Free Website Audit: Discover what's holding your digital presence back
Short answer
Under the EU AI Act, AI used to assess the creditworthiness of natural persons or set their credit score is high-risk, except AI used to detect financial fraud. After the AI Omnibus, the high-risk rules in Annex III apply from 2 December 2027. Lenders outside the EU are covered when the model output is used in the EU.
Many guides still give 2 August 2026 as the start of the credit-scoring rules. The AI Omnibus moved that date. Here is what the law says, how to check your role, and what a risk team can do in 90 days.
This article is not legal advice. Check your case with your legal team.
Is credit scoring high-risk under the EU AI Act?
Yes, when the AI scores people. Annex III, point 5(b), lists AI systems “intended to be used to evaluate the creditworthiness of natural persons or establish their credit score”, “with the exception of AI systems used for the purpose of detecting financial fraud” (AI Act Service Desk, Annex III). The European Commission uses “credit scoring denying citizens opportunity to obtain a loan” as its own example of high-risk AI (European Commission, AI Act policy page).
The rule is about natural persons, so read it closely if a model scores only companies. Point 5(c) adds AI for “risk assessment and pricing in relation to natural persons in the case of life and health insurance”.
Our finance industry work covers the data, integration and audit trail around these models.
When do the high-risk rules apply after the AI Omnibus?
The Annex III high-risk rules, which include credit scoring, apply from 2 December 2027. The AI Omnibus entered into force on 27 July 2026. High-risk AI built into products under Annex I has until 2 August 2028 (European Commission).
The later date removes no duty. Use the time to fix data, documents and oversight.
Are we a provider or a deployer of the model?
It depends on who builds the model and who uses it. Article 3 defines a provider as the body that “develops an AI system” or has one developed and places it on the market or puts it into service “under its own name or trademark”. A deployer is a body “using an AI system under its authority” (AI Act Service Desk, Article 3).
A deployer can become a provider, for example when it puts its name on a high-risk system or makes a “substantial modification” to it (Article 25).
Provider-or-deployer check
Answer these for every credit model. Take the answers to your legal team.
| Question | If yes, read |
|---|---|
| Did your team build or train the model? | Article 3(3), provider |
| Did a vendor build it, and you use it under the vendor’s name? | Article 3(4), deployer |
| Did you put your own name on a vendor model? | Article 25(1)(a) |
| Did you change a vendor model in a large way, or retrain it for a new purpose? | Article 25(1)(b) and (c) |
| Do you sell a scoring model to other lenders? | Article 3(3), provider |
Article 26 asks deployers to assign human oversight to people “who have the necessary competence, training and authority”. It also asks them to keep the logs the system generates for “at least six months”, unless other law says otherwise (Article 26).
What does a fundamental rights impact assessment ask of a lender?
A deployer of a point 5(b) system must do this assessment before it deploys the system (Article 27). The assessment must describe:
- The processes where you use the system.
- How long and how often you use it.
- The people and groups that it is likely to affect.
- The risks of harm to those groups.
- How people oversee the system.
- What you do when a risk occurs, including governance and complaints.
Most of this already sits in your credit policy, model documents and complaints process. Collect it in one document per model.
How much of this do DORA and banking rules already cover?
A large part. The European Banking Authority mapped the AI Act against EU banking law. It found “no significant contradictions” and saw no “immediate need” for new EBA guidelines (EBA factsheet, 21 November 2025). The EBA says the results may also be relevant for non-bank lenders.
The EBA Chair wrote that “the DORA framework, for instance, extensively covers the cybersecurity and business continuity requirements set out in the AI Act” (EBA Chair letter). DORA has applied since 17 January 2025 (EIOPA, DORA).
In ECB workshops with 13 banks, “about half” had dedicated AI policies or committees. The ECB warns not to generalise from this small sample (ECB Supervisory Newsletter, 20 November 2025). An ECB speaker said that “more than 85%” of large supervised banks already use AI in some form (ECB speech, 24 February 2026).
Does the AI Act apply to a lender or fintech in Bosnia and Herzegovina?
