 of the Act.
Detecting payment fraud or AML anomalies is generally not high-risk on its own unless the tool also blocks a person's access to essential services. Where an automated fraud decision stops a transaction, denies a payment account, or blacklists a customer, consumer-protection duties from both the AI Act and PSD2/RBA apply. The safest position is to treat scoring-style outputs as high-risk and document them accordingly.
Buying a credit-risk or KYC model from a vendor does not remove your obligations. As deployer you must ensure human oversight, maintain records, and confirm the model is suitable for your population. You cannot outsource deployer duties to your provider — regulators hold banks and fintechs accountable for the models they run, whoever wrote them.
See your score in 2 minutes. No signup, no code stored.
Scan Your Codebase NowNo — it is high-risk, not prohibited. You can run it, but you must comply with the full high-risk regime and offer human review of decisions.
Yes. Scanning your codebase and config surfaces both your own code and the integration points that consume vendor models, so you can document deployer-side controls.
AI that prices insurance or sets premiums is high-risk under Annex III. The same technical documentation, logging and human-oversight duties apply as to credit scoring.