It can. Article 2(1)(c) covers providers and deployers “located in a third country” “where the output produced by the AI system is used in the Union” (Article 2). Check two cases: your scores are used for loans in the EU, or you sell a scoring model to an EU lender.
Two local facts also matter:
- BiH’s new Law on Personal Data Protection has applied since 4 October 2025. Fines for legal entities go up to 4% of global annual turnover (N1 Sarajevo, 14 October 2025). It already applies to customer data in credit models.
- BiH received EU candidate status in December 2022, and the European Council decided in March 2024 to open accession negotiations (European Commission, Enlargement). No official source gives a date for BiH to adopt the AI Act.
We found no published AI guidance from the Central Bank of BiH or the FBiH Banking Agency.
What should a risk team do in the next 90 days?
Start with an inventory and a role check, then close the gaps.
| Days | Step | Owner | Output |
|---|---|---|---|
| 1 to 15 | List every model that scores people or prices credit | Head of risk | Model inventory |
| 1 to 15 | Mark fraud-only models and models that do both jobs | Model owners | Purpose note per model |
| 16 to 30 | Run the provider-or-deployer check for each model | Compliance | Role per model, reviewed by legal |
| 16 to 30 | Check where model output is used: BiH, EU or both | Compliance and product | Scope note |
| 31 to 60 | Map current risk, DORA and data controls to AI Act duties | Risk and IT | Gap list |
| 31 to 60 | Name the people who oversee each model and confirm their training | Head of risk | Oversight register |
| 61 to 90 | Draft the fundamental rights impact assessment for one model | Compliance | First draft |
| 61 to 90 | Confirm log retention and access for each model | IT | Log policy |
AI literacy belongs in this plan too. Article 4 now asks providers and deployers to “take measures to support the development of AI literacy” (Article 4). Our AI enablement programme guide shows how to build it. For AI in your own finance function, read AI for finance teams.
Konzept, a team of 5 in Sarajevo, builds the integrations, data pipelines and audit logs around scoring models through our AI automation service. We do not give legal opinions. To map your models before the 2027 date, book a call.
Sources
- European Commission, AI Act — updated 19 October 2026
- AI Act Service Desk, Annex III — 28 October 2026
- AI Act Service Desk, Article 2 — 28 October 2026
- AI Act Service Desk, Article 3 — 28 October 2026
- AI Act Service Desk, Article 4 — 28 October 2026
- AI Act Service Desk, Article 25 — 28 October 2026
- AI Act Service Desk, Article 26 — 28 October 2026
- AI Act Service Desk, Article 27 — 28 October 2026
- EBA factsheet on the AI Act — 21 November 2025
- EBA Chair letter — 21 November 2025
- EIOPA, Digital Operational Resilience Act — no page date
- ECB Banking Supervision, Supervisory Newsletter — 20 November 2025
- ECB speech, Pedro Machado — 24 February 2026
- N1 Sarajevo, BiH data law — 14 October 2025
- European Commission, Enlargement: Bosnia and Herzegovina — 28 October 2026
FAQ
Is fraud detection high-risk under the AI Act?
Annex III, point 5(b), names AI used to detect financial fraud as an exception to the credit-scoring category. If one model both detects fraud and scores creditworthiness, write down each purpose separately. Then ask your legal team how point 5(b) applies to that model.
Is 2 August 2026 still the deadline for credit scoring?
No. The European Commission states that the Annex III high-risk rules apply from 2 December 2027, after the AI Omnibus entered into force on 27 July 2026. Pages that still give 2 August 2026 were written before the change.
Do we need a fundamental rights impact assessment if we buy the model from a vendor?
Article 27 places this duty on deployers of systems under points 5(b) and 5(c), and a deployer is the body that uses the system under its authority. Buying the model does not move the duty to the vendor, but you need the vendor’s documents to complete it. Confirm your role with the provider-or-deployer check above.
Does the AI Act apply to a bank that serves only clients in Bosnia and Herzegovina?
Article 2(1)(c) reaches providers and deployers in a third country when the AI output is used in the Union. Check where your model output is used and whether you sell models to EU firms, then confirm with your legal team.